Effective Date: 17.09.2026

This Privacy Policy explains how SportBenefit collects, uses, stores and shares personal data when you use the SportBenefit mobile application, website, HR portal, subscriber panel and related services. It also explains how profile-photo verification and on-device face detection work and describes your data-protection rights.

1. Who We Are and Scope of This Policy

SportBenefit is operated by AG & FFW ALLSPORTS SOFTWARE LTD. For the processing described in this Policy, SportBenefit acts as the data controller unless a different role is stated for a particular processing activity.

If you are enrolled through an employer, your employer or corporate administrator may separately act as a data controller for information it collects or provides for benefit administration. SportBenefit processes the data it receives in accordance with this Policy and the applicable corporate arrangements.

2. Personal Data We Collect

2.1 Account Creation, Enrollment and Identification

Depending on how you join SportBenefit, we may collect this information directly from you or receive it from your employer or corporate administrator:

• First name and last name
• Email address
• Phone number
• Employer or corporate account association, where applicable
• Membership tier, subscription status, enrollment and deactivation information
• Profile photo

We use this information to create and maintain accounts, confirm eligibility, administer memberships, support billing, provide customer support, secure access to the service and prevent unauthorized use.

2.2 Geolocation

To confirm physical presence at partner facilities and help prevent fraud, we may collect exact or approximate geolocation information during use of the application, including during QR-code scanning and check-in. This helps prevent remote scanning, location spoofing, unauthorized access and other misuse.

2.3 Subscriber Panel and HR Portal

For subscription and corporate-program administration, we may process names, email addresses, phone numbers, employer or corporate account name, membership tier, subscription status, enrollment and deactivation information, and payment-related account information where applicable. This information is used to manage memberships, prepare invoices, authorize app access, support HR administration and confirm eligibility.

2.4 Mobile App, Device and Activity Information

QR-code scanning. The app may request access to your device camera to scan QR codes for entry into partner locations.

Profile-photo capture or selection. The app may request access to your device camera or photo library so that you can take or select a profile photo. An accepted profile photo is attached to your SportBenefit account and may be required before you can use certain services or access partner facilities.

Activity history. We process sports and wellness activity information such as check-ins, selected services, visit dates, facility names, subscription plans and related usage information. This supports supplier payments, administration and enforcement of membership entitlements (including venue-specific access, booking or check-in limits where applicable), fair-use monitoring, misuse investigations and service-quality improvement.

Device and app information. We may process technical information such as device identifiers, login activity, activation status, app-performance data and security-related information. This helps secure the service, detect suspicious activity, maintain compatibility and improve functionality.

2.5 Payments

Payments are processed through Stripe. If you make a payment, SportBenefit may provide Stripe with information such as your name, email address, payment amount and transaction-related information needed to process the payment. Stripe processes payment information under its own applicable terms and privacy practices.

Stripe Privacy Policy: stripe.com/privacy

3. Why We Process Personal Data and Our Legal Bases

We process personal data only where we have a lawful basis under applicable data-protection law. Depending on the activity, this may include:

• Performance of a contract or steps connected with providing the SportBenefit service, including account administration, membership access and check-ins.
• Our legitimate interests, including preventing fraud and account sharing, protecting the security and integrity of the service, investigating misuse, supporting partner verification, maintaining service quality and improving technical performance.
• Compliance with legal obligations, including accounting, tax, regulatory, dispute-resolution or lawful-request requirements.
• Consent, where a particular processing activity requires consent under applicable law. Where processing is based on consent, you may withdraw that consent at any time.

Where we rely on legitimate interests, we consider those interests against the rights and freedoms of the individuals concerned. Where the law gives you a right to object to such processing, you may exercise that right as described in Section 9.

4. Profile Photos and On-Device Face Detection

4.1 Why We Process Profile Photos

SportBenefit processes profile photos for these purposes:

• verifying that a membership is used by the authorized account holder;
• preventing account sharing, resale, unauthorized access and other misuse;
• supporting manual check-in verification by partner facility personnel;
• protecting the integrity, security and sustainability of the SportBenefit service; and
• enforcing SportBenefit Conditions of Use, access rules and corporate-program policies.

This processing is carried out to provide and secure the SportBenefit service and on the basis of SportBenefit's legitimate interests in preventing fraud, unauthorized access, account sharing and misuse. Where applicable law requires consent for a specific use of the profile photo, SportBenefit will request it separately.

4.2 Automated On-Device Photo Validation

Before a selected or captured profile photo is accepted, the SportBenefit mobile application may use Google ML Kit Face Detection to check whether the image contains a detectable human face and meets the technical requirements configured for a usable profile photo.

Google states that the ML Kit Face Detection API detects faces and facial features but does not recognize individuals. The image input and the resulting face-detection output are processed locally on the user's device. According to Google's ML Kit Terms & Privacy documentation, ML Kit does not send that image input or resulting output to Google servers.

The local validation check may prevent an image from being accepted when a suitable face is not detected or the configured photo requirements are not met. This check determines photo suitability only; it does not determine membership eligibility, subscription entitlement or the user's identity.

4.3 What Happens After a Photo Is Accepted

Once a profile photo passes the local validation step, it is uploaded to SportBenefit, attached to the user's account and stored by SportBenefit. The accepted profile photo is then used for account identification, fraud and misuse prevention, and manual check-in verification.

During check-in, the accepted profile photo may be displayed to authorized personnel at the relevant partner facility so that they can visually confirm that the person using the membership corresponds to the account holder. This is a manual visual verification process; SportBenefit does not use automated facial recognition for the check-in comparison.

Partner facilities must not copy, store, distribute, publish or use the profile photo or other SportBenefit personal data for unrelated purposes. Authorized SportBenefit personnel may access profile photos where necessary for account administration, fraud prevention, customer support, security and service operation.

4.4 Google ML Kit Technical Communications and Metrics

Although ML Kit does not send the profile-photo image input or the resulting face-detection output to Google, Google states that ML Kit APIs may contact Google servers from time to time to receive items such as bug fixes, updated models and hardware-accelerator compatibility information. ML Kit also sends metrics about API performance and utilization to Google.

Google states that these metrics are used to measure performance, debug, maintain and improve the APIs, and detect misuse or abuse. Google processes those metrics under its own applicable terms and Privacy Policy. Depending on Google's infrastructure, technical information may be processed outside the user's country under the transfer mechanisms described by Google.

Google ML Kit Terms & Privacy: developers.google.com/ml-kit/terms

Google Privacy Policy: policies.google.com/privacy

4.5 Invalid or Inappropriate Profile Photos

Users must provide a genuine, clear, recent and appropriate photo of their own face. The following are not accepted:

• photos of another person;
• group photos;
• unclear, heavily edited, obstructed or misleading photos;
• images of objects, animals, documents, screenshots, avatars, cartoons or other non-face images;
• obscene, offensive, explicit, inappropriate or otherwise non-compliant images.

A photo may be rejected automatically where the on-device face-detection check cannot detect a suitable face. SportBenefit may also manually review profile photos and may restrict, suspend or terminate access where a user provides an invalid, misleading, inappropriate, explicit or non-compliant image, or fails to provide a valid profile photo when required.

5. When We Share Personal Data

5.1 Partner Facilities and Suppliers

To provide the service, verify access, prevent misuse and support accurate payment for services, we may share or display the following information to partner facilities and suppliers where necessary:

• First name and last name
• Profile photo
• SportBenefit subscription plan
• Type of service chosen
• Check-in confirmation or visit-related information required to validate access
• Information necessary to confirm whether the user is authorized to access the selected service

The profile photo may be shown to partner facility personnel only for manual visual verification and related access-control purposes. The on-device face-detection feature does not provide the profile photo or face-detection output to Google or another external face-processing provider.

5.2 Corporate Customers and HR Administrators

Where you are enrolled through an employer or other corporate customer, SportBenefit may process and make available membership-administration information required to operate the corporate program, such as enrollment, membership tier and subscription status. Detailed check-in or activity information is not shared with a corporate customer merely because it sponsors or administers the membership unless a separate lawful purpose and applicable notice allow such sharing.

5.3 Technical Service Providers

We may use service providers that support the operation, security and performance of the SportBenefit service. For example, application error data, crash reports and performance-related technical information may be processed by Sentry.io or similar providers to identify technical issues, improve the user experience and maintain service stability and security. Such information is used for technical and operational purposes and is not intended for unrelated advertising or profiling.

Sentry Privacy Policy: sentry.io/privacy

5.4 Legal and Compliance Disclosures

We may disclose personal data where required by applicable law, regulation, court order or lawful request, or where necessary to establish, exercise or defend legal claims, protect users or the service, investigate fraud or security incidents, or enforce applicable agreements and policies.

6. International Data Transfers

Some technology and payment service providers may process technical or transaction information in countries outside Cyprus or the European Economic Area. Where the GDPR or other applicable law requires safeguards for such transfers, SportBenefit takes steps designed to use legally recognized transfer mechanisms or service providers that offer applicable safeguards. Third-party providers may also describe their own international-transfer mechanisms in their privacy documentation.

7. Data Security

SportBenefit uses appropriate technical and organizational measures designed to protect personal data during transmission, storage and processing and to reduce the risk of unauthorized access, disclosure, alteration, loss, destruction or misuse.

Profile photos are stored securely and access is limited to circumstances where the photo is needed for account administration, manual check-in verification, fraud prevention, customer support, security and service operation. The ML Kit face-detection analysis described in Section 4 is performed on-device; SportBenefit does not use that feature to send the profile photo to Google for image processing.

8. Data Retention

SportBenefit retains personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the service, maintaining account and transaction records, preventing fraud, resolving disputes, complying with legal and accounting obligations, and enforcing applicable agreements and policies.

Profile photos are retained while they are needed for account identification, manual check-in verification and related fraud-prevention purposes. When an account is deleted or a valid deletion request is processed, SportBenefit will delete or anonymize personal data unless continued retention is required or permitted for legal, accounting, fraud-prevention, security, dispute-resolution or other legitimate purposes.

SportBenefit does not use the temporary ML Kit face-detection output to create or maintain a biometric template or facial-recognition database.

9. Your Data-Protection Rights

Subject to applicable law, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data, subject to applicable retention requirements;
• request restriction of processing in certain circumstances;
• object to certain processing based on legitimate interests;
• receive certain personal data you provided to us in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent, without affecting processing already carried out lawfully before withdrawal; and
• lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact info@sportbenefit.eu. We may need to verify your identity before completing a request. If a particular processing activity is necessary to provide a requested SportBenefit service, deleting the relevant data or withdrawing consent may mean that we can no longer provide that service.

10. Complaints

If you believe that SportBenefit's processing of your personal data infringes applicable data-protection law, you may contact us first so that we can address your concern. You also have the right to lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection or another competent supervisory authority where applicable.

Cyprus Office of the Commissioner for Personal Data Protection: dataprotection.gov.cy

Email: commissioner@dataprotection.gov.cy | Telephone: +357 22 818 456

11. Children's Privacy

SportBenefit is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe that a child has provided personal data to SportBenefit, please contact us so that we can take appropriate steps.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, data-processing practices, legal requirements or security measures. The latest version will be published with a revised effective date. Where required or appropriate, we may also notify users of material changes through the application, email, website or other communication channels.

Continued use of SportBenefit after an updated Privacy Policy becomes effective means that you acknowledge the updated notice. This does not replace any consent that applicable law requires us to obtain separately.

13. Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or SportBenefit's processing of personal data, please contact us: