Updated: June 30, 2023

OUR COMMITMENT TO PRIVACY - DRAFTKINGS SPORTSBOOK & CASINO

DraftKings strives to offer the most innovative and entertaining games found anywhere on the Internet. To ensure the trustworthiness of our games and the quality of your experience, we collect and process information about our users. We are committed to handling that information with respect, because your privacy is important to us. Crown DK CAN Ltd. ("DraftKings," "DK," "we," "us," or "our") has prepared this Privacy Policy to explain why and how we collect, use, and share information about users of our websites located at http://sportsbook.draftkings.com/ and http://casino.draftkings.com/ ("Website"), our mobile application(s) ("Application(s)"), and our online gaming products and related services available through the Website and the Applications including our social networking features (collectively, "Services"). This Privacy Policy does not apply to websites, applications, or services that do not display or link to this statement or that display or link to different privacy statements.

Our Website, Applications, and Services are provided as part of the open and regulated internet gaming market in Ontario conducted and managed by iGaming Ontario ("iGO") and we collect, use, and disclose personal information on behalf of, and as an agent to, iGO.

TABLE OF CONTENTS

1. YOUR ACCEPTANCE OF THIS PRIVACY POLICY
2. APPLICATION OF THIS PRIVACY POLICY
3. THE PERSONAL INFORMATION WE COLLECT, ITS SOURCES, AND THE PURPOSES FOR COLLECTION
1. Information You Provide To Us
2. Information Collected via Technology
3. Information Collected From or About Friends
4. Information Collected from Other Sources
4. INTERACTION WITH THIRD-PARTY SITES AND SERVICES
5. ADDITIONAL USES OF PERSONAL INFORMATION
6. ADDITIONAL DISCLOSURES OF PERSONAL INFORMATION
7. BIOMETRIC VERIFICATION
8. SECURITY AND RETENTION OF PERSONAL INFORMATION
9. BREACH OF SECURITY SAFEGUARDS
10. YOUR CHOICES REGARDING PERSONAL INFORMATION
11. HOW TO ACCESS OR CORRECT PERSONAL INFORMATION
12. HOW WE RESPOND TO DO NOT TRACK SIGNALS
13. PROHIBITED USERS
14. MINORS
15. INTERNATIONAL INFORMATION HOSTING/DATA STORAGE
16. LODGING A COMPLAINT
17. CHANGES AND UPDATES TO THIS PRIVACY POLICY
18. HOW TO CONTACT US

1. YOUR ACCEPTANCE OF THIS PRIVACY POLICY

By opting inand using our Website, Application(s), or Services, you agree to accept this Privacy Policy, including its terms and conditions that relate to the ways we collect, use, and disclose your personal information. By opting in, you consent to our collection, use, and disclosure of your personal information in the ways described in this Privacy Policy. You can withdraw your consent to the collection, use, and disclosure of your personal information at any time. If you chose to withdraw your consent, we may not be able to provide you with access to, or use of, our Website, Applications, and Services.

2. APPLICATION OF THIS PRIVACY POLICY

DK is collecting personal information pursuant to Ontario's Freedom of Information and Protection of Privacy Act ("FIPPA"), Ontario Regulation 722/21 made under the Alcohol and Gaming Commission of Ontario Act ,DK's Operating Agreement with iGO and applicable Canadian federal and provincial privacy laws.

3. PERSONAL INFORMATION WE COLLECT, ITS SOURCES, AND THE PURPOSES FOR COLLECTION

In this section we describe the types of personal information that we collect, the sources from which we collect it, and the specific reasons why we collect it. As a general rule, we collect your personal information to perform our obligations to iGO under our Operating Agreement with iGO. We will not collect personal information from you for purposes that are not permitted under the Operating Agreement or applicable law.

a. Information You Provide to Us

• You may choose voluntarily to provide certain personal information to us. Personal information is any information about an identifiable individual, such as your real name, username, address, email address, phone number, gender, date of birth, age, payment card information, banking and other financial information, billing information, identity verification/authentication information such as your driver's license number, an image of your ID card, social insurance number, and profile photograph or other photograph. For example, when you create an account to log in to our network ("Account"), you may decide to share your full legal name, alias, date of birth, location, email address, personal and business phone number, username and password, street address, country of residence, occupation, name and address of your employer, along with an attestation as to whether you are a politically exposed person ("PEP"), head of an international organization ("HIO"), or a family member or close associate of a PEP or HIO and, if so, the sources of your funds and wealth and the nature of your connection to the PEP or HIO. We need this information to set up your Account, verify your identity, detect fraud, comply with our legal obligations, and provide you with our Services.
• When you use our Website, Applications, or Services, or deposit or withdraw funds from your Account, we may collect all information necessary to complete the transaction and provide you with the Services and to comply with our legal obligations, including your name, address, email address, phone number, payment card information and other billing information, social insurance number, and records of the products and Services you purchased, obtained, or considered.
• If you provide us feedback or contact us via email, we will collect your name and email address, as well as any other content provided in the email, in order to send you a reply, provide customer and technical support, improve and optimize our Website, Applications, and Services, satisfy our legal obligations, enforce our contracts, and address any existing or anticipated disputes.
• We will collect the profile photo you upload and username you choose for your public profile page including in connection with our social networking features ("Profile") to give you a personalized experience of our Website, Applications and Services. When you participate in any contest, game or other gaming-related product or promotion through the Website, Application(s), or Services (each, a "Game" or, collectively, "Games"), other participants (each, a "Player") will be able to see the information you selected for your Profile. Participation in Games is completely voluntary and you may choose whether to participate and, therefore, disclose the personal information required by the Games.
• If you tell us where you are (e.g., by allowing your device to send us your location or by otherwise permitting us to geolocate you), we may store and use that information to verify your eligibility to enter certain Games, to comply with relevant laws, and for fraud prevention purposes.
• When you participate in one of our surveys, we may collect additional information about your Profile, activity, usage, and preferences related to the Website, Applications and Services, so that we can evaluate your interest in and the quality of our products, Services, and customer and technical support. Participation in surveys is completely voluntary and you may choose whether to participate and, therefore, disclose the personal information required by the survey.
• If you participate in a sweepstakes, Game, or giveaway through our Website, Applications or Services, we may collect your email address and phone number, to notify you if you win or not. We may also ask for users' first and last names and addresses, in order to verify their identities. In some situations we may need to collect other information about user preferences as part of the entry process, such as a prize selection, or in connection with the award of prizes over a certain dollar amount. Such sweepstakes and Games are voluntary and you may choose whether to participate and, therefore, disclose the personal information required by the sweepstakes, Game or giveaway. We recommend that you read the rules for each sweepstakes and Game before you enter it.
• In the event you use our social networking features, we may collect and other DraftKings users may be able to see your Profile information, including your username, real name, photo, location, the content you post on your social feed and the feeds of other DraftKings users, and any other information you choose to upload or share. We may also collect, and other DraftKings users may be able to see, information about the Games you participate in, including the bets you have made and your betting unit data as shown in your betting feed, along with your aggregated betting data on our trending bets page. In the event you elect to sync, upload, or import data about your contacts from your device's address book using our contact importer tool, you must first ensure that you have the consent from your contacts to send their information to us and that they agree we may collect and use that information to provide you and your contacts with our Services, help you find and connect with your contacts through our social networking features, help your contacts connect with you through our social networking features, and for other purposes set forth in this Privacy Policy. Our contact importer tool may not be available to users in certain countries. In general, the information you choose to provide when using our social networking features is public and you should exercise caution and good judgment before you post, upload, sync, import or otherwise share personal information with us and others, in order to avoid disclosing sensitive, harmful, or unlawful information. You are solely responsible for the content you post and other information you provide, whether by posting, syncing, importing, uploading or otherwise, when you choose to use our social networking features. You may control who is able to view and access the information you share by using our social privacy settings. The privacy settings allow you to determine who is able to see your Profile information and Game participation activity through our social networking features; who can add you as a friend on DraftKings; who can find you in a username search; who is able to see your real name on search and friends lists; whether you will receive notifications of replies and reactions to your posts; whether you will receive notifications that someone has posted content to your feed or mentioned you in a post; who can see your posts; who is able to see your betting unit data alongside the bets shown in your betting feed; who is able to share their bets with you and invite you to place a bet; and who will be able to see your aggregated betting data on our trending bets page. However, please note that, neither you nor we can control what others do with your personal information once you share it publicly.

b. Information Collected via Technology

• Information Collected by our Services. In order to improve, personalize, and optimize our Website, Applications and Services and meet our legal obligations, we may automatically track certain information about your visits to and usage of our Website, Applications, and Services, including your browser type, operating system, Internet Protocol (IP) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session), device identifier, domain name, clickstream data, referring/exist pages, geolocation, and a date/time stamp for your visit. We also use this information to analyze trends, administer the Website, Applications and Services, gather demographic information about our user base, deliver advertising, perform research, provide technical and customer support, inform our product development efforts, protect our legal rights, address disputes, and prevent our Services from being used to commit harmful or unlawful activities, including fraud. Some of this information may also be collected so that when you use the Website, Applications, or Services again, we will be able to recognize you and optimize your experience accordingly.
• Device Information. We may collect information about the devices you use to access our Website, Application and Services, including the hardware models, operating systems and versions, software, file names and versions, preferred languages, unique device identifiers, advertising identifiers, serial numbers, device motion information, and mobile network information. If you have downloaded our mobile Application(s), we may also collect certain information from your mobile device, including information about how you use the Application(s). This information is generally used to help us deliver relevant information to you. In the event our Application(s) crash on your mobile device, we will also receive information about your mobile device model software version and device carrier, which allows us to identify and fix bugs, provide other technical support, and improve and optimize the performance of our Application(s).
• Cookies. Like many online services, we use "cookies" to collect technical information. Cookies are small pieces of information that a website sends to your computer's hard drive while you are viewing the website. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Website, Applications, and Services. We may use cookies to collect information about your IP address, browser type, operating system, device type and identifiers, platform type, as well as your usage of and activity on our Website and Application(s) and the performance of our Services. These types of information are collected to make the Website, Application(s) and Services more useful to you and to tailor your online experience to meet your special interests and expectations. You can use the options in your web browser to notify you when you receive a cookie or you may change your cookie preferences in your Internet browser or with third parties. You can control and/or delete cookies used by our Services at any time. For instructions on how to delete cookies using your particular internet browser, visit https://www.aboutcookies.org/. You can delete all existing cookies on your computer and adjust settings for most browsers to prevent cookies from being received.
• Pixel Tags. In addition, we use "pixel tags" (also referred to as clear gifs, web beacons, or web bugs). Pixel tags are tiny graphic images with a unique identifier, similar in function to cookies, that are used to track online movements of web users. In contrast to cookies, which are stored on a computer's hard drive or web browser, pixel tags are embedded invisibly in web pages. Pixel tags are often used in combination with cookies, trigger the placing of cookies, and transmit information to us or our service providers. This enables two websites to share information. The resulting connection can include information such as a device's IP address, the time a person viewed the pixel, an identifier associated with the browser or device, the type of browser being used and the URL of the web page from which the pixel was viewed. Pixel tags also allow us to send email messages in a format that users can read, tell us whether emails have been opened, and help to ensure we are sending only messages that may be of interest to our users. We may also use this information to reduce or eliminate messages sent to a user.
• Threat Detection. We use certain service providers, such as ThreatMetrix, to provide threat detection, user authentication, and fraud prevention services. These service providers may automatically collect certain information about your visits to the Website and Application(s), as well as the device you use to connect to our Services, in order to monitor for potential threats and bad actors. This information may include, among other things, your IP address and your device's unique identifiers. If you would like to know more about ThreatMetrix's data privacy practices, please review their privacy policy located at: https://www.threatmetrix.com/privacy-policy.
• Collection of Data in Connection with Advertising. We may use certain vendors to serve ads on our Services, as well as on other websites, applications, and social media networks. In connection with the delivery of advertising, certain vendors, including, but not limited to, Facebook, Twitter, Reddit, TikTok, Snapchat, FantasyPros, LiveRamp, The Trade Desk and TruSignal, may collect information about you and your visits to this and other websites. That information may include your IP address, internet service provider, unique personal identifiers (e.g., email address), and the browser you use to visit and use our Services and other websites and applications. They may do this by using cookies, beacons, pixel tags, clear gifs, or other technologies. The information collected may be used, among other purposes, to deliver advertising targeted to your interests and to better understand your usage of, preferences on, and visitation of our Services and other sites, social media networks, and applications tracked by such vendors. This Privacy Policy does not apply to, and we are not responsible for, cookies, pixel tags and other technologies used in connection with other parties' ads, and we encourage you to check the privacy policies of advertisers and ad services to learn about their use of such technologies. If you would like more information about these practices to understand your options for not having your information collected and used by such companies, please click http://www.aboutads.info/choices and https://www.networkadvertising.org/.
• Third Party Analytics. We use a number of service providers, such as Google Analytics, to help analyze how people use our Website, Applications and Services ("Analytics Companies"). Analytics Companies use cookies and similar technologies to collect information pertaining to how people use our Website, Applications and Services, what pages they visit, and what other sites they may have used prior to using our Website, Applications, and Services. The information generated by the cookies used by these Analytics Companies (including your IP address) is transmitted and stored by the Analytics Companies on their servers. The Analytics Companies use this information to evaluate the way visitors use our Website, Applications and Services, compile reports to us on Website, Applications and Services activity and provide other services relating to Website, Applications and Services activity and internet usage. We use the information we get from Analytics Companies to improve and optimize our Website, Applications, and Services. The Analytics Companies may also transfer this information to third parties where required to do so by law or where such third parties process the information on the Analytics Companies' behalf.
• Referral Affiliates. We may enter into agreements with companies that refer users to our Services via hyperlinks available on the referring party's website. We may automatically collect certain information, such as your IP address, other personal identifiers, and the identity of the referring website via cookies, pixel tags and similar technologies that are provided to us in connection with your use of the referring party's website.
• Location Information. We may collect your location information, including your geolocation records, for purposes of verifying whether you are eligible to participate in a Game, sweepstakes, or giveaway or to determine if you are otherwise permitted to use our Website, Application(s), or Services. We may also use such information to comply with our legal obligations, protect our legal rights, and address existing or anticipated disputes.

c. Information Collected From or About Friends

• Refer-a-Friend. Our Services enable you to invite your friends to join in the fun. We offer several ways to invite friends to play on the Website and Applications. All options include the use of a unique URL link provided to you by DraftKings that you must use to direct people who do not have an existing Account to the Website and Applications to become a referred friend ("Link"). You may share the Link with friends via email, text, Twitter, Facebook, and other ways. When a friend uses the Link to register an Account on DraftKings, the Link enables us to associate that friend with the referrer, primarily for the purpose of awarding bonuses. The Link and the terms and conditions of the Refer-a-Friend program are available at DraftKings Refer a Friend Terms. We also employ techniques to facilitate invitations to friends using the Link, including a contact importer tool that allows you to add your contacts, including those in your address book, so that you can ask them to join DraftKings and communicate with you through the Website, Applications, and Services. Our contact importer tool may not be available to users in certain countries. In the event it is available, with your permission, we will access your address book and import your contacts' names, email addresses, phone numbers, locations, and associated details to determine which of your friends have not registered an Account on DraftKings. We rely upon you to obtain any consents from your friends that may be required by law to allow us to access, upload, and use their data for this purpose. You or your friends may contact us at privacy@draftkings.com to request the removal of this information from our database.
• Find-a-Friend. Our Services may also enable you to invite your friends who already have an Account to participate in a Game. In order to invite friends with Accounts to join a Game, you may: (i) enter your friend's username associated with their Account to find and locate them; or (ii) in the event you are using our Application(s), use our contact importer tool to import and search through your contacts, including contacts in your address book to match those of your friends who are also registered DraftKings users. Our contact importer tool may not be available to users in certain countries. In the event it is available, with your permission, we will access your address book and import your contacts' names, email addresses, phone numbers, location, and associated information to facilitate the connection with your friends. Again, it is your responsibility to obtain any consents from your friends that may be required by law to allow us to access, upload, and use their personal information for this purpose.

d. Information Collected from Other Sources

We may supplement the information we have about you with information received from other sources including from our pages on certain Social Networking Sites, the Social Networking Sites themselves, and from commercially available sources (e.g., data brokers and public databases). Your activity on other websites and applications may be associated with your personal information in order to improve and customize our Services and the ads delivered on our Website and Application(s). The information we receive may include demographic data such as age, gender and income level, your preferences, interests, associations, commercial information, including records of products or services purchased, obtained, or considered and other purchasing or consuming histories or tendencies, as well as information regarding your interaction with various websites and applications, including the Services. This information is used to create and deliver advertising, improve and optimize our marketing efforts, perform user verification, authentication and fraud detection, and comply with our legal obligations.

4. INTERACTION WITH THIRD-PARTY SITES AND SERVICES

Certain products, services, or other materials displayed on the Website and Applications may integrate with, be integrated into, or be provided in connection with certain third-party services and content. We do not control those services and content and our Terms of Use and this Privacy Policy do not apply to those services and content. You should read the terms of use agreements and privacy policies that apply to such services and content. DK is not responsible for the practices used by any third-party websites or services linked to or from our Website or Application(s), including, without limitation, the information or content contained within them. By using our Website, Application(s), or Services, you acknowledge and agree that we are not responsible for and do not have control over any third-party services and content that you authorize to access information you provide to them. If you are using a third-party website or service and allow it to access your personal information, you do so at your own risk.

5. ADDITIONAL USES OF PERSONAL INFORMATION

User Feedback. We may post user feedback on the Website and Application(s) from time to time. We will share your feedback with your first name and last initial only. If we choose to post your first and last name along with your feedback, we will obtain your consent prior to posting. If you make any comments on a blog or forum associated with the Website, Application(s) or Services, you should be aware that any personal information you submit there can be read, collected, or used by other users of the blog or forum and might be used to send you unsolicited messages. We are not responsible for any personal information you choose to submit in these blogs and forums.

Creation of Aggregated, Anonymized, or De-Identified Data. We may create aggregated, anonymized or de-identified data (i.e., data that is not reasonably capable of being associated with or linked to you) from personal information we collected from or about you. We use such data to analyze request and usage patterns, so that we may improve, optimize, or enhance our Services and improve our users' experience with and ability to navigate our Website and Application(s). We reserve the right to use aggregated, anonymized, or de-identified data for any purpose and disclose it to third parties for any reason.

Responsible Gaming. As part of DraftKings' commitment to responsible gaming, we may use the information collected about you to assess whether you are responsibly playing the Games. In the event we identify potentially problematic information, we may reach out to you to provide resources to help ensure that you are playing the Games responsibly. By using our Website, Application(s) or Services, you consent to our use of your information for these purposes.

6. ADDITIONAL DISCLOSURES OF PERSONAL INFORMATION

In addition to the sharing practices discussed above, we may disclose your personal information to fulfil the purposes for which you have provided it to us, including in these circumstances:

• Parties You Share With. When you use the Website, Application(s) or Services, the personal and other information you choose to provide, including through our social networking features, will be shared with parties you allow to receive such information. For example, you may elect to communicate personal information to your friends and other Players, including those who are participating in the same Game as you. In addition, any information you post, upload, or disclose through your use of our social networking features may be available to other DraftKings users and the general public. Please use caution with your personal information and make sure that any personal information that you share is material you are comfortable being publicly viewable. As provided above, by using the social privacy settings, you may control who may view your social networking Profile information, your Game participation activity you share through the social networking features, and the notifications you would like to receive through the social networking features.
• Service Providers. We may share your personal information with certain service providers to provide you the Services we offer through our Website and Application(s); conduct quality assurance testing; facilitate the creation of accounts; provide account authentication and user verification services; provide technical and customer support; geolocate users; personalize, customize, and improve your use and experience of the Services; process payments to you and other financial transactions; send email and push notifications; enable security support and technical maintenance; send you newsletters, surveys, messages, and promotional materials related the Services or on behalf of other companies; verify your identity; prevent harmful or unlawful uses of our Services, including fraud; deliver you customized or personalized content, information, and advertising; understand when users have installed our Application(s); monitor the health and performance of code on users' devices; request user feedback; send users links to download our Application(s); monitor the health of our servers; manage search engine optimization; and improve and optimize the performance of our Services.

By accepting this Privacy Policy and using our Website, Application(s), or Services, you authorize third parties, which may include your mobile operator(s), internet service provider(s), financial institution(s), as well as government organizations and other authoritative data sources, to disclose to DraftKings and its data processing partners your personal information for the purposes of validating your identity and preventing fraud on your account. This information may include your credit record number, IP address, device identifier, browser type, operating system, location, and data regarding your interaction with an Internet website or application. You also authorize DraftKings to disclose your full name, data of birth, and address directly to our data processing partners for the purpose of verifying your identity. For such purpose, you permit DraftKings' data processing partners to verify your identity with a credit bureau and access your credit file solely for the purpose of identity verification which will not affect your credit score. This data will be maintained for the duration of the business relationship and any legally required retention period.

We also use the personal information we collect in connection with your use of our Website, Application(s), and Services to detect and prevent fraudulent, abusive, and other illegal or malicious activity. We share this information with Sift Science, Inc. (d/b/a Sift), a third-party service provider, to assist us with this effort. To learn more about Sift, please review Sift's Service Privacy Notice .

• Professional Financial and Legal Advisers. From time to time, we may also need to share your information with professional advisers, including lawyers, auditors, bankers, insurers and consultants, in order to obtain advice or other professional services from them. Such advisers are bound by legal and/or contractual duties of confidentiality and other prohibitions against disclosure of personal information.
• Co-Branded Partners. Co-Branded Partners are companies with whom we may jointly offer a service or feature. You can tell when you are accessing a service or feature offered by a Co-Branded Partner because the Co-Branded Partner's name will be featured prominently. You may be asked to provide information about yourself to register for a service offered by a Co-Branded Partner. In doing so, you may be providing your information to both us and the Co-Branded Partner, or we may share your information with the Co-Branded Partner. Please note that the Co-Branded Partner's privacy policy and terms of use may also apply to its use of your information and you should familiarize yourself with the privacy policy and terms of use of any Co-Branded Partner you access. DK is not responsible for the practices used by Co-Branded Partners. In addition, by using our Website, Application(s), and Services, you acknowledge and agree that we are not responsible for and do not have control over any Co-Branded Partners.
• DK Promotions. When you participate in a Game, we may collect and use your name, likeness, voice, testimonials, and biographical information for publicity, advertising, trade or promotional purposes without further payment, consideration, notice or approval. By participating in a Game, you grant DK, its affiliates, successors, assigns, agents and any third parties authorized by any of them (each, a "Licensee") the sole, worldwide, fully paid-up, royalty-free, irrevocable, perpetual, sublicensable and transferable right and license to display, share, publicly perform, exhibit, transmit, broadcast, reproduce, record, photograph, digitize, modify, alter, edit, adapt, create derivative works from, exploit, sell, rent, license, use your name, image, likeness, voice, professional and personal biographical information, and other personal characteristics and private information that you have provided to DK for the purpose of the Game, and to permit others to do so, in any and all materials created by or on behalf of any Licensee that incorporate any of the foregoing, in all forms and media now or hereafter invented, including, without limitation, composite and modified representations, for all purposes, including but not limited to any trade or commercial purpose. Any Licensee may but is not required to use your name as a credit in connection with any photograph and/or testimonial. You irrevocably waive the right to inspect or approve versions of any photograph and/or testimonial or the written copy or other media that may be used in connection with same. You release all Licensees, jointly and severally, from and irrevocably waive any claims that may arise regarding the use of any such photograph and/or testimonial, including any claims of copyright or trademark infringement, infringement of moral rights, libel, defamation, invasion of any rights of privacy (including intrusion upon seclusion, false light, public disclosure of private facts, and misappropriation of name or likeness), claims of defamation, invasion of privacy or violation of rights of personality or publicity, physical or emotional injury or distress, infringement of moral rights, or any similar claim or cause of action in tort, contract or any other legal theory, now known or hereafter known in any jurisdiction throughout the world.
• Social Networking Sites. Our Website, Application(s), and Services may enable you to post content to Social Networking Services (e.g., Facebook) (each, a "SNS"). If you choose to do this, we will provide information to such SNSs in accordance with your elections. In such event, you acknowledge and agree that you are solely responsible for your use of those websites and that it is your responsibility to review the terms of use and privacy policy of the companies providing such SNSs. We will not be responsible or liable for: (i) the availability or accuracy of any SNS's terms of use or privacy policy; (ii) the content, products or services on or availability of such SNSs; or (iii) your use of any such SNSs.
• Corporate Affiliates. We may share some or all of your personal information with our corporate affiliates, including, without limitation, our subsidiaries, joint ventures and other companies under a common control ("Affiliates"). We require that our Affiliates maintain any personal information they receive in a secure manner, use it only for the purposes set out in this Privacy Policy.
• Corporate Restructuring. We may share some or all of your personal information in connection with or during negotiation of any merger, financing, acquisition, corporate divestiture, dissolution transaction, or other proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets. In such event, the parties involved will be subject to confidentiality restrictions. In the event of an insolvency, bankruptcy, or receivership, your personal information may also be transferred as a business asset.
• Other Disclosures. Regardless of the choices you make regarding your personal information (as described below), DK may disclose personal information without consent in certain specific situations. For example, personal information may be shared to (i) comply with a duly authorized subpoena or warrant for the personal information, (ii) in connection with any legal investigations, (iii) if we have reasonable grounds to believe that the personal information relates to a breach of Canadian federal or provincial laws or (iv) to investigate or assist in preventing any violation or potential violation of law, this policy or our Terms of Use. We may also disclose your personal information without your consent to collect a debt that is owed to us.
• Advertising Alliances Opt-out: In addition to adjusting the appropriate settings in your browser, many advertising companies that may collect information for targeted advertising purposes are also members of the Digital Advertising Alliance or the Network Advertising Initiative. Both of these organizations provide directions on how individuals can opt-out from targeted advertising by their members. You can find more information on these opt-out capabilities on www.aboutads.info and www.networkadvertising.org.

7. BIOMETRIC VERIFICATION

With your consent, we may use facial image scan services provided by our vendors (including, for example, Onfido Inc.) to help verify your identity. These biometric identity verification providers and their contractors compare facial scan data extracted from your photo in your ID (e.g., driver's license) to the facial scan data extracted from the selfie photo or video you upload, and then report back to us whether or not there is a match. We will use these results to help verify your identity. These scans and associated results may constitute biometric information or biometric identifiers under certain laws. Any biometric identifier/information or representation of it will be processed based on your consent and collected, stored, and managed by Onfido or the applicable biometric identity verification provider. For more information please see Onfido's Facial Scan Policy and Release and Onfido's Privacy Policy.

Biometric data collected and processed for our verification purposes is scheduled to be retained until the earlier of when verification is complete or for up to one (1) year following your last interaction with the biometric identity verification provider, unless otherwise set forth at the time you provide consent or unless otherwise required by law or legal process. After this period, such biometric data is scheduled to be deleted. You may decline to use the biometric verification process, but this may limit our ability to complete the verification process required to use our Services. You may revoke your consent at any time by emailing us at privacy@draftkings.com.

8. SECURITY AND RETENTION OF PERSONAL INFORMATION

• The security of your information is important to us. We use reasonable administrative, technical, and physical procedures, practices, and safeguards designed to protect personal information we collect from unauthorized access, use, alteration, exfiltration, or destruction. Any payment card information that we collect from you will be held by us in encrypted form. Additionally, we will keep your information for only as long as it is needed to achieve its purpose or meet our legal obligations, after which it will be disposed of in accordance with our information retention and disposition policy and schedule.
• We make concerted, good faith efforts to maintain the security of your information. Although we work hard to ensure the integrity and security of our systems, it must be recognized that no information system is 100% secure and, therefore, we cannot guarantee the security of such information. Outages, attacks, human error, system failure, unauthorized use, or other factors may compromise the security of user information at any time.
• You can also play a role in protecting your personal information. To protect your personal information while using our Website, Applications and Services, we strongly suggest that you do not share your Account information and that you adhere to the following password practices:
• Use a strong password that is at least eight alphanumeric characters long, and contains upper and lower-case characters, numbers, punctuation marks and special characters such as !@#$;
• Use a password that is not easily guessed and is not a word in any language, slang or is based on personal information such as a family name;
• Treat your password as confidential and do not disclose it to anyone else;
• Do not write down your password;
• Do not store your password online in unencrypted form;
• Change your password every three (3)months; and
• Choose a password that is unique, not one that you use for other websites or applications.

9. BREACH OF SECURITY SAFEGUARDS

In the event that we suffer a breach of security safeguards resulting in the unauthorized access to or loss of any of personal information where there is a resulting real risk of significant harm to an individual, we will notify the affected individual(s) and applicable governmental authorities having jurisdiction, if required by applicable law. This notification will include notification to iGO. We will work closely with iGO and other applicable governmental authorities having jurisdiction to contain and remediate the breach.

10. YOUR CHOICES REGARDING PERSONAL INFORMATION

• Email Communication. We will periodically send you free newsletters and emails that contain information about our various products and Services, or other products and services we feel may be of interest to you. At any time you can easily indicate your preference to stop receiving such communications from us, and you may opt out of receiving further marketing from DK, by emailing us at privacy@draftkings.com or by following the unsubscribe instructions provided in the email you receive. Despite your indicated email preferences, we may send you service-related communications, including notices of any updates to our Terms of Use and this Privacy Policy.
• Changing or Deleting Your Personal Information.
• You may access, correct or delete any of your personal information in your Account by simply editing it within your Account or by requesting access, corrections or deletions by emailing us at support@draftkings.com. You may request deletion of certain personal information maintained by us, and we will use commercially reasonable efforts to honor your request, but please note that we may be legally or otherwise required to keep such information and not delete it, or to keep such information and not disclose it (or to keep this information for a certain time, in which case we will comply with your deletion request only after we have fulfilled such requirements). As an example, we may refuse access where providing the personal information would reveal confidential commercial information that cannot be redacted from the requested personal information. Where we do not provide access, we shall explain why.
• Deletion requests may be made by emailing us at privacy@draftkings.com or by submitting a privacy request through the "Contact Us" web form located at https://www.draftkings.com/help/contact-us. When we delete information, it will be deleted from the active database, but may remain in our archives. We may also retain your information to prevent fraud or other unlawful activity or for similar purposes.
• We take reasonable steps to ensure that the information we collect, hold, use and disclose about an individual is complete, up-to-date and accurate, consistent with the requirements of FIPPA and other applicable privacy laws. However, you also have a responsibility to inform us if any of your personal information that we hold is incomplete, up-to-date and accurate. If at any time you believe that personal information we hold about you is incorrect, incomplete, outdated or inaccurate, you have the right to request that we amend such personal information. If we refuse the correction request, we will provide written reasons and information about the complaints process should you not be satisfied with our reasons.

• Opt-Out of Personal Information Sharing. As described above, we and certain other companies may place tracking technologies on our Website, which allow us and such companies to receive information about your activity on our Website and related Services that is associated with your browser or device. You may control the use of certain tracking technologies and request to opt-out of the sharing of your personal information with third parties for non-required purposes by clicking the Do Not Share My Personal Information link in the footer of our Website and following the instructions on the page that appears. Please also keep in mind that your cookie and tracking tool preferences are specific to the device, website, and browser you are using and may be deleted when you clear your browser's cache.
• Applications. You may stop all collection of information by our Application(s) by uninstalling the Application(s). You may use the standard uninstall processes as may be available as part of your mobile device or via the mobile application marketplace or network.

11. HOW TO ACCESS OR CORRECT PERSONAL INFORMATION

In addition to editing your personal information through your Account as described above, you may request a copy of personal information that DK has collected about you through the Website, Application(s) or Services and an account of its use by emailing our privacy team via email addressed to privacy@draftkings.com or through the "Contact Us" web form located at https://www.draftkings.com/help/contact-us. You may also request that DK correct any factual inaccuracies in your personal information by contacting support@draftkings.com.

12. HOW WE RESPOND TO DO NOT TRACK SIGNALS

Various browsers, including Internet Explorer, Firefox and Safari, currently offer a "Do Not Track" or "DNT" option that relies on a technology known as a DNT header, which sends a signal to websites visited by the user about the user's browser DNT preference setting. Please note that, at this time, we do not honor "DNT" signals or other mechanisms that may allow you to opt out of the collection of information across networks of websites and online services as there is no standard for how online services should respond to such signals. As standards evolve, we may develop policies for responding to DNT signals that would be described in future versions of this Privacy Policy. For more information on DNT options, please visit www.allaboutdnt.org.

13. PROHIBITED USERS

As indicated in our Terms of Use, employees, operators, or consultants of a sport's governing body are prohibited from participating in certain Games where such employee, operator, or consultant is prohibited from participating in Games by such governing body ("Prohibited Users"). For clarity, examples of sports governing bodies are the National Football League, Major League Baseball, and the National Basketball Association. We may report any participation in the Services or in any Games by any Prohibited Users to the applicable sport's governing body. Additionally, as described below in Section 14, our Games and Services are only available to residents of the Province of Ontario.

14. MINORS

The Website, Application(s) and Services are not directed towards minors (i.e. persons who have not reached the age of majority in the province or territory where they reside) ("Minors") and we do not knowingly collect or maintain personal information from Minors through the Website, Application(s) or Services. If we become aware that a Minor has provided us with personal information through the Website, Application(s) or Services, we will delete the information from our files. If you are the parent or legal guardian of a Minor who you believe has provided personal information to DK through the Website, Application(s) or Services, please contact our privacy team at privacy@draftkings.com and we will delete the Minor's personal information.

15. INTERNATIONAL INFORMATION HOSTING/DATA STORAGE

The Website, our Application(s) and Services are intended for and directed solely to users in the Province of Ontario, Canada. The Website, our Applications and Services are not intended to subject DK to the laws or jurisdiction of any state, province, country or territory other than those of the Province of Ontario. If you are located outside of the province of Ontario and are a visitor to our Website or have downloaded any of our Applications, please be aware that the use of our Website, Applications, Games and our Services is not available to you. However, as described in this Privacy Policy, even if you are not able to use our Services and Games due to your location, there may be some personal information that we may automatically collect through your visiting our Website or downloading our Applications.

The Website, Application(s), Services and Games are hosted, and your personal information will be stored and processed in the United Statesand other countries where we have facilities or in which we engage service providers; please note that the United States and such other countriesmay have different data protection rules than those of your jurisdiction of residence. By using or visiting the Website, downloading the Application(s) or using our Services and Games, you are transferring your personal information to the United States and other countries as described above and you consent to the transfer.

16. LODGING A COMPLAINT

If you wish to complain about an alleged breach of the privacy of your personal information, or if you wish to complain about any other aspect of how we handle your personal information, you may make a complaint to us. The complaint should be made in writing to us and addressed to the attention of our Data Protection Officer. The details on how to contact our Data Protection Officer are provided below.

We will promptly acknowledge receipt of your complaint and we will endeavor to deal with your complaint and to provide you with a response within a reasonable time period following our receipt of your complaint (generally within thirty (30) days of receipt). Where the complaint requires a more detailed investigation, it may take longer to resolve. If this is the case, then we will provide you with progress reports.

We reserve the right to verify your identity and to seek (where appropriate) further information from you in connection with your complaint. Where required by law, we will provide our determination on your complaint to you in writing via email.

Please note that, in accordance with Canadian privacy laws, your right to access information is not absolute. We may refuse your request as permitted by Canadian law, including in situations where the requested information is protected by solicitor/client privilege or where the requested information would reveal confidential commercial information.

If you are not satisfied with the outcome of your complaint, you may write to us seeking an internal review of our decision. Such internal review will be completed by an officer not previously involved in the investigation or resolution of your complaint. If you remain dissatisfied following the outcome of our internal review, you may escalate the complaint to iGO.

17. CHANGES AND UPDATES TO THIS PRIVACY POLICY

This Privacy Policy may be revised periodically in our sole discretion, and, except for any material changes requiring your opt-in consent as described below, any non-material changes will be effective upon the revised Privacy Policy being posted to our Website or Application(s). You are solely responsible for reviewing this Privacy Policy for any changes. In the event we make material changes to this Privacy Policy, as determined by us in our sole discretion, we will seek your opt-in consent. Your continued use of the Website, Application(s), or Services following any non-material changes to this Privacy Policy will indicate your acknowledgement of and implied consent to such non-material changes and agreement to be bound by the terms of such changes. If the changes to this Privacy Policy are material changes and you do not provide your opt-in acceptance to them, then you will not be able to use your Account and it may be deactivated. You agree that, upon your implied or opt-in consent, the updated Privacy Policy applies to all of your personal information, including the personal information collected before the changes went into effect.

You are solely responsible for updating your personal information to provide us with your most current email address. In the event the last email address you provided is not valid or for any reason is not capable of delivering notifications to you, then in the event we provide you notification via email, our dispatch of the email containing such notification will constitute effective notification of the changes made to the Privacy Policy. In the event you do not wish to permit changes in our use of your personal information, you must notify us that you wish to deactivate your Account.

18. HOW TO CONTACT US

Should you have any inquiries, comments or concerns related to this Privacy Policy, our collection, use, or disclosure of your personal information, your privacy rights, or any other privacy or data security related concerns, you may contact our Data Protection Officer at privacy@draftkings.com. We may request specific personal or other information from you to help us confirm your identity prior to providing a substantive response or granting any access to you.

Updated: June 30, 2023