GLOBAL PRIVACY POLICY

Pickny ("we," "us," or "our") operates the Pickny website and player proposition research platform (the "Service"). This Global Privacy Policy ("Policy") explains how we collect, use, disclose, and protect your personal information regardless of where you are located in the world.

We recognise that privacy laws differ by jurisdiction. This Policy sets out our baseline global practices and includes jurisdiction-specific sections for users in the United Kingdom, the European Economic Area, the United States (California), Brazil, Australia, and Canada. Where local law grants you additional rights, those are described in the relevant section.

By using the Service, you acknowledge you have read and understood this Policy.

LeetSpot d.o.o. is the data controller (or equivalent under applicable law) responsible for your personal data. Contact us at:

• LeetSpot d.o.o., Prve poljanice 5, Zagreb, Croatia
• Email: support@pickny.com
• Website: pickny.com/privacy-policy

Where required by local law, we have appointed a representative or data protection officer. Details are provided in the jurisdiction-specific sections below.

3.1 Data You Provide

• Account data — name, email address, username, password.
• Profile and preferences — settings, notification preferences, saved searches.
• Communications — messages sent to us via email, support tickets, or contact forms.
• Payment data — billing name and address; card details are processed by our payment provider and not stored by us.

3.2 Data Collected Automatically

• Usage data — pages visited, features used, session length, clicks, and searches.
• Device and technical data — IP address, browser type and version, operating system, device identifiers, referring URLs.
• Location data — approximate location derived from IP address (country/region level only).
• Cookie and tracking data — see Section 8 for full details.

3.3 Data From Third Parties

• Authentication providers — if you sign in via Google or another third-party service, we receive basic profile data (name, email) from that provider.
• Analytics providers — aggregated and pseudonymised usage statistics from services such as Google Analytics.
• Sports data licensors — no personal data is received from or shared with our sports data providers.

• To create and manage your account and provide the Service.
• To personalise your experience and remember your preferences.
• To process payments and manage subscriptions.
• To communicate with you about your account, updates, and support.
• To send marketing and product updates where you have opted in.
• To analyse usage patterns and improve the Service.
• To detect, investigate, and prevent fraud, abuse, or security incidents.
• To comply with legal obligations and enforce our Terms of Use.

We rely on the following legal bases, which vary by jurisdiction:

Contract

Processing necessary to deliver the Service you have signed up for, including account management and payment processing.

Legitimate Interests

Improving and securing the Service, preventing fraud, and understanding how users interact with our platform — where these interests are not overridden by your fundamental rights and freedoms.

Consent

For marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Legal Obligation

Where applicable law requires us to process or retain data.

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers — hosting, infrastructure, analytics, payment processing, and email delivery partners who process data on our behalf under binding data processing agreements.
• Legal and regulatory authorities — where required by law, court order, regulation, or to protect our rights and the safety of others.
• Business transfers — in the event of a merger, acquisition, or sale of assets. We will notify you prior to any such transfer.
• With your consent — in any other circumstance where you have explicitly authorised disclosure.

We will only retain your information for as long as necessary to fulfil the purposes we collected it for (e.g. such as providing you access to our Services), including for the purpose of satisfying any legal, accounting, or reporting requirements.

Where it is no longer necessary to process your Personal Data, we will delete it or anonymise it by removing all details that identify you in accordance with Data Protection Laws. For example, if you withdraw your consent to process your Personal Data, we will delete your Personal Data unless this is required to be retained to enable us to comply with Data Protection Laws.

The length of time for which we retain your Personal Data will depend on what we are using it for as set out in this privacy policy. For example, whilst you are using our products and services, we may need to use it to answer your queries about our products and services.

Please note, however, that we may be subject to legal and regulatory requirements to keep Personal Data for a longer period, in particular pursuant to any applicable statutory limitation period.

• Essential cookies — required for the Service to function (session management, authentication). Cannot be disabled.
• Analytics cookies — help us understand usage patterns. Only set with your consent.
• Preference cookies — remember your settings and personalise your experience.

You can manage your cookie preferences via our Cookie Preferences Centre, accessible from the website footer. You may also configure your browser to block cookies, though this may affect Service functionality. Full details are available in our Cookie Policy at pickny.com/cookie-policy.

We are based in Croatia and may transfer personal data to countries outside your own, including countries that may not provide the same level of data protection as your home jurisdiction.

We ensure appropriate safeguards are in place for all international transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO.
• Adequacy decisions where the destination country has been recognised as providing adequate protection.
• Binding Corporate Rules or other approved transfer mechanisms where applicable.

For transfers from the UK or EEA to the United States, we rely on UK International Data Transfer Agreements (IDTAs) or EU SCCs as appropriate.

We apply appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, access controls, and regular security assessments. No internet transmission is completely secure; we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users as required by applicable law.

Regardless of location, you may contact us at support@pickny.com to request access to, correction of, or deletion of your personal data. We will respond within a reasonable timeframe consistent with applicable law. Jurisdiction-specific rights are described in Section 12.

12.1 United Kingdom (UK GDPR & Data Protection Act 2018)

Applies to users located in the United Kingdom.

Your rights under UK GDPR include:

• Right of access (Subject Access Request) — obtain a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion, subject to legal obligations.
• Right to restrict processing — limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — at any time, without affecting prior lawful processing.

To exercise these rights, contact support@pickny.com. We will respond within one calendar month. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

12.2 European Economic Area (EU GDPR — Regulation 2016/679)

Applies to users located in EU member states and the EEA.

Your rights mirror those described for UK users above (Section 12.1), governed by the EU GDPR.

Our EU representative (if required under Article 27 GDPR) is: [EU Representative name and address]. You may lodge a complaint with the supervisory authority in your EU member state of habitual residence.

12.3 United States — California (CCPA / CPRA)

Applies to California residents under the California Consumer Privacy Act and California Privacy Rights Act.

California residents have the following rights:

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, or sold in the past 12 months.
• Right to Delete — request deletion of personal information we hold, subject to certain legal exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined by CPRA.
• Right to Non-Discrimination — we will not penalise you for exercising your CCPA/CPRA rights.

To submit a request, email support@pickny.com. We will verify your identity before processing and respond within 45 days (extendable by a further 45 days with notice).

In the preceding 12 months, we have collected the following categories of personal information: identifiers, internet activity data, and inferences drawn from usage data. We have not sold personal information.

12.4 United States — Other States

Applies to residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with applicable privacy laws.

Residents of US states with comprehensive privacy laws have rights similar to those listed in Section 12.3, including rights to access, correct, delete, and opt out of targeted advertising or profiling. Contact support@pickny.com to submit a request. We will respond within the timeframe required by your state's law.

12.5 Brazil (LGPD — Lei Geral de Proteção de Dados)

Applies to users located in Brazil.

Under Brazil's LGPD, you have the right to:

• Confirm whether we process your personal data.
• Access your personal data.
• Correct incomplete, inaccurate, or outdated data.
• Anonymise, block, or delete unnecessary or non-compliant data.
• Data portability to another service provider.
• Delete personal data processed with your consent.
• Information about third parties with whom we share data.
• Withdraw consent at any time.

To exercise your LGPD rights, contact support@pickny.com. Complaints may be referred to the Autoridade Nacional de Proteção de Dados (ANPD).

12.6 Australia (Privacy Act 1988 & Australian Privacy Principles)

Applies to users located in Australia.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). You have the right to access personal information we hold about you and to request correction of inaccurate information.

To make an access or correction request, contact support@pickny.com. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12.7 Canada (PIPEDA / provincial privacy laws)

Applies to users located in Canada.

We collect, use, and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We obtain consent before or at the time of collection, except where law permits otherwise.

You have the right to access personal information we hold about you and to challenge its accuracy. Contact our Privacy Officer at support@pickny.com. Unresolved complaints may be referred to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We may update this Policy periodically. We will notify you of material changes by email or by posting a notice on the Service at least [30] days before changes take effect, where required by law. The "Last Updated" date at the top reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

For any privacy-related questions, requests, or complaints:

• Email: support@pickny.com
• Post: LeetSpot d.o.o., Prve poljanice 5, Zagreb, Croatia
• Data Protection Officer: support@pickny.com
• EU Representative: support@pickny.com