PRIVACY POLICY

TOD. Platform

Last Updated: October 2026

1. INTRODUCTION

1.1 This Privacy Policy explains how TOD. (the “Company”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data in connection with the TOD. platform (the “Platform”) and the services we provide through it (the “Services”).

1.2 We are committed to protecting your privacy and processing your personal data in compliance with Regulation (EU) 2016/679 (the “GDPR”), applicable national data protection laws implementing or supplementing the GDPR, and any other applicable data protection legislation.

1.3 This Privacy Policy applies to all users of the Platform, including Athlete Users, Organization Users, Parents/Guardians of Minor Users, and visitors. Capitalised terms not defined in this Privacy Policy have the meanings given to them in our Terms of Use.

1.4 Please read this Privacy Policy carefully. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. DATA CONTROLLER

The data controller responsible for the processing of your personal data is:

TOD. (Talent on Display)

Email: info@todtalents.com

3. PERSONAL DATA WE COLLECT

We collect and process the following categories of personal data:

3.1 Information You Provide Directly

Account and Registration Data: name, email address, date of birth, country of residence, username, password, and account preferences.

Profile Data (Athlete Users): biographical information, photographs, sport(s), position(s), physical attributes (height, weight), athlete statistics, performance data, achievements, academic information (where applicable), and highlight videos.

Profile Data (Organisation Users): organisation name, type, jurisdiction of establishment, contact details, accreditations, affiliations, and representative information.

Content Data: posts, comments, messages, and other content you create, upload, or share on the Platform.

Communication Data: messages sent through the Platform’s messaging functionality, connection requests, and interaction history.

Payment Data: billing information, payment method details, transaction history, and subscription data. Payment card details are processed by our third-party payment processor and are not stored on our servers.

Parental Consent Data: Parent/Guardian name, email address, contact details, and consent verification records for Minor Users requiring parental consent.

Correspondence Data: information contained in any correspondence you send to us, including support requests, feedback, and complaints.

3.2 Information We Collect Automatically

Device and Technical Data: IP address, device type, operating system, browser type and version, device identifiers, screen resolution, and language settings.

Usage Data: pages visited, features used, clickstream data, time spent on pages, search queries, referral URLs, and interaction patterns.

Location Data: approximate geographic location derived from your IP address. We do not collect precise geolocation data unless you provide explicit consent.

Cookie and Tracking Data: information collected through cookies, pixels, and similar tracking technologies, as described in our Cookie Policy.

3.3 Information from Third Parties

We may receive personal data from third parties, including:

(a) social media platforms, where you use social login to create an Account;
(b) identity verification providers, for the purposes of age or identity verification;
(c) a third-party product analytics provider, if and when we adopt one, who would provide aggregated usage data; and
(d) other users, who may provide information about you (e.g., when tagging you in content or sending you a connection request).

In addition, where we identify publicly available information about prospective or existing users from external sources (for example, published results, team rosters, or news articles), we may use automated tools, including a large language model provided by a third-party vendor, to extract structured data such as names, affiliations, and performance information from a source webpage. We review and allow correction of data obtained in this way. If this results in us holding personal data about you that you did not provide to us directly, we will, where required by Article 14 GDPR, provide you with the information required by that Article.

3.4 Special Categories of Data

We do not intentionally collect special categories of personal data (as defined under Article 9 GDPR), such as data revealing racial or ethnic origin, political opinions, religious beliefs, or health data. Certain information you voluntarily include in your Profile or Content, such as photographs or performance data that may incidentally reveal such characteristics, is not automatically treated as “manifestly made public” within the meaning of Article 9(2)(e) GDPR merely because it was voluntarily submitted, particularly where it is shared through restricted messaging, uploaded as a private document such as a professional licence, or submitted by or about a Minor User. Where we identify that content you have submitted constitutes special category data, we assess the applicable Article 6 legal basis and an applicable Article 9 condition separately, and we minimise our collection and use of such data accordingly.

4. HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes:

(a) Providing the Services: to create and manage your Account, display your Profile, enable you to upload and share Content, facilitate connections and communications between users, and provide the Platform’s core functionality;
(b) Scouting and Discovery: to enable Organization Users to search for, discover, and evaluate Athlete Users, and to facilitate professional networking between users;
(c) Subscriptions and Payments: to process Premium Subscription purchases, manage billing, and handle refunds;
(d) Age and Identity Verification: to verify your age, identity, and, where applicable, parental consent;
(e) Safety and Security: to protect users, particularly Minor Users, detect and prevent fraud, abuse, and violations of our Terms of Use, and ensure the safety and security of the Platform;
(f) Communication: to send you service-related notifications, updates, security alerts, and administrative messages;
(g) Improvement and Development: to analyse usage patterns, improve the Platform’s features and functionality, develop new features, and conduct research and analytics. This includes our own, first-party recording of certain activity, such as profile views and video playback, which we use to operate features including TOD Insights (see Section 4(k)) and to understand product performance; this first-party processing operates independently of any third-party analytics tool we may separately offer, and disabling a third-party analytics tool does not stop this first-party recording;
(h) Marketing: to send you promotional communications about our products and services, where you have consented or where permitted by applicable law. Your marketing preference is recorded centrally and applies across the channels through which we may contact you; you may opt out of marketing communications at any time, and we reconcile your opt-out across our systems before sending further campaigns;
(i) Legal Compliance: to comply with applicable laws, regulations, legal processes, or enforceable governmental requests; and
(j) Enforcement: to enforce our Terms of Use and other policies, and to protect our rights, privacy, safety, or property, or that of our users or third parties; and
(k) Profile Viewing and Insights: to record when you view another user’s Profile, and, subject to the disclosure rules described in Section 4A, to show the Profile owner who viewed their Profile and when, as part of the TOD Insights feature.

4A. PROFILE VIEWING AND INSIGHTS

4A.1 What Profile Viewing and Insights Means

When you view another user’s Profile, we record that you did so, including your identity (such as your name, account type, and avatar) and the date and time of the visit. TOD Insights is a feature that can show a Profile owner a history of who has viewed their Profile and when, rather than only an anonymous count. Viewing a Profile can therefore disclose your identity and the timing of your visit to the owner of that Profile, depending on the disclosure rules described below.

4A.2 Who Receives Named Visit Information

(a) Whether a Profile owner can see the identity of visitors, rather than an anonymised or aggregate count, depends on the visitor’s own viewing preference and, where applicable, on settings associated with the Profile owner’s Account tier.
(b) Your default viewing preference is PRIVATE, meaning your identity is not disclosed to the Profile owner when you view their Profile. You can view and change this preference in your account settings, where a short explanation of the consequences of each setting is also provided.
(c) In some operating configurations, your viewing preference may be fixed to PUBLIC by an administrative setting rather than by your own choice, meaning your identity would be disclosed to Profile owners you visit regardless of your preference, and you would not be able to switch to PRIVATE while that configuration is active. We do not treat activation of such a configuration as your consent to disclosure of your identity. If we operate the Platform with this configuration active for any user, we will provide prominent notice of it, will not rely on a system deployment date as evidence of your agreement, and will offer you an effective way to object before your identity is disclosed to other users. As of the date of this Policy, this configuration is disabled by default.
(d) Hiding your identity from a Profile owner by using the PRIVATE preference, or by blocking a user, stops future named disclosure to that user going forward; it does not retroactively alter or delete visit records already created, which are instead handled under the retention and erasure provisions of Section 9.

4A.3 Profile View Alerts

(a) Depending on your settings and the Profile owner’s notification configuration, viewing a Profile may trigger an in-app, real-time, or push notification to the Profile owner identifying you as a visitor. This is a service notification connected to the Insights feature, and is distinct from, and does not require, your consent to marketing communications or to any optional analytics tool.
(b) Turning off future profile-view alerts, or switching your viewing preference to PRIVATE, stops new alerts from being generated; it cannot retract an alert, in-app message, or notification preview that has already been delivered or displayed, including on a Profile owner’s lock screen, and we do not promise that it can.

4A.4 Legal Basis

We rely on your consent, or on our legitimate interests in operating the Insights feature subject to a documented balancing assessment, as the legal basis for recording and disclosing named visit information, depending on how the feature is configured when you use it. Where we rely on legitimate interests, we apply enhanced scrutiny where a visitor or a Profile owner is a Minor User, and we provide an objection route consistent with Article 21 GDPR. A Profile owner who pays for or otherwise holds Premium access cannot consent on another user’s behalf to the disclosure of that other user’s identity as a visitor.

4A.5 Retention

Named visit records, video-view records, and profile-alert records are retained in accordance with the differentiated periods described in Section 9.2(f).

5. LEGAL BASES FOR PROCESSING

Under the GDPR, we process your personal data on the following legal bases:

Processing is necessary for the performance of the contract between you and the Company (i.e., our Terms of Use), including creating and managing your Account, providing the Platform’s core features, processing subscriptions and payments, and enabling communications between users.

Where required, we process your data based on your freely given, specific, informed, and unambiguous consent, including:

(a) processing personal data of users below the applicable Digital Consent Age, based on the consent of their Parent/Guardian (Article 8 GDPR, as implemented by national law);
(b) placing non-essential cookies and similar tracking technologies on your device;
(c) sending you direct marketing communications; and
(d) processing any special categories of data you voluntarily provide.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where processing is necessary for the purposes of our legitimate interests or those of a third party, and such interests are not overridden by your interests or fundamental rights and freedoms, including:

(a) improving and developing the Platform;
(b) ensuring the safety and security of the Platform and its users;
(c) preventing fraud, abuse, and illegal activity;
(d) conducting analytics and research using aggregated or anonymised data; and
(e) enforcing our Terms of Use and protecting our legal rights.

Where we rely on legitimate interests, we conduct a balancing test to ensure our interests do not override your rights, and we apply enhanced scrutiny where Minor Users are involved.

Processing is necessary for compliance with legal obligations to which the Company is subject, including tax laws, anti-money laundering regulations, and child protection laws.

6.1 The Platform requires users to be at least 13 years of age. Users between 13 and 15 years of age require verifiable Parent/Guardian consent before we process their personal data, regardless of their country of residence. We take the protection of children’s personal data very seriously.

6.2 In accordance with Article 8 GDPR and applicable national implementing legislation, where a user is between 13 and 15 years of age, we obtain verifiable consent from the user’s Parent/Guardian before processing the user’s personal data. We apply this consent requirement uniformly to users in this age range; we do not currently vary the applicable consent age by country of residence, and we will update this Policy if that changes.

6.3 We implement the following safeguards for Minor Users:

(a) limiting the categories of personal data collected from Minor Users to what is strictly necessary;
(b) applying privacy-protective default settings for Minor User Accounts;
(c) restricting the visibility of certain Minor User Profile fields; however, some Minor User Profiles, including those of approved Minor Users, may currently be visible to signed-in Organisation Users and, in some cases, to anonymous visitors who are not signed in, depending on the visibility settings applicable to that Profile. We are assessing this design against the heightened risk of exposing Minor Users publicly and will update this Policy and the applicable defaults as that assessment concludes;
(d) enabling Parents/Guardians to access, review, and manage certain aspects of the Minor User’s Account as described in our Terms of Use; and
(e) providing Parents/Guardians with the ability to request deletion of the Minor User’s Account and associated data at any time by contacting us using the details in Section 15. We are developing a dedicated consent-withdrawal mechanism distinct from account deletion; until it is available, a deletion request is the available route to stop further processing based on a Parent/Guardian’s consent; and
(f) not targeting Minor Users with behavioural advertising or profiling for marketing purposes.

6.4 If we become aware that we have collected personal data from a child under 13 without appropriate parental consent, or from a child below the applicable Digital Consent Age without verifiable parental consent, we will take steps to delete that data as promptly as possible.

7.1 We may share your personal data with the following categories of recipients:

7.1.1 Other Users

Information in your Profile (including your name, sport, statistics, and highlight videos) is visible to other users of the Platform in accordance with your privacy settings. When you send messages or connection requests, the recipients will see the information you provide. Where you view another user’s Profile, your identity and the timing of your visit may also be disclosed to that Profile owner through the TOD Insights feature, as described in Section 4A.

7.1.2 Service Providers

We engage third-party service providers to perform services on our behalf, including:

(a) cloud hosting and infrastructure providers;
(b) payment processors;
(c) error monitoring and application diagnostics providers;
(d) email, push notification, and other communication service providers;
(e) identity sign-in providers (where you use social login) and age or identity verification providers;
(f) content delivery networks; and
(g) customer support tools.

These service providers process your data only on our instructions and in accordance with a data processing agreement that meets the requirements of Article 28 GDPR.

7.1.3 Advertising Partners

If we introduce advertising features in the future, we may share limited personal data (such as device identifiers and usage data) with advertising partners for the purpose of serving relevant advertisements. We will not target Minor Users with behavioural advertising. We will update this Privacy Policy and obtain any required consent before introducing such features.

7.1.4 Legal and Regulatory Disclosures

We may disclose your personal data where required by law, regulation, legal process, or governmental request, or where disclosure is necessary to: (a) protect the safety of any person; (b) investigate potential violations of our Terms of Use; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect our legal rights.

7.1.5 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your personal data may be transferred to the successor entity. We will notify you of any such transfer and any changes to the applicable privacy policy.

7.2 We do not sell your personal data to third parties.

8. INTERNATIONAL DATA TRANSFERS

8.1 Your personal data may be transferred to, stored in, and processed in countries outside the European Economic Area (“EEA”), including countries that may not provide the same level of data protection as your country of residence.

8.2 Where we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

(a) transfers to countries that have received an adequacy decision from the European Commission (Article 45 GDPR);
(b) transfers subject to the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR); or
(c) other appropriate safeguards as provided under the GDPR.

8.3 Where personal data is transferred to the United States, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses supplemented by additional technical and organisational measures as appropriate.

8.4 You may obtain further details of the safeguards we apply to international data transfers by contacting us at the details provided in Section 15.

9. DATA RETENTION

9.1 We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

9.2 The retention period for different categories of data is as follows:

(a) Account Data: retained for the duration of your Account and for 3 years after Account deletion, unless a longer retention period is required by law;
(b) User Content: retained for the duration of your Account and deleted upon Account deletion, except where Content has been shared with or saved by other users, or where retention is required by law;
(c) Communication Data: message content is retained for the duration of your Account. If you delete your Account, your sent messages may remain visible to other participants in the conversation, with your identifying details disassociated from the message record; this disassociation reduces identifiability for other users but does not itself constitute full anonymisation, and message content is not deleted solely based on a fixed time period after Account deletion;
(d) Payment Data: retained for the period required by applicable tax and accounting laws (typically 5-10 years);
(e) Parental Consent Records: retained for the duration of the Minor User’s Account and for 3 years after Account deletion or until the Minor User reaches the age of majority, whichever is later;
(f) Usage and Analytics Data: individual, account-linked usage events (such as profile views recorded for TOD Insights, described in Section 4(k)) are retained in identifiable form for up to 90 days, after which they are rolled into daily aggregate totals that remain linked to the relevant account owner; raw IP address and user-agent data collected from anonymous visitors for deduplication purposes is retained for 24 hours and is not routinely cleared earlier even where its deduplication purpose has already been served; and daily aggregate totals linked to an account owner are retained for as long as the owner’s Account remains active plus the Account Data retention period in paragraph (a), unless we adopt a shorter lifecycle rule. We do not apply a single undifferentiated 26-month retention period to all usage and analytics data;
(g) Cookie Data: retained in accordance with the retention periods specified in our Cookie Policy; and
(h) Premium and Competition Records: records of Premium entitlement grants, revocations, and the administrative reason for each change, together with competition enrollment, qualification, draw, and prize fulfilment records, are retained for 3 years after the relevant grant, revocation, or competition concludes, or for longer where required for tax, audit, or legal-hold purposes. Where your Account is deleted, we disassociate your account reference from these records where technically practicable, but retained free-text fields and frozen draw results are not always fully anonymised by that step alone, and we work to minimise identifying detail that administrators or operators can enter into these records.

9.3 Deleting your Account triggers a 30-day recovery window, during which you may reactivate your Account; this window is a product feature distinct from, and does not extend, any statutory deadline applicable to a data subject rights request you have made. Following the recovery window, or upon fulfilment of a verified erasure request made under Section 10, we delete or anonymise personal data in accordance with our data deletion procedures, including instructing relevant service providers to delete data processed on our behalf, subject to the retention periods described in this Section 9.

10. YOUR RIGHTS

10.1 Under the GDPR and applicable data protection laws, you have the following rights in relation to your personal data:

(a) Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether your personal data is being processed, and to access a copy of your personal data and information about how it is processed.
(b) Right to Rectification (Article 16 GDPR): You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
(c) Right to Erasure (Article 17 GDPR): You have the right to request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful.
(d) Right to Restriction of Processing (Article 18 GDPR): You have the right to request restriction of processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where processing is unlawful.
(e) Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where processing is based on consent or a contract and is carried out by automated means.
(f) Right to Object (Article 21 GDPR): You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we will cease processing without exception.
(g) Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
(h) Right Not to Be Subject to Automated Decision-Making (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, except where permitted by law.

10.2 To exercise any of these rights, please contact us using the details provided in Section 15. We will respond to your request within one month, which may be extended by a further two months where the request is complex or we receive a high volume of requests. We close a rights request only once we have verified that the corresponding action (such as access, correction, deletion, or restriction) has actually been carried out across our own systems and, where applicable, confirmed with the relevant service providers, rather than solely updating the status of the request.

10.3 Where a Parent/Guardian has provided consent on behalf of a Minor User, the Parent/Guardian may exercise these rights on the Minor User’s behalf.

10.4 If you believe that we have not complied with our data protection obligations, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In the Czech Republic, the competent supervisory authority is the Office for Personal Data Protection (Urad pro ochranu osobnich udaju, “UOOU”).

11. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies described in our Cookie Policy to operate the Platform. We separately carry out first-party usage analysis as described in Section 4(g), and profile-view recording as described in Section 4A, which do not depend on cookies. If we introduce advertising cookies or a third-party analytics tool in the future, we will update this Privacy Policy and our Cookie Policy and obtain any required consent before doing so. For detailed information about the cookies and similar technologies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

12. AUTOMATED DECISION-MAKING AND PROFILING

12.1 The Platform may use automated processing, including profiling, to:

(a) suggest connections between Athlete Users and Organisation Users based on athletic performance, sport, and location;
(b) personalise the user experience and recommend content; and
(c) detect and prevent fraudulent or abusive activity; and
(d) select winners in competitions and prize draws using an automated, weighted selection process, as described in the applicable Competition Rules and competition privacy notice.

12.2 The connection-suggestion, personalisation, and fraud-detection processes described in paragraphs (a) to (c) above do not produce decisions with legal or similarly significant effects on you; they are designed to enhance your experience on the Platform and improve the relevance of search and discovery features. We separately assess, on a competition-by-competition basis, whether an automated prize draw under paragraph (d) produces a legal or similarly significant effect for the purposes of Article 22 GDPR, and we describe the outcome of that assessment, together with any applicable safeguards, in the Competition Rules and competition privacy notice for that competition.

12.3 We do not use automated profiling to make decisions that produce legal or similarly significant effects on Minor Users.

13. SECURITY

13.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, in accordance with Article 32 GDPR.

13.2 These measures include, where appropriate, encryption of data in transit and at rest, access controls, regular security assessments, and staff training.

13.3 While we take reasonable precautions to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal data.

14. CHANGES TO THIS PRIVACY POLICY

14.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform’s features, or applicable law. When we make material changes, we will notify you by posting the updated Privacy Policy on the Platform and updating the “Last Updated” date. Where required by applicable law, we will also notify you by email or through an in-platform notification.

14.2 We encourage you to review this Privacy Policy periodically.

15. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us at: info@todtalents.com