Privacy Policy

Last Updated: October 2, 2026

CFG Stadium Group, LLC d/b/a Etihad Park (“CFG Stadium Group”, “Etihad Park”, the “Stadium”, “we”, “us”, or “our”) provides and operates the website currently located at https://etihadpark.com, together with any related websites, mobile applications, digital services, communications and other services that link to this Privacy Policy (collectively, the “Platforms”).

We are excited to engage with you through your use of the Platforms and through our various services, including those related to Etihad Park, Stadium events and operations, provided by CFG Stadium Group (collectively, the “Services”).

This privacy policy (the “Privacy Policy”) explains how CFG Stadium Group collects, uses, discloses and otherwise processes Personal Information (as defined in this Privacy Policy) in connection with the Services and in connection with your interactions with Etihad Park, including your attendance at or participation in events, programs, activities or services at the Stadium. We will not use, disclose, or share your information except as described in this Privacy Policy.

This Privacy Policy applies to visitors to the Platforms and users of any Services. Please remember that you are agreeing that you acknowledge the practices and procedures described in this Privacy Policy. If you provide Personal Information (as defined in this Privacy Policy), you also agree that Personal Information you provide may be transferred from your current location to the offices and servers of CFG Stadium Group, its affiliates, and its authorized third parties. If you do not agree with this Privacy Policy, please do not use the Platforms or any Service.

This Privacy Policy may not apply to Personal Information collected directly by third parties, including ticketing platforms, tenants, teams, leagues, promoters, event organizers, sponsors, food and beverage operators, or other partners. Those parties may provide separate privacy policies or notices, which may apply to their collection and use of your Personal Information.

TYPES OF INFORMATION WE COLLECT

When you interact with us through the Services, we collect the information you provide, usage information, and information about your device. We also collect information about you from other sources like service providers, and optional programs in which you participate, which we may combine with other information we have about you. Here are the types of information we collect about you:

(A). Personal Information

“Personal Information” is information that identifies, relates to, describes, or can be reasonably linked to, directly or indirectly, a particular individual or household. We may collect Personal Information (as we have done for the past twelve months) from you on or through the Services in a variety of ways, including when you register on the Platforms, purchase or engage with a Service, participate in online contests, surveys, or games, sign-up for a newsletter or subscription, or purchase merchandise. We also may, from time to time, receive Personal Information about you from third-party sources to improve the Services, and for the various purposes outlined in this Privacy Policy. We collect both Non-Sensitive and Sensitive Personal Information, as discussed below.

The information described in this Privacy Policy may relate to any individual who visits or attends an event at Etihad Park, including guests of CFG Stadium Group, NYCFC, other tenants, teams, leagues, promoters, event organizers, sponsors, or other authorized third parties.

We have grouped together the following categories of Non-Sensitive and Sensitive Personal Information to explain how we use this type of information.

In the past 12 months we have collected and may collect the following Non-Sensitive Personal Information, from users of the Platforms and Services:

(i). Personal Identifiers, including your first and last name, birthdate, age, gender, and username.

(ii). Contact Information, including your email address, phone number, and home address.

(iii). Biographical Information, including your level of education and professional background.

(iv). Commercial Information, such as products or services purchased.

(v). Inferences drawn from other Personal Information, such as your favorite Club.

(vi). Financial Information, including your credit card number and purchasing history.

(vii). Internet or Other Electronic Network Activity Information, including, but not limited to, your internet browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement.

In the past 12 months we have collected and/or may collect the following Sensitive Personal Information from users of the Platforms and Services:

(i). National or government identifiers, including your social security number.

(B). Device Identifiable Information

We may collect information that may not reasonably identify you or a household personally but is linked to your computer or device (“Device Identifiable Information”). We collect Device Identifiable Information from you in the normal course of providing the Services. When you visit our Platforms to browse, read, or download information, we automatically collect information about your computer that your browser sends, such as your IP address, browser type and language, access times, pages visited, and referring website addresses. We may use Device Identifiable Information to analyze trends, help administer the Services, track the online movement of users, to learn about and determine how much time visitors spend on each page of the Platforms, how visitors navigate throughout the Platforms or use other Services, and to gather broad demographic information for aggregate use. We may also collect Device Identifiable Information through “cookies” or “web beacons” as explained below.

In addition, we may collect information about your mobile device such as the type and model, operating system (e.g. iOS or Android) and version, carrier name, mobile browser (e.g. Chrome, Safari), applications using our Platforms, and identifiers assigned to your device, such as its iOS Identifier for Advertising (“IDFA”), Android Advertising ID (“AAID”), or unique device identifier (a number uniquely given to your device by your device manufacturer), sometimes referred to as a mobile carrier ID.

We may also collect your location information, such as your zip code or the approximate geographic area provided by your Internet service provider (“ISP”) or location positioning information provided by the location services and GPS features of your mobile device when location services have been enabled.

(C). Aggregated and De-Identified Information

We also collect and use aggregated or de-identified information. Aggregated or de-identified information may be derived from or include data collected from performance monitoring devices but is not considered Personal Information under applicable law or this Privacy Policy because this data does not directly or indirectly identify a person. However, when aggregated or de-identified information, including Device Identifiable Information, is directly associated with Personal Information, such that the aggregated or de-identified information can be reasonably associated with a particular individual person or household, then this aggregated or de-identified information is treated as Personal Information. We commit to maintain, use and otherwise process de-identified information only in a de-identified fashion and will not attempt to reidentify such information.

HOW WE COLLECT YOUR INFORMATION

(A). Cookies and Web Beacons

To help us serve you better, through the Platforms we may collect Device Identifiable Information from you through technologies such as “cookies” and “web beacons” (which are also called clear GIFs, pixel tags, or pixels) or by tracking internet protocol (“IP”) addresses.

“Cookies” are small data files that are stored by your web browser when you interact with a website. When you visit a webpage, the cookie sends back Device Identifiable Information.

“Web beacons” are small graphic images (usually invisible) that can be embedded in content and ads on a webpage that track usage of the Platforms and effectiveness of communication. These web beacons can then be used to recognize our cookies and to monitor certain user interactions with a website.

Cookies operate in the background, and you can turn them off by adjusting your Web browser settings, but doing so may make it difficult to use some of the features on the Platforms or the features may not be available to you. We may use cookies to make your Website experience easier by, for example, remembering your preferences, keeping track of your login name and password.

We may also use cookies, web beacons and other activity tracking tools on the Platforms and through other Services to collect your engagement metrics, including your Personal Identifiers and Device Identifiable Information, related to your activity on the Platforms and Services.

For more information on your choices regarding cookies, you can review the FTC’s guide to opting out of online tracking for computers and mobile devices. You can also see the “All Users: Your Rights, Choices and Controls” section below for ways to opt-out.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not want them to track your online activities. The Platforms and Services do not currently support Do Not Track requests.

(B). Other Direct Interactions with You

You give us your information in your direct interactions with us. We collect information you provide to us when you register accounts on our Platforms and other Services; request tickets, newsletters, and other products, services, or information from us; respond to surveys; participate in sweepstakes or contests; or otherwise interact with us. This information includes the categories of Personal Information described in Section 1(A) and Device Identifiable Information, which you give us from time to time.

Except for IP addresses, we may match Device Identifiable Information with Personal Information that we may have from or about you, which would allow us to identify you. We may use this information to provide you with offers that are available where you physically are located.

(C). Social Media

When using the Services or when using certain third-party social networking services (e.g., Facebook, Twitter) (each a “Social Network”), you may have the option to connect your Service information and activity with your Social Network information and activity. If you authorize such a connection, you permit us to share or publish information about your Service activity with that Social Network and its users, and to access certain of your Social Network information, as disclosed to you at the time you consent to the connection. Information we may share with a Social Network may include technical information about your Service activity, your Service comments, or the videos you watch on the Service. Information we may access about you, with your consent, from a Social Network may include, but is not limited to, your basic Social Network information, your location data, your list of contacts, friends or followers and certain information about your activities on the Social Network. If you permit a connection between a Social Network and a Service, we (and that Social Network) may be able to identify you and to associate information received pursuant to the connection with information we already have about you. For more information, please review the privacy disclosures and terms of your Social Network account, which govern how that account information is collected and shared with us.

(D). Other Third-Party Sources

CFG Stadium Group may also receive other information from Service Providers (as defined in this Privacy Policy) in connection with the operation of our Services, including when you purchase our tickets or take our surveys through a third-party vendor. We may also receive information from Service Providers through marketing and demographic studies that we use to supplement Personal Information and de-identified information provided directly by you. Similarly, we may receive Personal Information from advertising partners.

HOW WE USE YOUR INFORMATION

For the Purpose Collected: If you provide Personal Information for a certain reason, we will use the Personal Information in connection with the reason for which it was provided. For instance, if you sign up for an email newsletter, we will use your email address to send you the newsletter. Also, if you register or open an account on the Services, the Personal Information you provide may be used to maintain your account, provide you access to certain features of our Services, or offer you the benefits and privileges that typically come along with registration. These benefits may include access to and use of exclusive or personalized content or activities (such as message boards or digital ticket access), participation in special events and promotions (such as contests and sweepstakes), and delivery of food, beverages, and/or merchandise. As part of these activities, we may use your Personal Information to determine your eligibility, notify you whether you are a winner, and/or fulfill and deliver prizes and orders.

Support from Service Providers: In addition, Personal Information and Device Identifiable Information we collect may be used by us and by third-party service providers (as has been for the past twelve months), such as hosting providers, data management companies, address list hosting companies, e-mail service providers, analytics companies (e.g., Google Analytics), distribution companies, fulfillment companies, payment processors, and other partners that may offer you certain products or services in connection with your use of the Platforms and Services (collectively, “Service Providers”) for a variety of purposes, including to:

contact you about the Platforms and/or Services you have requested;

provide you with Services or information you have requested, or products or services you have ordered or signed up for, such as newsletters;

confirm or fulfill an order you have made;

administer your participation in a contest, sweepstakes, promotion, survey, or voting poll;

facilitate the operation, maintenance and improvement of the Services, our business operations, and internal record keeping;

Share Non-Sensitive Personal Information to our marketing partners to provide you with advertising that may be more relevant to you;

with your permission, send you, or facilitate your receiving, promotional material or special offers from Etihad Park, our affiliates, New York City Football Club, Major League Soccer, our partners or other third parties (such as Stadium tenants or event promoters). If you no longer wish to receive promotional e-mails from us, New York City Football Club, our partners, or have your information shared with third parties as previously described, you may change your mind and/or your preferences by following the directions in the “All Users: Your Rights, Choices and Controls” section of the Privacy Policy below.

Our Service Providers are given the information they need to perform their designated functions in connection with the Services, and, except for those instances we specifically allow, we do not generally authorize them to use or disclose your Personal Information for their own marketing or other purposes.

Identity Verification and Security: We also may obtain information about you from other businesses to verify your identity so we can properly process your requests and prevent fraud. By accessing and using our Services, you agree that we may use your submitted and obtained Personal Information and Device Identifiable Information for such purposes and to maintain the security of the Services.

Product Improvement and Marketing: Etihad Park and our Service Providers may also use your Personal Identifiers, Contact Information, Biographical Information, Financial Information, Device Identifiable Information, and other information collected through the Services to:

help us improve the content and functionality of the Services;

better understand our users and their preferences;

provide customer support;

personalize experiences and product offerings, including targeted advertising, for our Services or the products and services provided by some of our Service Providers; and

tailor payment plan offerings.

We may also use this information to communicate with you regarding the Services and, to the extent permitted by law, to tell you about services provided by others we believe may be of interest to you.

Enforcement and Legal Obligations: We may use your Personal Information to enforce our website terms or investigate and prevent activities that may violate our policies or be illegal, and to respond to legal proceedings and obligations.

HOW WE MAY SHARE YOUR INFORMATION

(A). Our Affiliates and Tenants

We may share your information with the affiliates of CFG Stadium Group, LLC, including but not limited to: New York City Football Club, LLC and its affiliates (collectively, “Affiliates”). In addition, we may share your information with Major League Soccer, its subsidiaries and affiliates, including Soccer United Marketing, and other MLS clubs, in accordance with their respective privacy policies. We may also share your information with tenants and licensees of Etihad Park in accordance with their respective privacy policies.

(B). Business Transfers

In the event of a corporate sale, merger, reorganization, dissolution, or similar event in which a third party assumes control of all or part of our business, Personal Information may be part of the transferred assets or business.

(C). Service Providers

We share Personal Information and Device Identifiable Information with Service Providers, as described above in “How We Use Your Information”.

In addition to the information sharing described above, we may share with third parties aggregated and de-identified information collected on or through the Services for various purposes such as fan research and audience analysis. Aggregated and de-identified information does not include and is not linked to any Personal Information that can identify you or another individual person, but we may use your IP Addresses to verify users’ locations for various purposes, including blackout restrictions.

We may permit access or provide Personal Information to third parties that are providing services on our behalf in connection with the Services, such as hosting, payment processing, and consent verification.

(D). Other Teams, Leagues, Promoters, and Event Organizers

We may share Personal Information and Device Identifiable Information with other sports teams, sports leagues, promoters, event organizers, sponsors, and other authorized partners involved in operating, presenting, administering, or promoting an event or activity at Etihad Park. This may include sharing information for ticketing, event administration, credentialing, access control, security, guest services, marketing, analytics, promotions, hospitality, and other purposes described at or before collection.

In some cases, these parties may independently collect and use Personal Information. Those parties may be separate businesses or data controllers, and their own privacy policies or notices may apply. We encourage you to review the privacy policy or notice applicable to the event, service, or transaction in which you participate.

(E). Third-Party Marketers

With your permission, we may share your Personal Information with our marketing partners and other third parties so that they may contact you directly regarding special promotions or offers (such as subscriptions to and promotions for goods and services, including, for example, through participation in a co-sponsored sweepstakes or contest, or sports betting or gaming promotions). We are not responsible for how these third parties may use your Personal Information, and such uses are subject to their own policies. If you have consented to our sharing of your Personal Information with third parties for such third parties’ marketing purposes, you can change your mind at any time and may let us know by following the instructions in the “All Users: Your Rights, Choices and Controls” section below.

(F). Other Third Parties

We may also share your Personal Information with others when explicitly requested by you (for example, with social media networks). We may also use or disclose your Personal Information as appropriate under applicable laws to respond to requests from public, governmental, and regulatory authorities; to comply with court orders, litigation procedures, and other legal processes; to obtain legal remedies or limit our damages; to protect the operations of our group entities; and to protect the rights, safety, or property of you or others.

(G). Sale and Sharing of Personal Information

Under the California Consumer Privacy Act (“CCPA”), “Share” is defined to include sharing, renting, releasing, disclosing, disseminating, or making available Personal Information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, and a “Sale” is defined broadly to include the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating the Personal Information of a consumer to another business or third party for anything of value.

We do not use or disclose Sensitive Personal Information for purposes other than the purposes listed in section 7027(m) of the CCPA Regulations.

If you are a California resident and would like to opt-out of the Sale of your Personal Information to our sponsors, partners, and other third parties, please contact us at the address provided under the “Contact Us” section below. We do not and will not discriminate against you because you opt-out of the sale of your Personal Information. But, please note that if we are unable to provide your Personal Information to our sponsors or partners it may mean that you will not receive some of the benefits or offers provided to others.

DATA RETENTION

We will only retain Personal Information for as long as necessary to fulfill the purposes for which we have collected such information, including for the purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention periods for all Personal Information, we consider the amount, nature and sensitivity of the Personal Information, legal requirements, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the Personal Information and whether we can achieve those purposes through other means.

COMMUNICATION SERVICES

Short Message Service

We may make available a service through which you can receive messages on your wireless device via short message service (“SMS Service”). You understand that your wireless carrier’s standard rates apply to these messages.

If you subscribe to one of our SMS Services, you may be required to register and provide Personal Information. We may also collect the date, time, and content of your messages in the course of your use of the SMS Service. We will use the information we obtain in connection with our SMS Service for the purpose of sending the SMS messages. If fees are charged to your wireless account invoice, we may provide your carrier with your applicable information to facilitate the transaction in connection therewith. Your wireless carrier and other service providers may also collect data about your wireless device usage, and their practices are governed by their own policies. We may also contact your carrier, which may access the content of your wireless account, for the purpose of identifying and resolving technical problems and/or Service-related complaints. You may change your mind and unsubscribe to SMS Services at any time by following the instructions in the “All Users: Your Rights, Choices and Controls” section below. Additional SMS terms and conditions may apply and will be provided at or before enrollment in the applicable SMS Service.

THIRD-PARTY ADVERTISING

We may allow other companies that are providing advertising content, social networking services, or other services on our Platforms to set and access tracking technologies such as cookies on your computer. These companies may collect information about your visits to the Platforms in order to measure and assess the effectiveness of online advertising and to provide and better target advertisements about goods and services of interest to you. While the information collected by these third parties from you while you are visiting our Platforms is not personally identifiable, some of these third parties may also combine such de-identified information with other information they have collected from various other sources, such as their own past online and/or offline purchase information and web usage from other sites. Such other information may include Personal Information, as well as demographic and behavioral information. Those companies’ use of cookies, and the information collected, are governed by those companies’ privacy policies, not ours. Please see the “All Users: Your Rights, Choices and Controls” section below for ways to opt-out of this third party advertising.

ALL USERS: YOUR RIGHTS, CHOICES AND CONTROLS

You have various choices with respect to the collection of and certain of our uses of the Personal Information we collect from you on or through the Platforms or Services. If you have not consented to us using your Personal Information as described in this Privacy Policy, we will only use it to complete the transaction or provide the service or product you have requested. Please note that not all of these rights may be available to users in all jurisdictions. Please note that if you choose to delete your information or opt out of the collection and use of your information, you understand that certain features of our Website(s) and/or Services may no longer be available to you.

(i). Your Rights

1.1. Right to Opt-Out/Opt-In

If you have agreed to receive communications or solicitations from us (and/or signed up for an account with us), and you later change your mind, you can revise your preferences by contacting us as indicated in the “Contact Us” section of this Privacy Policy. You also may opt out of receiving all future promotional e-mails from us by clicking on an opt-out or “unsubscribe” link within the promotional e-mail you receive. Please understand that if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your other relationship, activities, transactions and communications with us.

If you have agreed to have us share your Personal Information with third parties so that they may contact you about promotions (and/or signed up for an account with us), offers and other information, you can revise your preferences by contacting us as indicated in the “Contact Us” section of this Privacy Policy. If you do request to have us stop sharing your Personal Information with other entities for their direct marketing purposes, such request will only apply as of the date of your request, and we will not be responsible for any communications that you may receive from entities that received your Personal Information prior to such request. In these cases, please contact that entity directly or click on the opt-out or “unsubscribe” link that should be included within the promotional e-mail you receive from such third party. Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize the processing of your Personal Information for the above purposes.

You may opt-out of receiving ads from network advertisers by clicking the AdChoices icon on advertisements that are sent to you, or visiting the opt-out pages on the NAI website and the DAA website. Opting out does not prevent you from seeing ads; it simply means that network advertisers will no longer collect data for the purpose of providing you targeted ads. The DAA and NAI opt-out tools are cookie-based. They signal network advertisers so that they do not collect data online or deliver specific ads targeting you, and only affect the Internet/web browser on the computer where the cookies are installed. These opt-out tools will only function if your browser is set to accept third-party cookies. If you delete an opt-out cookie or all your cookies from a browser’s cookie files, change web browsers or change computers, you will no longer be opted out of our data collection and ad targeting, and we may place a new cookie unless an opt-out cookie is again reset on that browser. Opting out using one browser on one computer will not opt you out using any other browser on the same or another computer.

If you are a resident of the Commonwealth of Virginia (and, beginning on July 1, 2023, Colorado and Connecticut; beginning on January 1, 2024, Tennessee; beginning on July 1, 2024, Texas; beginning on October 1, 2024, Montana; beginning on January 1, 2025, Iowa; and beginning on January 1, 2026, Indiana), applicable law requires us to receive your opt-in consent before processing any “sensitive data”, which includes (1) Personal Information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (2) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; (3) Personal Information collected from a known child; or (4) precise geolocation data. We may process some of your sensitive data in connection with the Services and will ask for your opt-in consent before doing so.

1.2. Right to Know

You have the right to know and confirm that we are processing your Personal Information. You also have a right to access and see what data and Personal information we have collected about you. To the extent feasible, you may request for us to also provide a copy of your Personal Information that you previously provided in readily usable format to permit you to transfer your data to another entity.

1.3. Right to Modify

You have the right to correct any inaccuracies in the data and Personal Information you provide to us.

1.4. Right to Delete

You have the right to request that we delete the Personal Information we have collected from you (and direct our Service Providers to do the same). There are a number of exceptions, however, that include, but are not limited to, when the information is necessary for us or a third party to do any of the following:

Comply with a federal, state or local laws, rules, regulations or other legal obligations;

Investigate, establish, exercise, prepare for, or defend any legal claims;

Provide you a good or service;

Perform a contract between us and you;

Protecting an interest that is essential for your or another natural person’s life or physical safety;

Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; or prosecute those responsible for any such action;

Preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action;

Protect the free speech rights of you or other users;

Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws; or

Conduct internal research to develop, improve or repair our products, services or technology.

(ii). Exercising Your Rights

To exercise your rights under this Privacy Policy, please submit a verifiable consumer request to us as indicated in the “Contact Us” section of this Privacy Policy. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a request to know or delete on behalf of your child by providing proof of identity. You may only make a verifiable consumer request to exercise your right to know twice within a 12-month period at no additional cost to you. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify whether you are the person about whom we collected Personal Information or an authorized representative.

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. We will not discriminate against you for exercising any of your rights described above. Unless permitted by the law, we will not deny you goods or services; charge you different prices or rates for goods or services; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

(iii). Response Timing and Format

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another forty-five (45) days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account, or to the email address associated with the account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will cover the 12-month period preceding receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. Subsection (D) below describes how you can appeal our refusal to take action on a request to exercise your rights.

For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

(iv). Right to Appeal

If we refuse to take action on your request to exercise your rights, you may appeal our refusal. To appeal a refusal, please submit a copy of your request for an appeal and the original request to us as indicated in the “Contact Us” section of this Privacy Policy. Unless otherwise indicated in this Privacy Policy, within sixty (60) days of our receipt of your request for an appeal, we will inform you, in writing, of any action taken or not taken in response to your appeal. We will include a written explanation of the reasons for our decisions. If we deny your appeal, you may contact your local privacy enforcement authority to submit a complaint based on the below information.

ADDITIONAL STATE PRIVACY RIGHTS

Depending on where you reside and whether the applicable law applies to CFG Stadium Group, you may have certain rights regarding your Personal Information. These rights may include the right to confirm whether we process your Personal Information, access, correct, delete, or obtain a copy of your Personal Information, opt out of certain processing activities, limit the use of Sensitive Personal Information, and appeal our decision regarding a privacy request. The specific rights available to you, and any applicable exceptions or limitations, depend on your state of residence, the nature of your relationship with us, the information we collect, and whether CFG Stadium Group is subject to the applicable state privacy law. We will process and respond to requests in accordance with applicable law.

To exercise any applicable rights, please contact us using the information provided in the “Contact Us” section below. We may need to verify your identity before processing your request. We will not discriminate against you for exercising rights available to you under applicable law.

(i). Virginia

If you are a resident of the Commonwealth of Virginia, you can file a complaint with the Consumer Protection Section of the Office of the Attorney General of Virginia at: Mailing address: 202 North Ninth Street, Richmond, VA 23219. Online: https://www.oag.state.va.us/consumercomplaintform/form/start

(ii). Colorado

If you are a resident of Colorado, we will inform you, in writing, of any action taken or not taken in response to your appeal within forty-five (45) days of receipt of your appeal. If we require more time (up to another sixty (60) days), we will inform you of the reason and extension period in writing. If we deny your appeal, you can file a complaint with the Office of the Attorney General of Colorado at: Mailing address: Ralph L. Carr Judicial Building, 1300 Broadway, 10th Floor, Denver, CO 80203. Online: https://coag.gov/file-complaint/

(iii). Connecticut

If you are a resident of Connecticut, you can file a complaint with the Office of the Attorney General of Connecticut at: Mailing address: 165 Capitol Avenue, Hartford, CT 06106. Online: https://www.dir.ct.gov/ag/complaint/

(iv). Utah

If you are a resident of Utah, you can file a complaint with the Office of the Attorney General of Utah: Mailing address: Utah Attorney General’s Office, Utah State Capitol, P.O. Box 142320, Salt Lake City, UT 84114-2320. Online: https://attorneygeneral.utah.gov/contact/complaint-form/

(v). Iowa

If you are a resident of Iowa, you can file a complaint with the Office of the Attorney General of Iowa: Mailing address: Office of the Attorney General of Iowa, Consumer Protection Division, Hoover State Office Building, 1305 E. Walnut Street, Des Moines, Iowa 50319-0106. Online: https://www.iowaattorneygeneral.gov/for-consumers/file-a-consumer-complaint

(vi). California Residents: Your California Privacy Rights

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our customers who are California residents to request and obtain from us once a year, free of charge, information about the Personal Information we disclosed to third parties for direct marketing purposes in the preceding calendar year. If you are a California resident and would like a copy of this notice, please contact us at the email address set forth under the “Contact Us” section below. Not all information sharing is covered by the “Shine The Light” requirements and only information on covered sharing will be included in our response. Under California law, businesses are only required to respond to a request once during any calendar year. If you are a California resident, then you also have certain rights under the CCPA, as amended and expanded by the CPRA, regarding your Personal Information:

(A.) Right to Opt-Out

You have the right to direct us not to Sell your personal information (the “right to opt-out”). If you have opted-in to the Sale of your Personal Information, you may opt-out of future Sales at any time. Once you make an opt-out request, we will wait at least twelve months before asking you to reauthorize the sale of your personal information. You may change your mind and opt back in to the sale of your personal information at any time by opting back in or contacting us at the email address set forth under “Contact Us” below. You do not need to create an account with us to exercise your opt-out rights. We will only use the Personal Information provided in an opt-out request to review and comply with the request.

(B.) Right to Limit Use of Sensitive Personal Information

Under the CCPA, some Personal Information you may provide to us is considered “sensitive” Personal Information, such as your driver’s license, state identification card, financial information, racial or ethnic origin and geolocation. You may, at any time, direct us (and our Service Providers) to limit our use and disclosure of your “sensitive” Personal Information to only those uses which are necessary to perform the Services, or for any other lawful purpose. Once you exercise this right, we will not use or disclose your sensitive Personal Information for any other purposes without your express consent unless permitted by the CCPA or applicable law. However, we may continue to use or disclose your Personal Information that is not considered “sensitive” as set forth in this Privacy Policy.

(C.) Right to Know

You have the right to know and see what data we have collected about you over the past twelve months, including:

The categories of Personal Information we have collected about you;

The categories of sources from which the Personal Information is collected;

The business or commercial purpose for collecting your Personal Information;

The categories of third parties with whom we have shared your Personal Information; and

The specific pieces of Personal Information we have collected about you.

(D.) Right to Modify

You have the right to correct any inaccuracies in the data and Personal Information you provide to us.

(E.) Right to Delete

Complete your transaction;

Provide you a good or service;

Perform a contract between us and you;

Protect your security and prosecute those responsible for breaching it;

Fix our system in the case of a bug;

Protect the free speech rights of you or other users;

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);

Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws;

Comply with a legal obligation; or

Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

(F.) Exercising Your Rights

To exercise your right to know or your right to delete, please submit a verifiable consumer request to us as indicated in the “Contact Us” section of this Privacy Policy. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a request to know or delete on behalf of your child by providing proof of identity. However, please note that we may retain certain Personal Information as permitted by law and will maintain a record of the request as required by § 999.317(b) of the CCPA regulations. You may only make a verifiable consumer request to exercise your right to know twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Only you, or someone legally authorized to act on your behalf, may make a request related to your Personal Information. To have an authorized agent make a request under the CCPA on your behalf, please ask the authorized agent to contact us as set forth in the “Contact Us” section below. Please note that we may require the agent to provide us with proof that you have given them signed permission to submit the request. We may also require that you either verify your identity directly or directly confirm that you provided permission to your authorized agent. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

The requirements above do not apply if you have provided the authorized agent with power of attorney under the California Probate Code sections 4121 to 4130.

We will not discriminate against you for exercising any of your CCPA rights described above. Unless permitted by the CCPA, we will not deny you goods or services; charge you different prices or rates for goods or services; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services. However, please note that if we are unable to provide your Personal Information to our sponsors or partners it may mean that you will not receive benefits provided to other consumers (e.g., sample products or services).

SECURITY PRACTICES

We use reasonable security efforts to protect the Personal Information in our possession. However, no method of transmission or storage of data is 100% secure and we will not be responsible for any damage that results from a security breach of data or the unauthorized access to or use of information, whether Personal Information or Device Identifiable Information. To the extent we provide your Personal Information to any third parties, we will request that they use reasonable security measures to protect your information.

LINKS TO OTHER SERVICES

The Services may contain links to other websites and online services, including links to our Service Providers, partners’ or advertisers’ websites. When you link to such other sites and services (including by means of clicking on hyperlinks, logos, widgets, banners or advertisements), you become subject to their terms of use and privacy policies posted thereon and/or applicable thereto. Because we cannot control the activities of third parties, please note that we are not responsible for the privacy practices of third-party websites. We encourage you to be aware of this when you click on a link and leave the Platforms, and to read the privacy policies of every website that collects Personal Information from you.

U.S. OPERATIONS, NON-DISCRIMINATION, AND MAKING A COMPLAINT

The Services are operated and maintained within the U.S. We make no assurances or representations of any kind that the Services are suitable for use outside the U.S. or in the country in which you reside. The information we collect is kept on servers in the U.S. and may be transferred to servers in other countries, subject to the terms of this Privacy Policy. We retain the Personal Information that we collect for so long as we continue to have a business purpose for it.

By accessing and/or using a Service, establishing an account, or making a purchase, you consent to the processing of your Personal Information as provided in this Privacy Policy. You may withdraw that consent by contacting us as indicated in the “Contact Us” section of the Privacy Policy. Please know that when you withdraw your consent, we may still use your information to the extent necessary to complete a transaction with you or as otherwise permitted by law. You are required to provide certain Personal Information in order to use a Service, to make a purchase or to take advantage of certain features available through the Platforms. Your choice not to provide this information may prevent you from using the Services or may result in a need to terminate your account or an inability for you to use certain features. It is not our intent to discriminate against you for exercising your rights or the choices available to you. But, without certain information, the Platforms and Services may not work as designed.

If you wish to object to or raise a complaint on how we have handled your Personal Information, you may contact us as indicated in the “Contact Us” section of the Privacy Policy.

If you are not satisfied with our response or believe our processing of your Personal Information is not in accordance with law, you may register a complaint with the appropriate governmental authority. CFG Stadium Group controls the Personal Information collected via the Platforms and Services.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy replaces any earlier version. You should review this Privacy Policy periodically as we may modify it from time to time. If we change our Privacy Policy in the future, we will post the changed Privacy Policy on the homepage of the Platforms and other locations where the policy was previously posted. You will be able to determine what version of the Privacy Policy applies by the “Effective Date” placed under the title. Where consistent with applicable law, your continued use of the Services after we have changed the Privacy Policy signifies your acceptance of the revised terms. Under certain circumstances (e.g., with respect to certain material changes to this Privacy Policy, including the way we use or share Personal Information previously collected from you through the Services), we may also elect to notify you through additional means, such as posting a notice on the front page of the Platforms or by means of an e-mail.

CHILDREN’S DATA

The Services are intended for a general audience and are not directed to children under thirteen (13). We do not knowingly collect Personal Information online from children under thirteen (13) without verifiable parental or guardian consent.

If we learn that we have collected Personal Information from a child under thirteen (13) without the required consent, we will take reasonable steps to delete that information. A parent or legal guardian who believes that a child has provided Personal Information to us may contact us using the information in the “Contact Us” section.

We will not condition a child’s participation in an activity on the child providing more Personal Information than is reasonably necessary to participate in that activity.

EXCLUSIONS

This Privacy Policy does not apply to any Personal Information collected by us other than Personal Information collected through the Platforms or Services. This Privacy Policy also does not apply to information about businesses or other non-individual users. We reserve the right to use and disclose aggregated or de-identified information for any commercially reasonable purpose.

CONTACT US

Please feel free to contact us if you have questions or concerns about this Privacy Policy or if you would like to exercise your applicable data protection rights via email at [email protected].