Privacy Policy

Last Updated: February 15, 2026

1. Introduction

VICI Sports, Inc. (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you use FanFest (the “Platform”).

2. Who We Are

• Legal Entity: VICI Sports, Inc.
• Address: 447 Broadway, New York, NY 10013
• Contact Email: privacy@fanfest.io
• If you are an EU resident, we may appoint an EU Representative to handle GDPR queries:
  • Adam Jones
  • 5, parvis Alan-Turing, Paris, France

3. Information We Collect

1. Account Information: Phone number, email, username, or other details you provide to register and maintain an account.

2. Usage Data: IP address, device information, pages visited, and other analytics data for performance and usage insights.

3. Cookies and Similar Technologies: We use cookies, web beacons, or similar tracking to remember your preferences, analyze usage patterns, and potentially deliver relevant content or ads.

4. Payment Information: If you subscribe to paid tiers, your payment information is collected and processed by our third-party payment processor (we do not store full payment details ourselves).

5. Communications: If you contact us, we may keep a record of that correspondence.

3.7 Automated Decision-Making and Profiling

Channel creators on FanFest may configure audience-based access rules that use your past activity on the Platform to determine whether you can access specific content. This includes consideration of: actions you have performed, experiences you have attended, and communities you have participated in. This processing constitutes profiling as defined in GDPR Article 4(4).

Legal basis: Legitimate interest (Article 6(1)(f)) — enabling creators to deliver targeted content to engaged audiences. We have conducted a Data Protection Impact Assessment (DPIA) for this processing activity.

Your rights: You have the right to:

• Be informed when audience-based access rules are applied to you (the Platform will indicate when content is restricted by audience criteria)
• Request human review of an audience-based access decision by contacting privacy@fanfest.io
• Object to profiling-based access decisions under Article 21 GDPR

Audience-based access rules use a deterministic rules engine, not machine learning or artificial intelligence. The criteria are explicitly defined by channel creators and evaluated against your recorded activity data.

4. How We Use Your Information (Legal Basis)

• Performance of a Contract: To provide core features (e.g., account creation, verifying identity, enabling subscription access).
• Legitimate Interests: For platform analytics, product improvements, fraud prevention, and basic communications.
• Consent: Where required by law—for example, for certain marketing emails or non-essential cookies. You can withdraw consent at any time.

5. Categories of Third-Party Providers

We may share data with external providers who help us operate or improve the Platform. These may include:

• Cloud Hosting and Server Infrastructure: For storing data and ensuring uptime.
• Analytics Services: To understand usage patterns and enhance user experience.
• Email/Communication Services: For sending notifications, confirmations, or marketing emails.
• Payment Processors: To handle subscription fees securely and in compliance with standards (e.g., PCI-DSS).
• SMS Delivery (if applicable): For account verification or user notifications via text messages.
• Customer Support Tools: To manage and respond to user queries.
• Fraud Prevention and Security: To detect and prevent malicious activities or spamming.
• Advertising/Marketing Platforms (if applicable): If we run ads or promotional campaigns.
• Content Moderation Tools (if applicable): For automated or human review of user-generated content.

We require these providers to comply with data protection laws and to only process your personal data for the purposes described in this Policy.

6. International Data Transfers

If you are in the European Economic Area (EEA) or another region with data transfer restrictions, we may transfer personal data to countries outside your jurisdiction (e.g., to the United States). When we do so, we use Standard Contractual Clauses (SCCs) or other legal mechanisms to ensure your data remains protected.

6.1 Data Protection Framework

VICI Sports, Inc. participates in applicable data transfer mechanisms to protect personal data transferred from the EEA to the United States. Our Standard Contractual Clauses (SCCs) are available upon request by contacting privacy@fanfest.io.

7. Data Retention

We retain your personal data as long as necessary for the purposes outlined in this Policy (e.g., maintaining your account, fulfilling legal obligations). If you request deletion, we will delete or anonymize your data unless we must keep it for legal or legitimate business reasons.

8. Your Rights (GDPR and Similar Laws)

Depending on where you live, you may have rights such as:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccuracies in your data.
• Erasure (“Right to be Forgotten”): Request deletion of your data under certain circumstances.
• Restriction: Ask us to limit processing of your data.
• Portability: Obtain your data in a structured, machine-readable format.
• Objection: Object to certain processing based on legitimate interests or direct marketing.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact privacy@fanfest.io. We will respond within a reasonable timeframe, consistent with applicable law.

9. Cookies and Tracking

We use cookies or similar tracking to:

• Remember preferences (e.g., language settings).
• Analyze usage (e.g., Google Analytics).
• Provide relevant features or ads (if applicable).

You can control cookies through your browser settings. Note that disabling certain cookies may impact platform functionality.

10. Data Security

We implement appropriate administrative, technical, and physical measures to protect your personal data. However, no security system is perfectly secure, and we cannot guarantee absolute protection.

11. Children’s Privacy

We do not knowingly collect personal information from children under 13. If you believe a child has provided personal data, please contact us so we can promptly remove it.

12. Third-Party Links

Our Platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites.

13. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make significant updates, we will notify you via email or a prominent notice on the Platform. The “Last Updated” date at the top indicates when the latest changes were made.

14. Contact Us

For privacy-related inquiries or requests, please contact:

• privacy@fanfest.io
• VICI Sports, Inc.

447 Broadway

New York, NY 10013

If you are in the EU and not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.