Last Updated: September 4, 2026

PRIVACY POLICY

This privacy notice for CaveKraft Technology LLC (“Company”, “we”, “us”, or “our”) explains how and

why we collect, use, disclose, retain, and otherwise process personal information when you use

Kaddy+ and our related services (collectively, the “Services”), including when you:

• Visit our website at www.Kaddyplus.com or any web portal that links to this privacy notice

• Download, install, or use our mobile application (the “App”)

• Create a Kaddy+ account and set up your player profile and equipment inventory (your “disc bag:)

• Track rounds and throws using GPS-based location data or manual input

• Participate in scoring and side-play formats available in the App

• Engage with us in other related ways, including customer support or product communications

Questions or concerns? This notice explains your privacy rights and choices. If you do not agree with

our practices, please do not use the Services. You can contact us at privacy@kaddyplus.com or by

mail at 155 Anna Farm Rd E, North Stonington, CT 06359. If you are located outside the United

States, additional rights may apply under local law; see the Privacy Rights and International Users

sections below.

Controller. Unless we state otherwise, CaveKraft Technology LLC, located at 155 Anna Farm Rd E,

North Stonington, CT 06359, is the controller responsible for the personal information processed for

the purposes described in this notice. Information about any representative required for users in the

European Economic Area (“EEA”), the United Kingdom, or Switzerland is addressed in the

International Users and supplemental privacy sections below.

Privacy Officer. CaveKraft Technology LLC has designated a Privacy Officer responsible for

overseeing our privacy practices and responding to privacy questions, complaints, and access

requests. Contact: Privacy Officer, CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington, CT 06359;

email: privacy@kaddyplus.com.

SUMMARY OF KEY POINTS

This summary highlights key points from our privacy notice. You can find more detail on each topic in

the full notice below.

What personal information do we process? Depending on how you use Kaddy+, we may process your

username and email address; optional profile information; equipment inventory (your “disc bag”),

including private disc details and photos you add; course, round, score, throw, and side-play history;

precise geolocation when you enable location features; course and disc-catalog contributions you

choose to submit for review or publication; player invitations, guest-player information, and other user-

generated content; performance metrics and bag or disc-usage statistics; purchase and subscription-

status information; communications with us; and device, security, diagnostic, and usage information.

Kaddy+ does not require your legal name for basic account registration.

Do we process any sensitive personal information? We process precise geolocation when you enable

location-enabled features. Some U.S. privacy laws treat precise geolocation and certain account-

authentication information as sensitive personal information. Optional profile information may also

receive heightened protection under some laws depending on what you choose to provide. We use

sensitive personal information only for the purposes described in this notice, including providing

requested features, securing accounts, and preventing fraud or abuse; we do not use it to infer

unrelated characteristics about you or for targeted advertising.

Do we collect information from third parties? We primarily collect information directly from you and

automatically through the Services. We may also receive limited information from App Stores or

payment and entitlement providers, service providers acting on our behalf, and disc golf associations

you choose to connect or identify. We may receive information you voluntarily send to us through app-

store reviews, social media, support channels, or similar communications. We do not purchase third-

party consumer profiles or independently collect unrelated information about you from data brokers.

How do we process your information? We process information to create and maintain your account

and disc bag; track rounds and throws; calculate scores and performance metrics; support scoring

and side-play formats available in the App; display or distribute content according to the sharing

choices you make; process subscriptions; provide support; maintain security and reliability; and

comply with legal obligations.

In what situations and with which parties do we share personal information? We disclose personal

information only as needed to operate Kaddy+, including to service providers that support cloud

hosting, backend/database and authentication services, administrative web hosting, push

notifications, subscription and payment administration, transactional email, mapping and location

functions, and technical diagnostics and security. We also disclose information when required by law,

in connection with a business transaction, or when you direct or authorize a disclosure. We do not sell

personal information.

How do we keep your information safe? We use administrative, technical, and organizational

safeguards designed to protect personal information, including encrypted communications,

authentication and access controls, logging and monitoring, backups, secure development practices,

and vendor safeguards appropriate to the Services. No system can be guaranteed to be completely

secure.

What are your rights? Depending on where you live, you may have rights to access, correct, delete,

restrict, object to, or obtain a portable copy of your personal information; withdraw consent where

processing relies on consent; object to direct marketing; and complain to a data-protection authority.

You can also delete your Kaddy+ account from your account settings, subject to limited retention

permitted or required by law and the treatment of shared community contributions described below.

How do you exercise your rights? You can manage your account and location settings directly in the

App, or contact us at privacy@kaddyplus.com. We will consider and act on any request in accordance

with applicable data protection laws.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL

INFORMATION?

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

6. HOW LONG DO WE KEEP YOUR INFORMATION?

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

8. DO WE COLLECT INFORMATION FROM MINORS?

9. WHAT ARE YOUR PRIVACY RIGHTS?

10. CONTROLS FOR DO-NOT-TRACK FEATURES

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

12. DO WE MAKE UPDATES TO THIS NOTICE?

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM

YOU?

15. CHANGES TO THIS NOTICE

16. INTERNATIONAL USERS AND EU/EEA TRANSFERS

17. EXTERNAL LINKS

18. CANADA SUPPLEMENTAL PRIVACY NOTICE

19. UNITED KINGDOM SUPPLEMENTAL PRIVACY NOTICE

20. AUSTRALIA SUPPLEMENTAL PRIVACY NOTICE

21. NEW ZEALAND SUPPLEMENTAL PRIVACY NOTICE

22. SWITZERLAND SUPPLEMENTAL PRIVACY NOTICE

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you voluntarily provide to us when you create an

account, set up your player profile and disc bag, track your play, or otherwise interact with the

Services.

We collect personal information that you voluntarily provide when you register for the Services, set up

and maintain your player profile and equipment inventory, track rounds and throws, contribute course

or community information, participate in scoring or side-play formats available in the App, request

information, provide feedback, or otherwise communicate with us.

Account Information. Basic registration requires a username and an email address. Depending on the

features you choose to use, we may also collect optional profile or preference information, including:

• Username

•  Email address

•  Account credentials and authentication information used to create and secure your account.

• Kaddy+ sign-in uses an email address and password; email verification is required and

password reset is handled by email. CaveKraft Technology LLC does not store your password

in plaintext

•  Profile picture or avatar image, if you provide one

•  Optional profile details, such as birth year or gender, where offered

•  Communication, notification, and product preferences

•  Your PDGA number, if you choose to provide it. Kaddy+ stores the number so the App can link

to your PDGA account page; the current link does not import additional PDGA profile data into

Kaddy+

•  Your name or other contact information only if you voluntarily provide it through customer

support, a privacy or rights request, or another optional interaction; Kaddy+ does not require a

legal name for basic account registration

• Profile, Equipment, and Gameplay Content You Provide. Kaddy+ is designed to track your play

and help you make equipment and strategy decisions. The information you choose to add or generate

through use of the App may include:

•  Your equipment inventory (“disc bag”), including discs in your collection or bags and private

details you choose to add to an individual disc, such as a disc photo, color, plastic type,

condition, weight, and notes

•  Course and play history, such as courses played, dates of play, scores, selected discs, side-

play participation and results, and related round activity

• Throw and round data captured by GPS-based tracking or entered manually, including

location-derived throw measurements and the disc you select for a tracked throw. Round and

throw data may also be stored locally on your device for offline use and synchronized with

Kaddy+ backend services when connectivity is available.

• Scoring data across traditional play and side-play formats available in the App, including

results calculated from entered scores and results or winner confirmations entered by

participants

•  Performance metrics and statistics derived from your play, including round statistics, bag

analysis, and disc-usage information such as “most used” discs. Side-play results are used

within the applicable side-play feature and do not currently feed into general player

performance statistics.

•  Other information you enter directly, such as preferences, guest-player names or identifiers

you add to a round, and other notes or information you choose to provide.

Location Information. With your permission, we process precise geolocation to display your live

position, calculate distances, support throw tracking, identify nearby courses, and support course-

mapping and layout-editing features. While you are actively using a round, throw-tracking, course-

mapping, or other location-dependent screen, the App may process your device location continuously

so the live position shown in the App can update as you move. Course mapping does not require you

to be physically present at the course: you may place or edit course features remotely. Coordinates

that you intentionally place for course features, such as tees, baskets, out-of-bounds features,

mandatories, or drop zones, are course-mapping data and do not necessarily represent where you

personally were located. Location information associated with saved throws, rounds, or course

contributions may be stored as part of those records. Some privacy laws treat precise geolocation as

sensitive personal information. We process precise location only when location access is enabled for

the App. You can control or disable the App’s access to location through your device or App settings,

though location-dependent features may not work as intended if you do.

User-Generated and Community Content. You may submit, create, edit, or share content through the

Services, including course maps and course details, layouts and mapped course features, layout

corrections, scorecards and side-play results, photos, disc-catalog submissions, notes, and other

content you choose to provide. Course submissions may include an address or precise course

coordinates and, if approved for publication, that course information may become visible to other

Kaddy+ users. If you submit a new disc for possible publication in the shared Kaddy+ disc database,

the shared submission is limited to the disc name, manufacturer, and flight numbers. Personal details

for an individual disc in your collection, including its photo, color, plastic type, condition, weight, and

notes, are not displayed to other users as part of the public disc catalog. We process User Content to

operate, improve, secure, and develop the Services and to make community contributions available

according to the functionality of Kaddy+ and the Terms of Service.

Information Visible to Other Users. Users may be able to choose Public or Private profile visibility

through available settings. A round invitation may show the invited player the round date, time, and

location. When players share a scorecard or round, participating players may see one another’s

username and profile image as needed for that shared round. Certain information may also be visible

to other users when you search for or invite users, join a multiplayer round, share a scorecard,

participate in side play, contribute shared course information, submit an approved disc-catalog entry,

or use another sharing feature. Depending on the feature and your available visibility settings, this

may include your username, profile image, scores, side-play results, or content you intentionally

share. Published course information may include the course address, layout, and mapped

coordinates. Kaddy+ does not make your private live-location history or private individual-disc details

and photos public by default. A shared scorecard, course contribution, or other sharing feature may

nevertheless reveal or allow others to infer your general location.

Public Reviews and Feedback. If you voluntarily submit a review, testimonial, recommendation,

endorsement, survey response, or other feedback to us or through an app store or public channel, we

may use that material to respond to you, improve Kaddy+, or, where permitted by law and consistent

with the Terms of Service, display or quote the content. We will not use non-public personal

information for a public testimonial without an appropriate lawful basis or permission where required.

Information About Other People. Your account or rounds may include references to other people,

including Kaddy+ users you search for or invite, guest players you add, or other players in a

multiplayer round. Depending on the feature, you may provide a guest name or identifier and enter

scores or side-play results for that guest, and a selected lead or designated participant may be

permitted to enter or confirm results for others. We store this information as part of operating the

requested round or feature. You are responsible for ensuring you have an appropriate basis to

provide information about others. When users participate together, they may be able to see certain

scores, results, usernames, or other information needed for the shared round or feature.

Communications With Us. If you contact customer support or otherwise communicate with us, we

collect the information you provide in those communications.

Billing and Subscription Information. Purchases are processed through the applicable application

store or billing platform, such as the Apple App Store or Google Play. CaveKraft Technology LLC

does not receive or store full payment card or bank-account information from those platform

transactions. We and a subscription-entitlement service provider may receive or process a Kaddy+

account or pseudonymous identifier, store transaction or receipt information, purchase and

entitlement status, Subscription status, renewal or refund status, and related technical information

needed to validate purchases and provide paid access. Kaddy+ does not require a legal name for

subscription management.

Information from Other Sources. We primarily collect information directly from you and automatically

through your use of the Services. We may also receive limited information from application stores and

payment/subscription service providers, operating-system or device platforms, disc golf associations

you choose to identify or connect, and service providers acting on our behalf. Depending on the

source, this may include transaction and purchase information, Subscription and entitlement status,

account or pseudonymous identifiers, technical information, and association information you choose

to connect.

Application and Operational Data. We automatically collect certain information when you use the

Services, such as:

• Device type, operating system, and language settings

•  Technical request and service-use data generated as you use the Services

•  Diagnostic, error, and performance logs

•  IP address and network or request information

•  Authentication session information

Application Data. When you install and use the App, the App may request certain permissions from

your device, such as access to precise location for live position, nearby-course, round, throw-tracking,

and course-mapping features; camera or photo access when you choose to take or upload a profile

image; and notifications for round, invitation, confirmation, or other service-related messages. Kaddy+

does not access or upload your phone contacts or address book, and microphone access is not part

of the launch functionality. If you enable push notifications, our push-notification service provider may

process a device or push token, app or device identifiers, notification preferences, and delivery

information needed to deliver and manage those messages. Kaddy+ does not intentionally send full

round history, throw history, or GPS/location history to the push-notification provider. Push

notifications are not used for marketing at launch. You can manage or revoke these permissions

through your device or App settings, though some features may not work as intended if you do.

Diagnostic and Performance Data. We collect limited technical and diagnostic information

needed to secure, operate, troubleshoot, and improve the Services. Backend diagnostic

records may include error events, stack traces, request or path information, and account

identifiers such as a user ID or email address when necessary to investigate a problem. The

mobile App does not currently use a general-purpose behavioral analytics or crash-reporting

SDK.

All personal information that you provide to us must be true, complete, and accurate, and you must

notify us of any changes to such personal information.

Required and Optional Information. Username, email address, and authentication information are

generally required to create and secure an account. Other information is optional unless a specific

feature clearly requires it. For example, precise location is optional, but location-dependent features

such as throw tracking, distance measurement, course mapping, or nearby-course functions may be

unavailable or less accurate if you do not enable it. Optional profile information is not required for

ordinary use. Where information is required by law, contract, or a specific feature, we will tell you

when practicable and explain the consequences of not providing it.

Information automatically collected

In Short: We collect limited technical, request, security, and diagnostic information automatically when

you use the Services so we can keep Kaddy+ secure, reliable, and functioning properly.

We automatically collect certain technical information when you visit, use, or navigate the Services.

This information does not directly identify you (such as by name or email) but may include:

• IP address and network or request headers

•  Device, operating-system, app, and language information where transmitted by your device or

the App

•  Browser type and version when you access the Services through our website

•  Technical information needed to operate, secure, and troubleshoot the Services

 Request and service-use data, such as service requests, request paths, session dates and

times, and response or operational status information

•  Diagnostic and performance data, such as backend error events, technical request logs, and

service-health information.

•  Authentication session information

How we collect this. We use server and request logs, necessary authentication/session technologies,

and other operational mechanisms needed to provide and secure the Services. See the Cookies and

Similar Technologies section for details and your choices.

Location. Service infrastructure may receive your IP address as part of ordinary network requests.

This is separate from the precise geolocation processed only when you enable a location-dependent

feature in the App, as described in the “What information do we collect?” section above.

Why we collect this. To maintain the security and operation of the Services, authenticate accounts,

monitor service reliability, troubleshoot errors, prevent fraud or abuse, and detect anomalous activity.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate

with you, enhance security and fraud prevention, and comply with law. We may also process your

information for other purposes with your consent.

We process your personal information for a variety of reasons depending on how you interact with the

Services, including:

 To facilitate account creation and authentication and manage user accounts. We process your

information so you can create and log in to your account, secure your session, and keep your

account in working order.

 To set up and maintain your player profile and equipment inventory. We process the

information you provide so you can build and update your disc collection and bags, store

private details about individual discs, choose discs during throw tracking, and view bag

composition, disc-usage, and related analysis.

 To track your play. We process throw and round data using GPS-based location data or

manual input, may process precise device location continuously while an active location-

dependent feature is in use, associate tracked throws with the equipment you select, calculate

distances, and record your scores and course progress.

 To analyze your performance. We process your real-time and historical normal-round play

data and equipment usage to calculate performance metrics, bag and disc-usage statistics,

and patterns in how you play. Side-play results are used within the applicable side-play feature

and do not currently feed into general player performance statistics.

 To support scoring and side-play formats. We process information needed to manage

traditional scoring and side-play formats available in the App. Some results are calculated from

entered scores, while other results may be entered or confirmed by a participant selected in

the App.

 To communicate with you. We send service-related messages, respond to inquiries, provide

customer support, and may send transactional email or push notifications needed to operate

your account and requested features. Kaddy+ does not currently use push notifications for

marketing.

 To protect the Services and users. We process information for security monitoring, abuse and

fraud prevention, incident detection, account and access-control enforcement, and to enforce

our terms and policies.

 To monitor and manage operational performance and quality. We process operational and

diagnostic data to monitor service health, prevent errors, and improve reliability.

 To analyze, improve, and develop the Services. We use diagnostics, usage data, and de-

identified or aggregated information to understand performance, fix bugs, and improve

features.

 To process subscriptions and payments. We process or receive necessary transaction,

entitlement, renewal, and Subscription-status information from application stores, billing

platforms, and subscription-entitlement service providers to provide paid features, manage

access, restore purchases where available, handle support, prevent fraud, and maintain

required records.

 To support community and shared features. We process User Content and profile information

as needed to support player search and invitations, guest-player and multiplayer rounds,

scorecards, side-play results, course contributions, approved disc-catalog contributions, and

other shared features according to your choices and the functionality of the Services. We may

review, correct, merge, reject, unpublish, or remove shared course or disc-catalog

submissions as needed to maintain the Services.

 To conduct research, surveys, and obtain feedback. We may invite you to participate in

surveys, product research, beta testing, or feedback programs and use your responses to

understand and improve Kaddy+, subject to applicable law and your choices.

 To comply with legal, regulatory, and contractual obligations. We process information to meet

recordkeeping, reporting, and audit requirements and to respond to lawful requests.

 To protect vital interests. We may process information when necessary to prevent harm or

address safety concerns.

What we do not do. We do not sell your personal information.

Note: How we share information with third parties is described in the; When and with whom do we

share your personal information’s section.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We process your personal information only when we believe it is necessary and we have a

valid legal reason to do so under applicable law (for example, with your consent, to comply with laws,

to provide the Services or perform a contract, to protect rights and safety, or to pursue legitimate

business interests).

If you are located in the European Union or another country in the EEA, this part of the section applies

to you.

The General Data Protection Regulation (“GDPR”), as applicable in the EU and EEA, requires us to

identify a lawful basis for each processing purpose. The basis depends on the data involved, the

feature you use, and the reason for processing. We generally rely on one or more of the following:

 Consent. We rely on consent where required for specific optional processing, which may

include precise geolocation for location-enabled features, optional marketing communications,

and non-essential cookies or similar technologies in the EEA where consent is legally

required. You may withdraw consent at any time through available settings or by contacting

us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

 Performance of a contract. We process information when necessary to provide the Services

you request under our Terms of Service, including creating and securing your account,

maintaining your disc bag, recording rounds and scores, providing requested competition

features, generating requested performance functions, managing subscriptions, and providing

customer support.

 Legitimate interests. We process information where necessary for legitimate interests that are

not overridden by your rights and interests, including securing the Services, preventing fraud

and abuse, diagnosing and fixing errors, maintaining service reliability, improving features

using operational and de-identified information, protecting legal rights, and understanding

service operation. Where GDPR gives you a right to object to processing based on legitimate

interests, you may exercise that right as described in the Privacy Rights section.

 Legal obligations. We process information where necessary to comply with applicable legal

requirements, including tax, accounting, recordkeeping, consumer-protection, privacy,

security-incident, regulatory, and lawful-request obligations.

 Vital interests. In limited circumstances, we may process information where necessary to

protect an individual’s vital interests, such as responding to an urgent threat to health or safety

when another legal basis is unavailable.

International transfers. Information for EEA users may be transferred outside the EEA, including to the

United States. We use a lawful transfer mechanism where required, such as an adequacy decision or

the European Commission's Standard Contractual Clauses, together with supplementary safeguards

where appropriate. See the International Users and EU/EEA Transfers section for more information

and how to request information about applicable safeguards.

If you are located in Canada, this section applies to you.

We process your information with your consent, which may be express or implied depending on the

context and applicable law. You may withdraw consent at any time, subject to legal or contractual

restrictions and reasonable notice.

In limited circumstances, we may process your information without consent where permitted by law,

for example: where collection is clearly in an individual’s interests and consent cannot be obtained in

time; for investigations and fraud detection and prevention; for certain business transactions subject to

statutory conditions; to comply with subpoenas, warrants, court orders, or other lawful requests;

where seeking consent would compromise the availability or accuracy of the information for an

investigation; or where otherwise authorized or required by applicable federal or provincial privacy

laws.

Note: Additional details about how long we keep information, how we share information, and your

choices and rights are provided in the Retention, Sharing, and Your Privacy Rights sections,

respectively.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information only as needed to operate the Services, with other players when you

choose to share or compete, to comply with law, to protect rights and safety, or with your direction or

consent.

We may share your personal information in the following situations:

 With service providers that operate the Services on our behalf. We use service providers for

cloud hosting and backend infrastructure; database, authentication, and storage;

administrative web hosting; transactional communications and push notifications; subscription

and payment administration; mapping, weather, elevation, and location functionality; and

technical diagnostics, security, and other operational support. These providers may process

personal information only as needed to perform their services for us, subject to contractual and

legal requirements applicable to that processing.

 With other users, when you choose to share, invite, play, or contribute. When you invite

another user, join a multiplayer round, share a scorecard, participate in side play, contribute

course information, submit an approved disc-catalog entry, or use another sharing feature,

certain profile information or User Content may be visible to other users according to the

feature and available settings. Published course contributions may include course addresses

and mapped coordinates. Private live-location history and private individual-disc details,

photos, and notes are not made public by default.

 For legal, compliance, and safety. We may share information to comply with applicable law

and lawful requests; to protect the rights, privacy, safety, or property of you, us, or others; to

enforce our terms and policies; and to detect, prevent, or address fraud, abuse, or security

issues.

 Business transfers. We may disclose or transfer information in connection with due diligence,

financing, a merger, reorganization, acquisition, sale of assets, or another business

transaction. Any processing in connection with such a transaction will remain subject to

applicable law, confidentiality and security obligations, and any notice or choice rights required

by law.

 With affiliates, if any. We may share information with entities under common ownership or

control that support the Services, subject to this notice and applicable law.

 With your direction or consent. We share information when you ask us to, such as when you

request a data export or otherwise direct us to share information on your behalf.

 Aggregated or de-identified information. We may share aggregated or de-identified data

that does not identify you, such as course statistics, play-behavior metrics, and other

aggregated service metrics.

What we do not do. We do not sell your personal information. We do not run third-party advertising

or use your information to target ads. We do not share your personal information with third parties for

their own commercial or marketing use without your consent, except as part of a specific program or

feature for which you have the ability to opt in or opt out.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use strictly necessary or functional cookies and similar technologies where needed to

keep web-based portions of the Services secure, support sign-in, and remember settings. We do not

use advertising technologies, and the mobile App does not currently use a general-purpose

behavioral analytics SDK.

Cookies and similar technologies may include:

• Strictly necessary cookies to enable core functions, such as sign-in, authentication, security,

and load balancing.

•  Functional cookies to remember your settings and preferences.

•  No non-essential advertising cookies are used for Kaddy+ advertising or targeted advertising.

We do not use cookies or other tracking technologies to conduct advertising, to analyze the

effectiveness of advertising, or for any purpose associated with advertising, and we do not share

information collected through cookies for third-party advertising.

Service-provider technologies. Our service providers may process limited account, request, device,

subscription, communication, mapping/location, security, and diagnostic information as needed to

provide their respective services. Kaddy+ does not currently use a general-purpose behavioral

analytics SDK in the mobile App. If our data-processing practices materially change, we will update

this notice as required by law.

EU/EEA cookie and device-access consent. If the Services are made available to users in the EU/EEA, we will

obtain consent before using non-essential technologies that store information on, or access information from,

a browser or device where such consent is required by applicable ePrivacy or national law. Strictly necessary

technologies may operate without consent where permitted.

Your choices.

• Browser controls. You can block or delete cookies in your browser. Some features may not

work without required cookies.

•  Consent controls. Where consent is legally required for a non-essential cookie or similar

technology, we will provide an appropriate method to accept, refuse, or later change that

choice. We do not treat continued browsing or use alone as consent where affirmative consent

is required.

•  Do Not Track and Global Privacy Control. Because we do not engage in sales, shares, or

targeted advertising as those terms are defined under applicable laws, the Services do not

currently respond to the Global Privacy Control (GPC) signal or to browser Do Not Track

signals. If our practices change, we will update this notice and honor recognized opt-out

signals where technically feasible.

US state law notice. We do not sell or share personal information for cross-context behavioral

advertising as those terms are defined under applicable US state privacy laws. If this changes, we will

update this notice and provide a clear opt-out mechanism.

For details about retention and the categories of data we collect, see What information do we collect.

How we disclose information is described in When and with whom do we share your personal

information.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as needed for the purposes described in this notice,

unless a longer period is required by law or contract.

We retain personal information only for as long as necessary to: (a) provide the Services and support

your account; (b) fulfill legal, regulatory, tax, or accounting obligations; (c) resolve disputes; (d)

maintain security and audit records; and (e) enforce our agreements. We do not keep personal

information longer than necessary.

When we no longer have an ongoing need to process personal information, we will delete or de-

identify it. If immediate deletion is not possible (for example, data in backup archives), we will securely

store it and isolate it from further processing until deletion is possible.

Retention criteria.

 Account and profile content, including profile data, disc-bag and equipment information, course

and play history, scores, side-play results, and throw and round data, is generally retained

while your account is active. When you delete your account, user-scoped content is deleted or

queued for deletion as described below, subject to limited legal, security, accounting, dispute,

audit, shared-record, or backup exceptions.

 Communications and support records are retained for as long as reasonably necessary to

resolve inquiries, maintain appropriate support history, protect the Services, and meet legal

obligations.

 Technical, diagnostic, and service logs are retained for operational and security purposes

according to the applicable system configuration, provider settings, and legal needs, and may

later be deleted, aggregated, or de-identified.

 Security and incident records are retained for as long as reasonably necessary to investigate

and respond to security events, prevent fraud or abuse, comply with legal obligations, and

preserve evidence when appropriate.

 Transaction, Subscription, and billing records are retained for as long as reasonably necessary

for purchase administration, tax, accounting, audit, fraud prevention, dispute resolution, and

other legal obligations.

 Backups and replicas follow provider-managed backup, recovery, and overwrite lifecycles. We

do not currently apply one universal retention period across every third-party service, and

retention may vary by provider, record type, configuration, and applicable law.

 Aggregated or de-identified data: retained without a set time limit, provided it cannot

reasonably be used to identify you.

Anonymized and aggregated play data. Even after you stop sharing publicly or delete your account, we may

retain anonymized or aggregated data derived from course and play history, such as course statistics

and non-identifying play metrics, to operate and improve Kaddy+ and provide useful

aggregate information. If information from a round must remain to preserve another user’s round

history or a shared multiplayer scorecard, we retain only the information needed for that record and

remove or dissociate your Kaddy+ account, profile, email address, PDGA number, and other personal

identifiers. The remaining record may show a score or other non-identifying round information, but it

will no longer be linked to your Kaddy+ account. Data that has been de-identified so that it can no

longer reasonably identify you is not treated as personal information under this notice.

Shared course, disc-catalog, and community contributions. Course maps, course details, layout

corrections, ratings, reviews, and other contributions that you intentionally submit for use by the

Kaddy+ community may continue to be maintained, adapted, and displayed after you stop using

Kaddy+ or delete your account, as permitted by the Terms of Service and applicable law. Approved

disc-catalog submissions, limited to shared catalog fields such as disc name, manufacturer, and flight

numbers, may likewise remain in the Kaddy+ disc database. If you delete your account, retained

shared contributions will not continue to display you as the mapper or contributor and will be

dissociated from your Kaddy+ account, profile, email address, PDGA number, and other personal

identifiers. Private disc photos, color, plastic type, condition, weight, notes, and other user-scoped

disc details are handled separately under the account-deletion process below.

Before account deletion. Before confirming account deletion, you may download or export your

available Kaddy+ account and play history using the export functionality provided by the Services.

Export is optional and is not required to delete your account.

Account deletion. You can delete your account at any time through available account settings or

request deletion by contacting us. Deleting your account does not delete or alter another user’s

account or round history. When deletion is confirmed, we delete or queue for deletion your user-

scoped profile, private disc-bag content and photos, private play content, authentication record, email

address, linked PDGA number, and other personal identifiers, subject to limited information we must

or may retain for legal, security, fraud-prevention, accounting, dispute, or audit purposes. We also

delete, request deletion of, or unlink account-linked identifiers from active third-party support systems

under our control, including applicable push-notification and subscription-service providers where

appropriate, subject to information that an App Store, billing platform, service provider, or other

independent recordkeeper must lawfully retain. Shared multiplayer round records, paired scorecards,

published course or community contributions, and approved shared disc-catalog entries may remain

only as described above, with your account and personal identifiers removed or dissociated. We may

also retain anonymized or aggregated information that no longer identifies you.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We protect personal information using a combination of organizational and technical

safeguards designed to keep the Services secure and reliable.

We maintain administrative, technical, and organizational safeguards designed to protect the personal

information we process. Depending on the system and data involved, these safeguards may include:

•  Encryption in transit and, where supported by the relevant infrastructure, encryption at rest

•  Authentication and access controls designed to restrict data access according to account

permissions, operational roles, and sharing functionality

•  Network, application, and infrastructure security controls appropriate to the Services

•  Secure development, code-review, dependency-management, and change-control practices

appropriate to the development process

•  Operational, security, and authentication logging where available and appropriate

•  Operational and security monitoring designed to identify suspicious or anomalous activity

•  Vulnerability, dependency, and security review processes appropriate to the Services

•  Backup, recovery, and service-continuity procedures appropriate to the information and

infrastructure involved

•  Vendor review and contractual data-protection safeguards for service providers that process

personal information on our behalf

The Services are operated from the United States. Account, authentication, synced play, and related backend

data are primarily stored and processed in the United States. Other service providers may process limited account,

request, device, push-notification, Subscription, transaction, mapping/location, communications, security, or

diagnostic information in the United States, the European Economic Area, or other countries where they operate.

We require service providers that process personal information on our behalf to protect it consistently

with applicable contractual and data-protection obligations.

Despite these safeguards, no method of electronic transmission, processing, or storage is completely

secure. We cannot guarantee that unauthorized access, loss, misuse, or other security events will

never occur. If a security incident affects personal information, we will investigate and provide notices

to affected individuals and authorities where and within the time required by applicable law.

Your role in security. Keep your account credentials secure, use a strong and unique password, and

enable any available account security features. You are responsible for maintaining the security of

any password, user ID, or other authentication used to access the Services. In order to protect you

and your information, we may suspend your use of the Services, without notice, pending an

investigation, if any breach of security is suspected.

Notification of security incidents. If we determine that a security incident has affected your

personal information, we will notify you and applicable regulators without undue delay where required

by law, consistent with our internal incident response procedures and applicable breach notification

statutes. Our notification will describe, to the extent known, what happened, what information was

involved, what we have done in response, and steps you can take to protect yourself.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: Kaddy+ is intended only for persons 18 years of age or older. Persons under 18 may not

create an account, access an account, or use the Services.

The Services are intended exclusively for users who are at least 18 years old. By creating an account

or using the Services, you represent that you are at least 18 years old and have the legal capacity to

use the Services under our Terms of Service. Kaddy+ does not currently offer parent-managed,

guardian-managed, family, or minor-profile accounts.

We do not knowingly permit persons under 18 to use Kaddy+ or knowingly collect personal

information from them through the Services. If we learn that an account is being used by a person

under 18, we may suspend or terminate the account and will take reasonable steps to delete or

otherwise handle the related personal information as required by applicable law, subject to legally

permitted retention for security, fraud prevention, or compliance purposes.

If you believe we have collected personal information from a minor, please contact us at

privacy@kaddyplus.com so we can take appropriate action.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your place of residence, you may have rights that allow you greater access to

and control over your personal information. You may review, change, or terminate your account at any

time, subject to applicable law.

European Union / EEA and Switzerland. If you are located in the EU/EEA or Switzerland, applicable law may

provide rights to access your personal information; correct inaccurate information; request deletion; restrict

certain processing; receive certain information in a portable format; object to certain processing; and

withdraw consent where we rely on consent. For EU/EEA users, you also have the right to object at any time to

processing based on legitimate interests in circumstances provided by GDPR and to object at any

time to processing for direct marketing. You have the right not to be subject to a decision based solely

on automated processing, including profiling, when that decision produces legal or similarly significant

effects, subject to applicable exceptions. Kaddy+ does not currently make such legally or similarly

significant automated decisions.

EU/EEA complaints and response timing. If you are in the EU/EEA and believe your personal

information is being processed unlawfully, you may lodge a complaint with a competent data-

protection supervisory authority, including an authority in the country where you habitually reside,

work, or where the alleged infringement occurred. You may contact us first, but you are not required

to do so before complaining to an authority. We respond to GDPR rights requests without undue delay

and ordinarily within one month, subject to any lawful extension for complex or multiple requests; if an

extension is needed, we will provide notice within the initial response period as required by law.

United States (state-specific rights)

Depending on your state of residence, you may have the right to request: access to and deletion or

correction of your personal information; to receive a portable copy of certain information; to opt out of

the sale or sharing of personal information, targeted advertising, or certain profiling; and to limit the

use and disclosure of sensitive personal information where applicable. We do not sell or share

personal information for cross-context behavioral advertising, we do not use personal information for

targeted advertising, and we do not use personal information for automated decision-making that

produces legal or similarly significant effects about you. If you submit a rights request and disagree

with our response, you may request an appeal using the contact details below.

Exercising your rights. You can make a request by contacting us at privacy@kaddyplus.com. To help protect privacy,

we may need to verify your identity (and your authority, if you are an authorized agent) before fulfilling a

request. Where you maintain a password-protected account, we may verify your identity through

existing authentication practices available through your account. Where we deny a request, we will

explain the reason, subject to legal restrictions.

Self-service access and account management. You can do many of the most common actions

directly from your account and App settings without contacting us:

•  View and edit your profile, disc bag, and play information.

•  Manage your location permissions, including turning precise location tracking on or off at any

time through your device or App settings.

•  Manage your communication and notification preferences.

•  Control the visibility of your profile and any content you share with other players, where those

features are offered.

• Delete your account. Upon your request to delete your account, we will delete or queue for deletion your

• user-scoped profile and play content and delete your authentication record. We will also delete, request

  deletion of, or unlink account-linked identifiers from active third-party systems under our control where

  appropriate. Deleting an account-linked subscription-service record does not itself cancel a Subscription billed by

  Apple, Google, or another billing platform; Subscription cancellation is handled separately as described in our Terms

  of Service. We may retain limited information as permitted by law for security, audit, fraud prevention, troubleshooting,

  legal compliance, or recordkeeping, and we may retain anonymized or aggregated data consistent with this section.

Marketing communications. Kaddy+ does not currently operate a marketing email program, and push

notifications are not used for marketing at launch. Transactional, security, billing, legal, and other

service-related communications may still be sent as needed to provide or administer the Services.

Cookies and similar technologies

Most browsers accept cookies by default. You can remove or reject cookies in your browser settings;

some features may not function properly without required cookies. For details about our use of

cookies, see the Do we use cookies and other tracking technologies section.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some operating systems include a Do-Not-Track (“DNT”) setting you can

activate to signal that you prefer not to be tracked online. Because no common industry standard for

recognizing DNT signals has been finalized, we do not currently respond to DNT signals.

Browser-based opt-out signals. Because we do not sell or share personal information or engage in

targeted advertising as those terms are defined under applicable laws, the Services do not currently

recognize the Global Privacy Control (GPC) signal. If our practices change, we will honor legally

mandated browser signals as opt-out preferences for applicable activities where required by law.

To control cookies and similar technologies, see the Do we use cookies and other tracking

technologies section and your browser settings.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you reside in a U.S. state with an applicable comprehensive privacy law, you may have

rights concerning access, correction, deletion, portability, sensitive personal information, certain

disclosures, opt-outs, and appeals. The exact rights and our obligations depend on the law that

applies to you and to CaveKraft Technology LLC.

The specific rights available to you, and the conditions for exercising them, depend on the privacy law

of your state.

Personal information we collect. We collect the categories described in What Information Do We Collect?,

including identifiers and account information; optional profile information; commercial and subscription

records; internet, device, and request information; IP/network information; precise geolocation

when enabled; profile images or other content you provide; gameplay, course, score, and

User Content; and performance metrics generated from your activity. Some state laws treat precise

geolocation and account log-in information as sensitive personal information. We use sensitive

personal information only for permitted operational purposes such as providing requested features,

securing accounts, and preventing fraud or abuse, and not to infer unrelated characteristics about

you.

How we use and disclose personal information. See How do we process your information? and

When and with whom do we share your personal information? We disclose personal

information to service providers and contractors under written agreements requiring them to

use the information only to provide services to us. We may also disclose information to other

players when you choose to share a scorecard, join a multiplayer round, participate in side

play, or use another sharing feature.

Sale, sharing, and targeted advertising. We do not sell personal information, share it for cross-context

behavioral advertising, or use it for targeted advertising. We do not use personal information for

profiling in furtherance of decisions that produce legal or similarly significant effects. Because persons

under 18 may not use Kaddy+, we do not knowingly sell or share the personal information of minors. If

our practices change, we will update this notice and provide any legally required opt-out mechanisms

and recognition of universal opt-out signals.

Your rights (state laws may vary). Subject to exceptions, you may have the right to:

•  Know whether we process your personal information and to access it

•  Correct inaccuracies in your personal information

•  Request deletion of your personal information

•  Obtain a portable copy of certain personal information

•  Opt out of sale, sharing, targeted advertising, or certain profiling (not currently applicable as

described above)

•  Limit use and disclosure of sensitive personal information where applicable

•  Receive a list of categories (and, in some states, specific third parties) to whom we disclosed

personal information, where required

•  Be free from discrimination for exercising your rights

How to exercise your rights. Many requests can be handled directly from your account and App

settings, including reviewing and editing your profile and play information, managing your location

permissions, and deleting your account. You can also submit a request by contacting us at

privacy@kaddyplus.com. If you are an authorized agent submitting a request on behalf of a

consumer, include proof of authorization. We will verify requests by reasonably matching information

you provide with information we maintain. If you maintain a password-protected account, we may

verify your identity through existing authentication practices available through your account. If we

cannot verify your identity or authority, we may request additional information as permitted by law.

Appeals. If we decline to act on your request, you may appeal by emailing privacy@kaddyplus.com.

We will provide a written response explaining our decision and, where applicable, how to contact your

state attorney general if you remain dissatisfied.

California Shine the Light. We do not share personal information with third parties for their own direct

marketing purposes. If you still wish to submit a Shine the Light request, contact us at privacy@kaddyplus.com.

California Supplemental Notice. If and to the extent the California Consumer Privacy Act, as

amended (“CCPA”), applies to CaveKraft Technology LLC or to your information, the following

disclosures supplement the rest of this notice and are intended to function as a Notice at Collection for

the categories described below.

Categories collected. Depending on how you use Kaddy+, we may collect CCPA categories

including identifiers; customer-record information you provide; characteristics protected by law where

voluntarily provided and applicable; commercial and subscription information; internet or other

electronic-network activity; precise and general geolocation; visual information such as a profile

image; User Content and communications; and inferences or performance information derived from

gameplay and use of the Services. Sensitive personal information may include precise geolocation

and account log-in information used with credentials.

Sources and purposes. We collect these categories primarily from you, your device, App

Stores and payment or entitlement providers, disc golf associations you choose to connect or

identify, and service providers acting on our behalf. We use them for the business and

operational purposes described in this notice, including account administration, service

delivery, scoring and shared features, subscriptions, diagnostics and debugging, security,

fraud prevention, customer support, internal research and product development, legal

compliance, and exercising or defending legal rights.

Disclosure categories. We may disclose relevant categories of personal information for

business purposes to service providers and contractors; App Stores, payment, and

entitlement providers; other users when you direct or enable sharing; professional advisers

and authorities where legally permitted or required; affiliates, if any; and parties involved in a

business transaction. We do not sell or share personal information for cross-context

behavioral advertising. The specific categories disclosed depend on the recipient and purpose

and are limited to what is reasonably necessary for that purpose.

California rights. Subject to statutory exceptions and applicability thresholds, California residents

may have rights to know or access personal information, request correction or deletion, obtain

information about categories of sources and recipients, receive specific pieces of personal

information, opt out of sale or sharing if those practices ever occur, limit certain uses of sensitive

personal information where applicable, and receive non-discriminatory treatment for exercising

privacy rights. Requests may be submitted using the methods described below.

Retention. We retain personal information as described in How long do we keep your information?

12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We update this notice as needed to stay compliant and reflect changes to the Services.

We may modify this privacy notice from time to time. The “Last Updated” date at the top will identify

the current version. If we make material changes, we will provide notice appropriate to the change

and applicable law, such as an in-App notice, email, or website banner, and we will request consent

before applying a new processing activity where consent is legally required. We encourage you to

review this notice periodically.

If changes alter how we process personal information in a way that requires consent (for example,

new purposes or new categories of data), we will ask for consent before applying those changes to

you.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, or if you would like to exercise any of the privacy

rights described above, you may contact us at:

CaveKraft Technology LLC

Privacy Officer

Mailing Address: 155 Anna Farm Rd E, North Stonington, CT 06359

Email: privacy@kaddyplus.com

EU/EEA Representative. EU representative under Article 27 GDPR: Europe Services, SE Na Cecelicce 425/4,

Smichov, 150 00 Praha 5, Czech Republic. Data subjects may contact the representative at

info@gdprrepresentative.com regarding the processing of their personal data. The representative

serves as a contact point for the data subjects and supervisory authorities and does not replace

Cavekraft Technology LLC as the controller. If you have a comment, question, or complaint about

how we are handling your personal information, we encourage you to contact us first so we can

work to resolve the matter.

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

In Short: Depending on your place of residence, you may request access to, correction of, or deletion

of your personal information, and you may withdraw consent where applicable. Many of these actions

can be completed directly from your account settings.

Self-service options. You can do many common actions directly from your account and App settings

without contacting us:

•  Review and edit your profile, disc bag, and play information

•  Manage your location and communication preferences

•  Download or export your available account and play history before deleting your account

•  Delete your account

How to submit a request.

 Email us at privacy@kaddyplus.com with your request, or use a data request form if provided

on our website.

 Specify the type of request (access, correction, deletion, portability, withdrawal of consent, or

appeal).

Verification and authorized agents.

 We will verify your identity, and, if applicable, your authority as an authorized agent, before

fulfilling a request.

 If we cannot verify your request, we may ask for additional information as permitted by law.

Timing and response.

 We will respond within the timeframe required by applicable law and explain any denial,

limitation, or extension we are legally required or permitted to apply. For GDPR requests from

EU/EEA users, we respond without undue delay and ordinarily within one month, subject to

any lawful extension for complexity or number of requests.

 You may appeal our decision by emailing privacy@kaddyplus.com; we will provide a written

response and information on how to contact your state authority where applicable.

Limits and exceptions.

 Certain information may be retained as permitted or required by law for security, fraud

prevention, accounting, audit, dispute resolution, legal compliance, or recordkeeping. Shared

course or community contributions and approved shared disc-catalog entries may remain after

account deletion only as described in the retention and deletion sections, with personal

identifiers removed or dissociated where applicable.

 We may retain anonymized or aggregated data derived from your play history, such as course

statistics and play behavior, which is no longer considered personal information, as described

in How long do we keep your information?

15. CHANGES TO THIS NOTICE

We may update this privacy notice from time to time to reflect changes in our privacy practices, legal

requirements, or the way we process personal information. When required by applicable law, we will

provide notice of material changes or obtain consent before the changes take effect.

16. INTERNATIONAL USERS AND EU/EEA TRANSFERS

The Services are operated by CaveKraft Technology LLC from the United States. Personal

information may be stored or processed in the United States and may also be processed in the

European Economic Area or other countries where our service providers operate. We use provider

categories that include cloud/backend and authentication services, administrative web hosting,

transactional communications and push notifications, subscription/payment administration, mapping

and location services, and technical diagnostics/security. We do not intentionally send full round

history, throw history, or GPS/location history to push-notification providers. Kaddy+ does not

currently use a general-purpose behavioral analytics SDK in the mobile App. Those countries may

have data-protection laws that differ from the laws where you live. Additional regional information

appears in the supplemental sections below.

EU/EEA international-transfer safeguards. When GDPR applies and personal information is

transferred from the EU/EEA to a country that has not been recognized as providing adequate

protection, we use, or require the applicable service provider to use, a lawful transfer mechanism as

required by law. Depending on the recipient and transfer, this may include an adequacy decision, the

EU-U.S. Data Privacy Framework where the recipient is eligible to rely on it, the European

Commission’s Standard Contractual Clauses, and supplementary technical or organizational

measures where appropriate. You may contact us to request information about the safeguards

applicable to a transfer of your personal information, subject to lawful redactions for confidentiality or

security.

No blanket consent to international transfers. We do not treat your mere use of Kaddy+ as the

legal basis for an EU/EEA international transfer where GDPR requires an adequacy decision,

appropriate safeguards, or another lawful transfer mechanism. If we ever rely on a specific derogation

or explicit consent for a particular transfer, we will provide the information and obtain the consent

required by law before relying on it.

EU/EEA transparency. For EU/EEA users, this notice identifies the controller, categories and

sources of personal information, purposes and legal bases, legitimate interests, categories of

recipients, retention periods or criteria, international-transfer safeguards, whether information

is required or optional, and rights and complaint mechanisms. Our EU representative contact

information is provided in Section 13. If a data-protection officer becomes legally required, the

applicable DPO contact information will be added to this notice as required by law.

17. EXTERNAL LINKS

The Services may contain links to websites, course resources, stores, or other services operated by

third parties. We do not control those third-party services and are not responsible for their privacy

practices or content. Each third party may maintain its own privacy and data-collection policies. We

encourage you to review the applicable privacy information before providing personal information to a

third party. Nothing in this section limits any responsibility that applicable law does not permit us to

exclude.

18. CANADA SUPPLEMENTAL PRIVACY NOTICE

Scope. This section supplements the rest of this notice for individuals in Canada, including Quebec

and all other provinces and territories where the Services are made available. Depending on the

circumstances, CaveKraft Technology LLC may be subject to applicable federal and provincial privacy

laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA),

substantially similar provincial private-sector privacy laws, and Quebec’s Act respecting the protection

of personal information in the private sector.

Accountability and Privacy Officer. CaveKraft Technology LLC is accountable for personal information

under its control, including personal information transferred to a service provider for processing. Our

designated Privacy Officer is the contact point for Canadian privacy questions, access requests, and

complaints: Privacy Officer, CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington, CT 06359;

email: at privacy@kaddyplus.com.

Canadian consent. We obtain meaningful consent where required and may rely on express or implied

consent as permitted by applicable Canadian law, taking into account the sensitivity of the information

and the reasonable expectations of the individual. You may withdraw consent subject to reasonable

notice and any legal or contractual restrictions. Withdrawal does not affect processing lawfully carried

out before withdrawal and may prevent us from providing a feature that requires the information.

Canadian access and correction rights. Subject to applicable exceptions, you may ask whether

CaveKraft Technology LLC holds personal information about you; request access to that information;

request an account of how it has been used and the organizations or categories of organizations to

which it has been disclosed; and challenge its accuracy and completeness and request correction

where appropriate. You may also challenge our compliance with applicable Canadian privacy law.

Kaddy+ additionally offers account deletion and available data-export functionality as described

elsewhere in this notice. We may verify your identity before responding. We will respond to an access

request as soon as possible and in any event no later than thirty (30) days after receiving it, at

minimal or no cost to you. Where applicable law permits, we may extend that period by up to a further

thirty (30) days, or longer where the law allows; if we extend, we will notify you within the original thirty

days of the new time limit, the reason for the extension, and your right to complain to the applicable

Commissioner. If we refuse a request in whole or in part, we will explain why, identify the provision

relied on where required, and tell you how to complain.

Canadian complaints and regulatory recourse. Privacy questions or complaints may be submitted to

our Privacy Officer. If you are not satisfied with our response, or where applicable law permits you to

proceed directly, you may contact the Office of the Privacy Commissioner of Canada or the applicable

provincial privacy regulator, including the Commission d’accès à l’information du Québec for matters

within its jurisdiction.

Processing outside Canada. Personal information of Canadian users may be transferred to or

processed by service providers outside Canada. CaveKraft Technology LLC remains accountable for

personal information transferred to service providers for processing and uses contractual and other

safeguards appropriate to the circumstances. While information is processed in another country, it is

subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, or

national-security authorities in accordance with those laws.

Processing locations and purposes for service providers outside Canada. Canadian-user personal

information may be processed outside Canada, including in the United States and the European

Economic Area, for cloud hosting/backend and authentication services, administrative web hosting,

mapping and location functions, subscription/payment administration, push messaging, transactional

communications, diagnostics/security, and related operational support. The active provider

configuration and processing locations may change over time. You may contact the Privacy Officer for

current information about the country or region, provider category, and purpose of outside-Canada

processing.

Provincial notices regarding service providers outside Canada. Where provincial law requires

additional information about service providers outside Canada, including under Alberta or Quebec

law, you may request our applicable policies and practices or ask questions by contacting the Privacy

Officer at privacy@kaddyplus.com. For Quebec personal information, we assess and document

cross-border processing and use contractual or other safeguards where required by applicable

Quebec law.

Canadian privacy breaches. CaveKraft Technology LLC maintains the safeguards described in How

do we keep your information safe? If a breach of security safeguards involving personal information

under our control occurs and it is reasonable in the circumstances to believe that the breach creates a

real risk of significant harm to an individual, we will report the breach to the Office of the Privacy

Commissioner of Canada and, where applicable, to the appropriate provincial privacy regulator, and

we will notify affected individuals as soon as feasible and in the form and manner required by

applicable law. Where required, we will also notify other organizations or government institutions that

may be able to reduce the risk of harm. We will maintain breach records for the period required by

applicable Canadian law.

Canadian electronic marketing. Commercial electronic messages sent by or on behalf of CaveKraft

Technology LLC to electronic addresses accessed in Canada will comply with Canada’s Anti-Spam

Legislation (”CASL”) and other applicable law. Where CASL applies, we will send commercial

electronic messages only with consent or another basis permitted by CASL. Messages will identify

CaveKraft Technology LLC, provide required contact information, and include a clear and functional

unsubscribe mechanism. We will give effect to an unsubscribe request without delay and in any event

within ten (10) business days. Opting out of commercial electronic messages does not prevent

transactional, security, billing, legal, or other service-related communications that are necessary to

provide or administer the Services.

19. UNITED KINGDOM SUPPLEMENTAL PRIVACY NOTICE

Scope. This section supplements the rest of this notice for individuals in England, Wales, Scotland,

and Northern Ireland. Where the processing of personal information is subject to UK law, CaveKraft

Technology LLC processes that information in accordance with the UK General Data Protection

Regulation (“UK GDPR”), the Data Protection Act 2018 as amended, the Data (Use and Access) Act

2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and

other applicable UK privacy and data-protection requirements.

Controller and Privacy Officer. CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington,

CT 06359, United States, is the controller for the personal information described in this notice unless

we state otherwise. Our Privacy Officer is the contact point for UK privacy questions, rights requests,

and data-protection complaints and may be reached at privacy@kaddyplus.com or at the mailing

address above.

UK lawful bases. For processing subject to the UK GDPR, we rely on one or more lawful bases

appropriate to the processing purpose, including consent, performance of a contract, legitimate

interests, compliance with legal obligations, and vital interests, as described in What legal bases do

we rely on to process your information? Where we rely on legitimate interests, we consider the

interests and rights of the affected individual, and UK individuals may object where the UK GDPR

gives them that right. Where we rely on consent, consent may be withdrawn at any time without

affecting processing that was lawful before withdrawal.

UK privacy rights. Subject to applicable conditions and exceptions, UK individuals may have the right

to request access to personal information; rectification of inaccurate information; erasure; restriction of

processing; data portability; and to object to processing, including direct marketing. Where processing

relies on consent, you may withdraw consent. You also have rights relating to decisions based solely

on automated processing that produce legal or similarly significant effects. Kaddy+ does not currently

use solely automated processing to make decisions that produce legal or similarly significant effects

about you. We respond to UK data-subject-rights requests without undue delay and ordinarily within

one month, subject to any extension permitted by UK law.

UK data-protection complaints. You may submit a data-protection complaint to the Privacy Officer

using the contact information in this notice. CaveKraft Technology LLC will provide a clear means of

making a complaint, acknowledge receipt of a qualifying data-protection complaint within 30 days,

take appropriate steps to investigate the complaint without undue delay, keep the complainant

appropriately informed, and communicate the outcome. You may also complain to the Information

Commissioner’s Office (“ICO”) and are not required to contact CaveKraft Technology LLC before

exercising any right to complain directly to the ICO.

UK cookies and device-access technologies. For UK users, CaveKraft Technology LLC obtains

consent before storing information on, or accessing information from, a user’s device where PECR

requires consent. Technologies may operate without consent where an applicable UK exemption

permits their use, including where they are strictly necessary or otherwise fall within a lawful

exemption. Where consent is required, we provide a method to accept, refuse, or later change the

available choices, and we do not treat continued browsing or use by itself as consent when affirmative

consent is legally required.

UK electronic direct marketing. Kaddy+ does not currently operate a marketing email program. If

CaveKraft Technology LLC later sends marketing emails, text messages, or similar electronic direct

marketing to UK individuals, we will do so only where permitted by PECR and applicable UK data-

protection law, including on the basis of valid consent or an applicable existing-customer or “soft opt-

in” rule. Where required, we will provide an opportunity to refuse marketing when contact information

is collected and a clear and simple method to opt out in each subsequent marketing communication.

Service, security, billing, legal, and other non-marketing communications may still be sent where

necessary to provide or administer the Services.

Processing outside the United Kingdom. CaveKraft Technology LLC is established in the United

States, and if Kaddy+ is later made available in the United Kingdom, personal information may be

transferred to or processed in the United States, the European Economic Area, or other countries

where our service providers operate. Service providers supporting subscription administration,

cloud/backend functions, communications, mapping/location, and diagnostics may process limited

information in those locations. Where a transfer from the UK is a restricted transfer under the UK

GDPR, CaveKraft Technology LLC will use, or require the applicable recipient to use, a lawful UK

transfer mechanism and supplementary safeguards where required.

No blanket consent to UK international transfers. We do not treat a UK user’s mere use of Kaddy+ as

the legal basis for a restricted international transfer where the UK GDPR requires adequacy

regulations, appropriate safeguards, or another lawful transfer mechanism. If we rely on a specific

statutory exception or explicit consent for a particular restricted transfer, we will provide the

information and obtain the consent required by UK law before relying on it.

UK Representative. UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889),

Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the United

Kingdom may contact the representative at info@gdprrepresentative.com. The representative is a privacy

contact point and does not replace Cavekraft Technology LLC as the controller.

20. AUSTRALIA SUPPLEMENTAL PRIVACY NOTICE

Scope. This section supplements the rest of this notice for individuals in Australia. CaveKraft

Technology LLC handles Australian personal information in accordance with applicable Australian

privacy law, including the Privacy Act 1988 and the Australian Privacy Principles (“APPs”) to the

extent they apply, and complies with applicable electronic-marketing requirements including the Spam

Act 2003.

Controller and Privacy Officer. CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington,

CT 06359, United States, is responsible for the personal information described in this notice unless

we state otherwise. Our Privacy Officer is the contact point for Australian privacy questions, access or

correction requests, and privacy complaints and may be reached at privacy@kaddyplus.com or at the

mailing address above.

Anonymity and pseudonyms. Kaddy+ does not require a legal name for ordinary account registration.

Users may choose a username and may use an email address that does not disclose their legal

identity, provided the email address functions for account authentication and communications. Certain

account-dependent functions require a functioning email address or other account identifier because

authentication, account recovery, syncing, security, Subscription administration, and similar

functionality cannot practicably be provided without an account identifier. A username, email address,

or pseudonymous identifier may still be personal information when CaveKraft Technology LLC can

associate it with a Kaddy+ account or other information about the user.

Australian access and correction rights. Subject to applicable conditions and exceptions, Australian

individuals may request access to personal information CaveKraft Technology LLC holds about them

and may request correction where information is inaccurate, out of date, incomplete, irrelevant, or

misleading. We may verify identity before responding. If we refuse or limit access or correction where

Australian law permits, we will provide any reasons and complaint information required by law.

Kaddy+ separately offers account deletion and available data-export functionality as described

elsewhere in this notice.

Subscription information. Application stores, billing platforms, and service providers supporting

subscription administration may process a Kaddy+ account or pseudonymous identifier, purchase and

entitlement information, Subscription status, renewal or refund status, and limited technical

information needed to validate purchases and provide paid access. Kaddy+ does not receive full

payment-card information from application-store purchases.

Overseas processing and disclosure. Australian-user personal information may be transferred to or

processed by service providers outside Australia, including in the United States, the European

Economic Area, or other countries where our providers operate. Provider categories include

cloud/backend and authentication services, administrative web hosting, mapping/location services,

subscription/payment administration, transactional communications, push messaging,

diagnostics/security, and related operational support. Where Australian privacy law requires it,

CaveKraft Technology LLC takes reasonable steps appropriate to the circumstances to require

overseas service providers to protect personal information consistently with applicable Australian

privacy requirements and remains accountable to the extent provided by law.

Australian privacy complaints. You may submit a privacy question or complaint to the Privacy Officer

using the contact information in this notice. CaveKraft Technology LLC will investigate and respond

within a reasonable period and will provide any information about external complaint rights required by

law. If you are not satisfied with our response, you may have the right to complain to the Office of the

Australian Information Commissioner (“OAIC”).

Australian data security and eligible data breaches. CaveKraft Technology LLC uses the safeguards

described in How do we keep your information safe? Where the Notifiable Data Breaches scheme or

another applicable Australian breach-notification requirement applies, we will assess suspected

eligible data breaches and notify the OAIC and affected individuals where required by law.

Australian electronic marketing. Commercial electronic messages sent by or on behalf of CaveKraft

Technology LLC to Australian recipients will comply with applicable requirements of the Spam Act

2003. Where required, we will obtain consent, accurately identify CaveKraft Technology LLC as the

sender or authorizing business, provide current contact information, include a clear and functional

unsubscribe method, and honor unsubscribe requests within the period required by law. Opting out of

marketing does not prevent transactional, security, billing, legal, or other service-related

communications that are necessary to provide or administer the Services.

21. NEW ZEALAND SUPPLEMENTAL PRIVACY NOTICE

Scope. This section supplements the rest of this notice for individuals in New Zealand. CaveKraft

Technology LLC handles personal information of New Zealand users in accordance with the Privacy

Act 2020 and the applicable Information Privacy Principles (“IPPs”), together with other applicable

New Zealand privacy and electronic-messaging requirements.

Agency and Privacy Officer. CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington, CT

06359, United States, is the agency responsible for the personal information described in this notice

unless we state otherwise. Our Privacy Officer is the contact point for New Zealand privacy questions,

access or correction requests, and privacy complaints and may be reached at

privacy@kaddyplus.com or at the mailing address above.

Data minimization and pseudonymous account information. Kaddy+ does not require a legal name for

ordinary account registration. Users may choose a username and may use an email address that

does not disclose their legal identity, provided the email address functions for authentication and

communications. We collect identifying information only where it is reasonably necessary for a lawful

Kaddy+ purpose. Certain account-dependent functions require a functioning email address or account

identifier because authentication, account recovery, syncing, security, Subscription administration,

and similar functionality cannot practicably be provided without an account identifier. A username,

email address, or pseudonymous identifier may still be personal information when CaveKraft

Technology LLC can associate it with a Kaddy+ account or other information about the user.

Collection notices and information collected from other sources. We provide this privacy notice at or

before account creation and keep it available through the Services. We primarily collect personal

information directly from you and automatically through your use of the Services. We may also receive

limited personal information from the Apple App Store, Google Play, other application-store or

payment platforms, subscription-entitlement providers, operating-system or device platforms, disc golf

associations you choose to identify or connect, and service providers acting on our behalf. Depending

on the source, this may include transaction and purchase information, Subscription and entitlement

status, a pseudonymous account identifier, technical information, and association information you

chose to connect. We use this information for the purposes described in this notice.

New Zealand access and correction rights. Subject to applicable conditions and exceptions, you may

request access to personal information CaveKraft Technology LLC holds about you and request

correction of that information. We may verify your identity before responding. We will respond to an

access or correction request as soon as reasonably practicable and no later than the period required

by the Privacy Act 2020, which is generally 20 working days unless a lawful extension or other

statutory rule applies. If we do not make a requested correction, you may ask us to attach a statement

of the correction sought to the information where New Zealand law provides that right. Kaddy+

separately provides account deletion and available data-export functionality as described elsewhere in

this notice. If we decline a request for access or correction, we will tell you the reasons and inform you

of your right to complain to the Office of the Privacy Commissioner. If we do not respond within the

time required, that failure may be treated as a refusal for the purposes of the Privacy Act 2020.

Subscription information. Application stores, billing platforms, and service providers supporting

subscription administration may process a Kaddy+ account or pseudonymous identifier, purchase and

entitlement information, Subscription status, renewal or refund status, and limited technical

information needed to validate purchases and provide paid access. Kaddy+ does not receive full

payment-card information from application-store purchases.

Overseas processing and disclosure. New Zealand-user personal information may be processed by

service providers outside New Zealand, including in the United States, the European Economic Area,

or other countries where our providers operate. Provider categories include cloud/backend and

authentication services, administrative web hosting, mapping/location services, subscription/payment

administration, transactional communications, push messaging, diagnostics/security, and related

operational support. Where an overseas provider processes personal information solely on our behalf,

we structure that processing consistently with applicable New Zealand privacy requirements. You may

contact the Privacy Officer for current information about likely overseas processing locations, provider

categories, and purposes.

New Zealand privacy complaints. You may submit a privacy question or complaint to the Privacy

Officer using the contact information in this notice. CaveKraft Technology LLC will investigate and

respond within a reasonable period. If you are not satisfied with our response, you may complain to

the Office of the Privacy Commissioner of New Zealand, subject to the procedures and rights provided

by New Zealand law.

New Zealand privacy breaches. CaveKraft Technology LLC uses the safeguards described in How do

we keep your information safe? If a privacy breach has caused, or is likely to cause, serious harm and

is notifiable under the Privacy Act 2020, CaveKraft Technology LLC will notify the Office of the Privacy

Commissioner and affected individuals as soon as practicable as required by New Zealand law.

New Zealand electronic marketing. Commercial electronic messages sent by or on behalf of

CaveKraft Technology LLC to New Zealand recipients will comply with the Unsolicited Electronic

Messages Act 2007 and other applicable law. Where required, we will obtain or rely on lawful consent,

accurately identify CaveKraft Technology LLC as the sender or authorizing business, provide current

contact information, include a clear and functional unsubscribe method, and honor an unsubscribe

request within five working days. Opting out of marketing does not prevent transactional, security,

billing, legal, or other service-related communications that are necessary to provide or administer the

Services.

22. SWITZERLAND SUPPLEMENTAL PRIVACY NOTICE

Scope. This section supplements the rest of this notice for individuals in Switzerland. Where

applicable, CaveKraft Technology LLC processes Swiss personal data in accordance with the Swiss

Federal Act on Data Protection (FADP), its implementing ordinance, and other applicable Swiss

privacy and data-protection requirements. Switzerland is not part of the European Union or European

Economic Area, and references to the GDPR apply to Swiss users only where the GDPR

independently applies.

Controller and Privacy Officer. CaveKraft Technology LLC, 155 Anna Farm Rd E, North Stonington,

CT 06359, United States, is the controller responsible for the personal data described in this notice

unless we state otherwise. Our Privacy Officer is the contact point for Swiss privacy questions, rights

requests, and complaints and may be reached at privacy@kaddyplus.com or at the mailing address

above.

Categories, sources, and purposes. The categories and sources of personal data we process, and the

purposes for which we process it, are described in Sections 1 and 2 of this notice. Depending on the

features you use, this may include account and profile information; disc-bag and equipment

information; course, round, score, throw, side-play, and location information; Subscription and

entitlement information; device, push-notification, security, diagnostic, and technical information;

communications; and information from services you choose to connect. Round and throw data may

first be stored locally on your device for offline use and later synchronized to our backend when

connectivity is available.

Storage and processing outside Switzerland. Kaddy+ is operated from the United States, and

account, authentication, synced play, and related backend data are primarily stored or processed in

the United States. Other providers may process limited account, request, device, push-notification,

Subscription, transaction, mapping/location, communications, security, or diagnostic information in the

United States, the European Economic Area, or other countries where they operate. You may contact

our Privacy Officer for current information about destination countries or regions, provider categories,

and processing purposes.

Safeguards for disclosures abroad. Where Swiss law requires safeguards for a disclosure of personal

data to a country that is not recognized as providing adequate protection, CaveKraft Technology LLC

uses, or requires the applicable recipient to use, a lawful transfer basis or safeguards recognized

under Swiss law. Depending on the recipient and transfer, these may include an applicable adequacy

determination, the Swiss-U.S. Data Privacy Framework where an eligible recipient is certified to rely

on it, recognized standard contractual clauses with any required Swiss adaptations, and

supplementary technical or organizational measures where appropriate. We do not treat a Swiss

user’s mere use of Kaddy+ as consent to an overseas disclosure where Swiss law requires another

transfer basis or safeguard.

Push notifications. If you enable notifications, our push-notification provider may process a device or

push token, app or device identifiers, notification preferences, and message-delivery information

needed to deliver and manage those messages. Kaddy+ does not intentionally send full round history,

throw history, or GPS/location history to the push-notification provider.

Swiss privacy rights and response timing. Subject to applicable conditions and exceptions, you may

request information about whether and how CaveKraft Technology LLC processes personal data

about you; request access to personal data; request correction of inaccurate data; request deletion or

destruction where applicable; request cessation, restriction, or other relief for unlawful processing

where available; and request data portability where the statutory conditions are met. We may verify

your identity before responding. We will generally respond within 30 days, subject to any extension,

limitation, fee, or exception permitted by Swiss law, and will provide any explanation required if we

cannot fully grant a request.

Automated individual decisions. Kaddy+ does not currently use solely automated processing to make

a decision that produces legal effects or similarly significant effects about you. If Kaddy+ later makes

an automated individual decision subject to Article 21 FADP, we will provide the notice and

opportunity to express your point of view or request human review required by Swiss law.

Cookies, SDKs, and notification choices. Our use of cookies, mobile SDKs, push-notification

technologies, and similar technologies is described in Section 5. You may use available App, browser,

device, and consent settings to manage optional technologies. Where Swiss law requires consent or

another meaningful choice for a non-essential, unexpected, sensitive, or high-risk use, we will provide

that choice before or at the time required by law.

Security incidents. CaveKraft Technology LLC uses the safeguards described in Section 7. If a data-

security breach is likely to result in a high risk to the personality or fundamental rights of an affected

person, we will notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as

soon as possible where required by the FADP. We will also inform affected individuals where required

by law, ordered by the FDPIC, or necessary for their protection.

Complaints and Swiss representative. You may submit a privacy question or complaint to our Privacy

Officer using the contact information in this notice. You may also contact the FDPIC regarding matters

within its authority. If Article 14 FADP requires CaveKraft Technology LLC to designate a

representative in Switzerland, we will designate that representative in writing and make the

representative’s identity and contact information available through this notice and the Services. Any

representative is a privacy contact point and does not replace CaveKraft Technology LLC as the

controller.