Interim text, pending final legal review. Some details are marked as placeholders.

Privacy Policy — Buzztime ProBook

Last updated: [TO BE SET AT PUBLICATION]

1. Introduction

We at eGames.com Holdings, LLC, dba Buzztime, and our affiliated companies and subsidiaries (collectively "Buzztime," "we," "us," "our") are dedicated to protecting your privacy and handling your personal information with care and respect. Whether you are new to Buzztime or a long-time user, please take a moment to read this Policy, and if you have any questions please contact us (Section 17).

This Privacy Policy ("Privacy Policy" or "Policy") applies to the Buzztime ProBook platform (the "Platform") — our free-to-play sportsbook and fantasy games, and the paid fantasy sports contests we offer in New Hampshire under NH RSA 287-H — as provided through our websites, our mobile applications, and businesses and venues operated by our partners. This Policy describes the ways we collect, store, process, transfer, share, and use data that identifies or is associated with you ("personal information") in connection with your use of the Platform.

Information relating to our use of cookies and similar technologies is set out below in our Cookie Policy (Section 14). The Cookie Policy forms part of this Privacy Policy, and whenever we refer to the Privacy Policy we are referring to the Privacy Policy incorporating the Cookie Policy.

Before registering for, installing, and/or using the Platform, please ensure that you have read and understood how we collect, store, process, transfer, share, and use your personal information. Buzztime is the data controller of the personal information we hold about you.

Because the paid contests are offered under a state registration, some of the personal information described below is collected because the law requires us to collect it, and some records must be kept for as long as the law requires, even if you close your account. We say so wherever that applies.

We may change this Policy from time to time, so please check back periodically. When we change this Policy in a material way we will update the date above and notify you on the Platform. Your use of the Platform constitutes your agreement to this Policy (including the Cookie Policy) and to our Terms of Service. If you do not agree to any of the provisions of this Privacy Policy, you should not use the Platform.

2. Personal information we collect about you

Information you provide to us

We collect personal information that you submit directly to us when you (i) register for the Platform; (ii) create or edit your account; (iii) complete identity verification before paid play; (iv) deposit, withdraw, or enter a contest; (v) correspond with us by email or otherwise; or (vi) use the Platform's chat or invite a friend. Such information may include:

Account information: your email address, display name, password (stored only in hashed form), date of birth (declared at registration so that we can refuse registration to anyone under 13 and keep the cash features closed to anyone under 18; the date is held on your Buzztime account profile, which is the record we consult for age), account settings, and marketing preferences.
Eligibility attestations: before paid play you confirm that you are 18 or older, physically located in New Hampshire when you play, and not a prohibited participant (an Operator employee or household member, or an athlete, agent, team employee, referee, or league official in the sport of a contest). We record each attestation with the time and the wording you agreed to.
Identity-verification information (required before paid play): legal name, date of birth, residential address, telephone number, and, where requested, the last four digits of your Social Security number. Your telephone number and any partial SSN are transmitted directly to our independent identity-verification service and are not retained by us. We ask for the telephone number for identity verification only — it is one of the attributes the verification service matches against, and providing it means more players are confirmed from records alone rather than being asked for a photo ID. We do not use it for marketing, it is not a login credential, and it is never shown to other players. Verification outcomes, the verified name and date of birth, and audit records are retained, and the verified date of birth is written to your Buzztime account profile so that the profile agrees with your verified identity. If a records check cannot verify you, you may be asked to photograph a government ID and take a selfie; these images are captured by and transmitted directly to our identity-verification service, which compares the document photo to the selfie, and are not retained by us.
Financial and transaction information: deposits, withdrawals, contest entries, prizes, refunds, reversals, and related ledger records; payment instrument metadata (card brand, last four digits, expiration). Full payment card numbers are never received or stored by us — card data is entered into our payment processor's hosted payment fields and transmitted directly to the processor.
Tax information: IRS Form W-9 information (name, address, taxpayer identification number) when your net winnings reach the federal reporting threshold. We retain only the last four digits of your taxpayer identification number app-side; the full number is handled by our tax-filing process.
Chat and other User Content: messages you post in the Platform's chat, which are visible to other players.
Referrals: if you invite a friend, the email address you give us for the invitation, which we use only to send it.
Communications: support messages and your marketing preferences.

We do not ask for demographic information (gender, education, income, race) on the Platform.

Information we collect automatically

There is certain personal information that we collect automatically as a result of your use of the Platform:

Location information, evaluated at each deposit and each cash contest entry to confirm you are at an eligible venue in New Hampshire — see Section 5.
Gameplay and performance information: contests entered, lineups, results, bets placed with BMO points, and the experience counters (number of paid contests entered, prizes won) that RSA 287-H:3, IX requires us to keep to identify beginner and highly experienced players.
Device and usage information: device and browser type, operating system, IP address, the pages and features you use, and timing of your actions — including logs we use to detect prohibited scripts and automation, multiple accounts, and fraud.
Communications metadata, such as confirmation that a one-time login code was sent to your email address.

The lists in Appendices A and B summarize the categories of personal information we collect about you and how we use that information, together with the legal basis on which we rely to process it. We may link or combine the personal information you provide us with the information we collect automatically.

We may anonymize and aggregate any of the personal information we collect (so that it does not directly identify you). We may use anonymized information for purposes that include testing our IT systems, research, data analysis, improving the Platform, and developing new products and features, and we may share such anonymized information with others.

3. How your information is used

Information you provide or that we collect automatically is used by Buzztime, and by service providers who process the information on our behalf, to:

Provide and operate the Platform and its contests, and settle them.
Comply with NH RSA 287-H and New Hampshire Lottery Commission requirements: verifying age (18+) and identity; confirming New Hampshire location at deposit and cash entry; enforcing prohibited-participant, entry-limit, script, beginner and highly-experienced-player, and self-exclusion rules; and maintaining auditable records of all of these.
Process deposits, withdrawals, and prizes; maintain the financial ledger; prevent fraud, chargebacks, and multi-accounting.
Screen against government sanctions and watch lists as federal law requires, including ongoing re-screening, review of potential matches, and any blocking and reporting of funds that federal sanctions law directs.
Tax reporting (Form 1099-MISC and related obligations).
Responsible-gaming administration (self-exclusion, deposit limits, marketing suppression).
Analyze performance statistics — records of your contests, scores, and results — to operate contests, detect fraud and automation, and improve the Platform. We may use anonymized performance statistics for marketing without identifying you.
Communicate with you: service notifications (login codes, contest results, withdrawal status), responses to your requests, and — if you have opted in — promotional communications about the Platform, which you can opt out of at any time in your account settings or via the unsubscribe link in any such message. We never send promotional communications to self-excluded players or to accounts that have not been age-verified (RSA 287-H:3, VI).

Your display name is public on the Platform. It appears in chat, on leaderboards, and in contest entrant lists and standings, together with the beginner or highly experienced badge that RSA 287-H:3, IX requires. Your email address, real name, and location are never shown to other players.

4. Recipients of your personal information

We share your personal information only with the following:

Identity-verification service — to verify your age and identity as required by RSA 287-H:3, I(f), and to perform the document and selfie check where needed.
Watchlist-screening service — to screen your verified identity against government sanctions and watch lists, with ongoing re-screening, as federal law requires.
Payment processor (Finix) — to process deposits, withdrawals, and payment disputes; the processor also screens payout recipients against global sanctions lists.
Tax authorities and tax-filing services — as required for information reporting.
The New Hampshire Lottery Commission and other authorities — upon lawful request, audit, or as required by our registration.
Independent auditors — for the annual independent audit required by RSA 287-H:3, IV, and for other audits of our controls.
Service providers and advisors under contract — hosting, email delivery, support tooling, and professional advisors — limited to what they need to perform services for us.
Purchasers and third parties in connection with a business transaction — your personal information may be disclosed to third parties in connection with a transaction such as a merger, sale of assets or shares, reorganization, financing, change of control, or acquisition of all or a portion of our business.
Law enforcement, regulators, and other parties for legal reasons — as required by law, or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements, including our Terms of Service; and/or (iii) exercise or protect the rights, property, or personal safety of the Platform, its users, or others.

We do not sell personal information, and we do not share it with business partners for their own marketing.

Your Platform account is a Buzztime player account: your registration information (email address, display name, password, and date of birth) is held on the Buzztime player platform operated by the same company, so that you can use it across Buzztime services.

5. Location information

Before each deposit and each cash contest entry, the Platform asks your browser or device for your location (the browser or device asks your permission first) and checks that you are physically at an eligible venue in New Hampshire. This is a legal requirement of our registration (RSA 287-H; Compliance Specification §7.2), and cash contests cannot be offered to you without it. If you decline to share location, you can still use the free-to-play features and withdraw your balance, but you cannot deposit or enter cash contests.

Each check records the coordinates and accuracy your device reported, device signals we use to detect falsified locations, your IP address, the venue matched (if any), and the result. These records are kept as a regulatory record of every location decision (Section 9) and are available to the New Hampshire Lottery Commission and our auditors. Location checks are not performed for free-to-play features, and we do not track your location between checks.

We may also derive approximate location from your IP address, as most websites do, for security and fraud detection.

6. Communications with us

We communicate with you by email (including one-time login codes and service notices) and, in our mobile application, by push notification to the extent you permit it. We may collect information regarding such communications, such as confirmation that a message was delivered or opened.

7. Storing and transferring your personal information

Security

We have security measures in place designed to help protect your personal information under our control against accidental or unlawful destruction, loss, change, or damage. All personal information you provide via our websites and applications is protected in transit by TLS encryption. Payment card data is confined to the payment processor (processor-hosted fields; the Platform itself never receives a card number). Financial records are kept on append-only ledgers with restricted, logged access, and access to personal information is role-restricted. Please be aware that, despite our efforts, no security measures are perfect or impenetrable, and we cannot guarantee the security of the information you provide to us. We will notify affected users and authorities of a breach as required by law.

You should take reasonable steps to protect against unauthorized access to your password, email account, computer, and web-enabled devices, among other things by signing off after using a shared computer, choosing a password that nobody else knows or can easily guess, and keeping it private. Because login codes are sent to your email address, keep that account secure too. You should never share your login information with others. We are not responsible for any lost, stolen, or compromised passwords, or for any activity on your account via unauthorized password activity.

Consent to international transfers of your personal information

Buzztime and the Platform are operated in the United States and are governed by United States law. If you are located outside the United States, please be advised that any information you provide through the Platform will be transferred to the United States or other designated locations for processing and hosting. By using the Platform, you consent to this transfer and to the use of the information as described herein.

8. Your rights with respect to your personal information

In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

Right of access. You have the right to obtain confirmation of whether, and where, we are processing your personal information; information about the categories of personal information we are processing; and a copy of the personal information we hold about you. Your complete play history and financial transaction history are available to you in your account at any time (RSA 287-H:3, I(i)).
Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format. Your transaction history is exportable from your account.
Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay. You can update your account information at any time in your account settings. Verified identity information can only be changed by repeating verification.
Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified. This right does not extend to records we are required to keep under RSA 287-H, tax law, or other legal obligations — see Section 9.
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified.
Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

To exercise these rights, contact us at legal@buzztime.com (Section 17). We may require additional information from you to verify your identity before acting on a request.

9. Retention of your personal information

Because the paid contests are offered under a state registration, some records must be kept regardless of whether your account remains open:

Your player-facing transaction history — every deposit, withdrawal, contest entry, prize, refund, and reversal — is retained indefinitely so that it remains permanently available to you (RSA 287-H:3, I(i)).
Financial ledgers, identity-verification records, eligibility attestations, location-check records, sanctions-screening records, and self-exclusion records are retained for no less than the periods required by applicable law and our regulatory obligations, and remain available to the New Hampshire Lottery Commission and to our independent auditors.
Tax records are retained as tax law requires.

Other account information is retained for so long as you maintain an account with us. If you close your account, you can instruct us to delete the personal information that is not subject to the retention obligations above, which we will do as soon as we reasonably can after such a request. If you do not request deletion, we may (but are not required to) retain it for up to seven years, in case you decide to reinstate your account or where retention is necessary for compliance with a legal obligation to which we are subject, to resolve disputes, or to protect your vital interests or the vital interests of another person.

10. Choices available for the use of your information

Marketing: if you opted in to promotional communications, you may opt out at any time in your account settings or by clicking the unsubscribe link at the bottom of any such communication. Please be aware that changes may not be effective immediately, so you may continue to receive promotional communications for a short time. You will still receive non-promotional communications from us, such as login codes, contest results, withdrawal status, notices of prizes you have won, or responses to your inquiries.
Responsible gaming: you may set deposit limits or exclude yourself from play from the Responsible Gaming page at any time; self-exclusion also removes you from all marketing.
Location: you may decline location sharing at any time in your browser or device settings; cash deposits and entries will then be unavailable (Section 5).
Account closure: you may close your account at any time from the Platform or by emailing customersupport@buzztime.com. Buzztime may require additional information from you to verify your account prior to closure. Any remaining cash balance is disbursed to you, and the regulatory records described in Section 9 are retained.

11. Your California privacy rights

California law permits visitors who are California residents to request certain information regarding our disclosure of personal information to third parties for such third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. To make such a request, please send an email to legal@buzztime.com or write to us at Buzztime, 6965 El Camino Real, Suite 105 #517, Carlsbad, CA 92009.

12. New Hampshire privacy rights

13. Third-party sites or services

The Platform may include links to other sites, such as the responsible-gaming resources we link to. By clicking a link, you may be directed to third-party sites or services. These third parties may collect information from and about you. They are not covered by this Policy, and Buzztime is not responsible for their privacy practices, the content of their sites, or their products or services.

The Platform does not offer sign-in through social networks and does not embed third-party advertising or analytics (Section 14).

14. Cookie Policy

This Cookie Policy forms part of our Privacy Policy and should be read together with it.

What are cookies?

Cookies are small text files placed on your computer, phone, or other device when you visit websites and are used to record information about your activity. Cookies can be "persistent" or "session" cookies. Persistent cookies stay on your device for a set period of time or until you delete them, while session cookies are deleted once you close your web browser.

How we use cookies

The Platform sets one cookie, which is strictly necessary to operate the service:

Login session (probook_session) — Operational / Security. Keeps you signed in after you enter your login code, and lets the Platform recognise your account on each request. It is not readable by scripts, is sent only to the Platform, and expires after a set period or when you sign out.

The Platform does not use advertising cookies, analytics cookies, pixels, or third-party tracking technologies, and it does not share your activity with advertising networks. The mobile application may store your login on the device so that you do not have to sign in each time.

Do Not Track disclosure

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Because the Platform does not track you across other websites or serve tailored advertising, there is no cross-site tracking for a DNT signal to switch off, and we do not otherwise alter the Platform's behaviour in response to DNT signals.

15. Children and age

The Platform is not intended for, and may not be used by, anyone under 13 years of age. Players between 13 and 18 may use the free-to-play features with the agreement of a parent or legal guardian, as the Terms of Service describe. Cash contests — and the identity verification, deposits, and location checks that go with them — are available only to players 18 and older (RSA 287-H:3, I(f)); an account registered as under 18 cannot begin identity verification until the player is 18.

We refuse registration to anyone whose declared date of birth shows them to be under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently received personal information from a child under 13, we will take reasonable steps to delete it. If identity verification determines that a player who attempted paid play is under 18, the account is permanently locked out of paid play, any deposits are refunded to their source, and we retain the record of that determination that the law requires.

16. Appendices — categories of personal information

Appendix A – personal information collected by us from you

Contact and account information (email address, display name, password, declared date of birth, account settings) — used for: account registration and login; service communications; enquiries and complaints; refusing registration to persons under 13 and keeping cash features closed to persons under 18. — Legal basis: performance of a contract; compliance with legal obligations; legitimate interests (administering the Platform, communicating with you).
Eligibility attestations (18+, New Hampshire, not a prohibited participant; time and wording version) — used for: eligibility for paid contests; regulatory record. — Legal basis: compliance with legal obligations (RSA 287-H:3, I(e)–(f)).
Identity-verification information (legal name, date of birth, residential address; telephone number and partial SSN passed through and not retained; ID document and selfie captured by the verification service and not retained by us; verification outcome) — used for: verifying age and identity before paid play; underage lockout; sanctions screening. — Legal basis: compliance with legal obligations (RSA 287-H:3, I(f); federal sanctions law).
Payment information (card brand, last four digits, expiration; never the full card number) — used for: deposits, withdrawals, and payment disputes. — Legal basis: performance of a contract.
Financial and transaction information (deposits, withdrawals, entries, prizes, refunds, reversals, ledger records) — used for: operating the Platform; your transaction history; segregation and reconciliation of player funds; fraud and chargeback prevention. — Legal basis: performance of a contract; compliance with legal obligations (RSA 287-H:3, I(i), VIII).
Tax number or government identifier (W-9 information; last four digits retained app-side) — used for: compliance with reporting obligations to tax authorities for prize winnings. — Legal basis: compliance with legal obligations.
Chat, comments, and User Content — used for: operating and providing features of the Platform; addressing questions, issues, and concerns; moderation. — Legal basis: performance of a contract; legitimate interests (communicating with users, keeping the Platform safe).
Referral email addresses (with your permission) — used for: sending the invitation you asked us to send. — Legal basis: consent.
Responsible-gaming choices (deposit limits, self-exclusion) — used for: enforcing the limits you set; marketing suppression. — Legal basis: compliance with legal obligations (RSA 287-H:3, I(j), VI); performance of a contract.

Appendix B – personal information we collect automatically

Location information (coordinates, accuracy, device signals, IP address, venue matched, result — at each deposit and cash entry) — used for: confirming physical presence at an eligible New Hampshire venue; detecting falsified locations; regulatory record. — Legal basis: compliance with legal obligations (RSA 287-H; Compliance Specification §7.2); consent (device location permission).
Gameplay and performance information (contests, lineups, results, BMO bets, experience counters) — used for: operating and settling contests; beginner and highly-experienced-player identification; fraud detection; improving the Platform. — Legal basis: performance of a contract; compliance with legal obligations (RSA 287-H:3, IX); legitimate interests (improving the Platform).
Log files and device information (device type, operating system, browser, IP address, pages and features used, timing of actions) — used for: presenting the Platform on your device; security; detecting prohibited scripts, automation, and multiple accounts; resolving issues; improving the Platform. — Legal basis: legitimate interests (administering, securing, and improving the Platform); compliance with legal obligations (RSA 287-H:3, VII).

17. Questions or complaints? Contact us

If you have any questions or complaints about this Policy or the practices on the Platform, you may contact us at:

Via Certified Mail: eGames.com Holdings, LLC, Attn: Legal Dept. (Privacy Policy), 6965 El Camino Real, Suite 105 #517, Carlsbad, CA 92009

Via Email: legal@buzztime.com, Subject: Privacy Policy

Support: customersupport@buzztime.com