Privacy Policy

Effective Date: November 4, 2024

ON LOCATION - PRIVACY POLICY

On Location Events, LLC ("On Location", "we", "us", "our") is a premier hospitality and enhanced experiences company and we and our partners are part of Endeavor Group Holdings, Inc.

On Location has been designated as the official hospitality provider by Fédération Internationale de Football Association (FIFA). This Privacy Policy, as updated from time to time, applies only to personal information processed by or on behalf of On Location. On Location, under our contract with FIFA, collects certain information on behalf of FIFA and shares it with them. In this context, FIFA and On Location, shall each be separate, independent controllers of that data shared with them. As indicated below, On Location also shares data with major partners including Soccer United Marketing, LLC, and Major League Soccer, LLC. Their respective privacy policies set out how they will use this information and can be found here. A copy of FIFA's privacy policy can be found here. FIFA will further share information with its third-party partners, which can be found here.

The present privacy policy ("Privacy Policy") describes how we use the data (which may include personal information) we collect about you offline and through our digital properties such as websites, apps, or other content or service delivery mechanism ("Site(s)") when: you create an account, make a reservation, request support, chat, send us a message, or otherwise communicate or interact with us via our websites or app, when you buy a ticket or other merchandise from us online or onsite, when you view or interact with content on our online channels, and when you otherwise interact with us, including our social media, marketing, contests, sweepstakes, and surveys (collectively our "Service(s)").

Please read this Privacy Policy carefully to understand how we handle your information. This Privacy Policy (together with our Terms of Use, Cookie Policy and any other documents referred to therein) provides information on the data we collect from you, or that you provide to us, and how we process it. Please read this Privacy Policy carefully before you provide us with your personal information. This Privacy Policy provides detailed information about when and why we collect your personal information, how we may use it, and how we keep it secure. This Privacy Policy works in conjunction with the Cookie Policy and Terms of Use. It covers what we collect from you. It does not apply to information that you provide or have provided to other websites or social media or that has come from public sources. This Privacy Policy also provides information about your privacy rights and to how to request and enforce them.

WHO WE ARE

We are On Location ("we", "us", "our"). We are also part of Endeavor Group Holdings, Inc. and may share data (as described further below) with its affiliated entities (collectively, "Endeavor").
Like any company, we use a variety of third party businesses and partners to market and provide our Services to you. Some of those companies are part of Endeavor, and some are third parties (e.g., event organizers, sporting associations, artists, etc.) that we partner with or support our operations so we can provide the best experience to you.

HOW WE COLLECT INFORMATION ABOUT YOU

Directly From You

You may provide us with personal information in a number of ways, namely when you:

• Access our Sites, applications, and other digital channels by signing up, creating accounts (including using social media login), filling out forms, using chat services, commenting, or otherwise engaging with our online Services;
• Purchase a product from us;
• Communicate with us by e-mail or phone;
• Subscribe to e-mails, newsletters, or other features made available on our Sites or apps from time to time;
• Report a problem or request support for any of our Services;
• Apply to, register for, inquire about or participate in our programs or events;
• Buy a ticket from us;
• Interact with our social media accounts;
• Participate in our contests, promotions, sweepstakes or surveys;
• Interact with technology platforms we make available to you;
• Subscribe to or otherwise view our content online, including any of our online social media channels official videos, or participate in any of our online streaming events;
• Attend any event using our Services (e.g. ticket scanning, CCTV, and other On Location interactions you may have with us);
• Interact with us in person at events; and
• Interact with us during your time at our events.

Information We Collect From Other Sources

We work closely with our affiliates that are part of Endeavor to provide our Services, market to you and to provide a seamless service across different businesses. As such we receive from such affiliates, personal information such as name, email, phone number or address.

We work closely with third parties, including FIFA, and may receive personal information about you from them such as: technology, customer support service partners, and other service providers (to seamlessly provide our services to you), fraud prevention and cybersecurity companies (that protect our Services and information from fraud or other cyber threats), event registration companies and venue providers (that enable you to register for our events, and host events and provide various marketing, advertising, customer support, and security services related to events), cookies and similar tracking technologies (information that is automatically collected when you visit our Sites), medical services partners (that assist in providing medical services (e.g. medications, allergies, emergency care, etc.), marketing, media and digital content partners (IP addresses and email addresses to market our products and services and create additional audiences for our Services), partners and sponsors (which partner with us or sponsor our events), performance technology platforms (to enhance our service offering to you by providing performance statistics and analytics), ticketing providers (that provide services supporting our sale of tickets for our events), promotions companies (which assist in operating and managing promotions), reservation booking platforms, advertising networks (such as Google/Bing), analytics providers, payment providers and processing companies (that process your purchases of our Services and fulfil your payments on our behalf, by providing us with your billing and purchase information), e-commerce platforms (that provide platforms enabling you to purchase our Services (e.g.,tickets to events, etc.) and fulfil your orders on our behalf), lead generation partners (which provide us with your information if you are interested in receiving our Services or communicating with us), directly managed hotels and travel bookings (that enable us to facilitate your travel to/from our events), and third party data providers (that provide us with information regarding individuals interested in our Services or the services of our affiliates).

We may also receive and display personal information and content which is or you make publicly available on your social media account when you use social media logins for our Services or interact with any of our content (such as contests or when you post using one of our promoted hashtags).

Some of our key partners, which we receive data from and may share some data with (see " DISCLOSURE OF PERSONAL INFORMATION " section below), include:

• E-commerce platforms and services
• Media and digital content partners.
• Ticket sellers and ticketing platforms around the world who sell tickets to events

INFORMATION WE COLLECT AND HOW WE USE IT

This is the generally applicable portion of the Privacy Policy. Depending on your jurisdiction, please also refer to the jurisdiction-specific section below that is relevant to you. If there is any conflict between the generally applicable portion and the jurisdiction-specific section, the jurisdiction-specific section shall prevail in the event that you are located in such a jurisdiction.

We may also use personal information we have about you

• as necessary if we believe there has been a breach of the Purchase Policy, Terms of Use, the FIFA 2026 Ticketing Terms and Conditions or the rights of any third party,
• as necessary to assist in the investigation of potential criminal activity or other activity that is in violation of our rules, regulations and policies, or
• to comply with legal and regulatory requirements.

We combine personal information we receive from other sources with personal information you give to us and personal information we collect about you. We use this combined information for the purposes set out above. We may use data that has been anonymized or aggregated without limitation in a lawful manner.

DISCLOSURE OF PERSONAL INFORMATION

We do share personal information with Endeavor, FIFA, Soccer United Marketing, LLC, Major League Soccer, LLC and the other categories of partners as listed above. Some of these disclosures of personal information may constitute a sale of personal information under certain data privacy laws (i.e. CCPA). Accordingly, we offer the option for you to opt out of the transfer or sale of personal information, as further set forth below.

FIFA, Soccer United Marketing, LLC, and Major League Soccer, LLC as independent data controllers of your personal data, will utilize or share your personal data among them and their affiliates, for the purposes set out above and in their privacy policy, a copy of which can be found here. FIFA will further share information with its third-party partners, which can be found here.

We may also disclose personal information to third parties:

• if we evaluate or enter into negotiations to buy, sell, or merge with any business or assets, or if we enter into bankruptcy, reorganization, or receivership, or some similar proceeding in which case we may disclose personal information about you to the prospective or eventual seller or buyer of such business or assets;
• if we are under a duty to disclose or share personal information about you in order to comply with any legal obligation, or in the event of an emergency, or in order to enforce or apply our applicable Terms of Use, registration documents, and other agreements, or to protect the rights, property, or our safety or of, Endeavor, our customers, clients or others; and
• to any other third party not covered in this Privacy Policy with your prior consent.

MARKETING AND ADVERTISING

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use the information we have collected from you to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.
You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

Third-party marketing

We may share your personal data with third parties for marketing purposes. Where required by law, we will obtain your express opt-in consent before sharing your personal data with any third party for marketing. You may also have the right to opt out of such sharing at any time, in accordance with applicable law.

COOKIES

We and trusted third parties use cookies and similar technologies on the Site to collect and process personal information. For more information, please see our Cookie Notice. You can change your preferences by interacting with the cookie banner on our Site and selecting "Cookie Settings."

GLOBAL PRIVACY CONTROL AND OPT-OUT PREFERENCE SIGNALS

We recognize user-initiated opt-out preference signals sent by your web browser, such as the global privacy control ("GPC"), as a valid request to opt-out of the sale and sharing of personal information processed on this website (i.e., through cookies and tracking technologies). For more information about GPC and how to implement it on your browser, please visit globalprivacycontrols.org.

DO NOT TRACK

Please note that certain web browsers may also transmit "do-not-track" signals to the websites with which the user communicates. Because there currently is no industry standard concerning what, if anything, websites should do when they receive such signals, we do not alter our practices when the website receives a "do-not-track" signal from a visitor's browser

STORAGE AND TRANSFER OF INFORMATION

We operate the Services and store personal information about you in and from a number of different jurisdictions, including the United States, the United Kingdom (the "UK") and European Economic Area (the "EEA"). The personal information that we collect from you will be transferred to and stored at/processed in countries outside of your location. Personal information about you is processed by staff operating outside of your respective country who work for us or our third party service providers. Personal information about you may be disclosed in response to inquiries or requests from government authorities or to respond to legal process in the countries in which we operate and/or store personal information about you. We will take steps reasonably necessary to ensure that your information is treated securely and in accordance with this Privacy Policy. For any transfers outside the UK or EEA, we transfer information to be able to perform our Services under our contract with you. In order to comply with applicable laws and their requirements on international data transfers, we may ask you for consent to such transfer or, where possible, we will enter approved model contracts like the European Commission's model contracts, and, in any cases, we will provide appropriate safeguards required by laws for the transfer of personal information to third countries (i.e. the standard contractual clauses), or, for transfer out of the UK, China, Russia and other countries, any similar model contracts approved by the relevant authorities with entities we share your data with.

RETENTION OF INFORMATION

We will retain your Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the Services to you; (ii) whether there is a legal obligation to which we are subject; or (iii) whether retention is legally advisable (for example, in regard to applicable statutes of limitations, litigation or regulatory investigations so that we can preserve evidence to protect or defend our rights).

JURISDICTION SPECIFIC SECTIONS

CALIFORNIA AND OTHER U.S. STATES

This section of the Privacy Policy provides additional information for residents of the United States, as required under the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA") and any current or future adopted comprehensive U.S. consumer privacy laws that come into effect, collectively referred to as "U.S. Privacy Laws" and applies to Personal Information, whether collected online or offline.

In the past 12 months, we collected, used, shared, and sold (as defined within the California Consumer Privacy Act ("CCPA")), the categories of personal information detailed in the chart above in the " INFORMATION WE COLLECT AND HOW WE USE IT" section. As also noted above, we sell personal information as that term is defined in the CCPA.

Various U.S. Privacy Laws provide individuals with certain rights relating to the collection, storage, and processing of their Personal Information. This section describes your rights under those laws and explains how to exercise those rights. Subject to certain exceptions, individuals have the right to make the following requests:

• Information about You. You may ask for us to state what categories of personal information about you we have, and the categories of sources from which we collect personal information about you.
• Receive a Copy of Your Data. You may request the categories and specific pieces of information (if any) we have about you, the categories of personal information that we have disclosed about you for a business purpose, and the categories of third parties with which we have shared personal information.
• Delete Your Data. You may request that we delete the personal information we have collected from you.
• Right to Opt Out of Sale and Sharing: You have the right to opt out of the sale of your personal information and the disclosure of your personal information for cross-context advertising.
• Right to Limit Processing of Sensitive Personal Information: You have the right to tell us not to process sensitive personal information except for the purpose for which it was originally collected.
• Non-Discrimination. You have the right not to receive discriminatory treatment for the exercising of your privacy rights.

In addition, California's "Shine the Light" law permits users of our Services, who are California residents, to request certain personal information regarding our disclosure of personal information to third parties for their direct marketing purposes.

How to Exercise Your Rights. To exercise any of the above California Privacy Rights, please follow the instructions below:

• By phone at 1-866-983-0571
• Online by using this webform.

Verification Process and Required Information. All requests must be verified. Some requests, including receiving a copy of personal information about you or requests made by an agent claiming to be acting on your behalf, are subject to heightened requirements. Authorized Agent. You may designate an authorized agent to make a request on your behalf. An authorized agent must have written documentation of their authority to act on your behalf, such as a power of attorney.

OPTING IN TO/OPTING OUT OF THE SALE OF PERSONAL INFORMATION

We share personal information about you with sponsors, vendors, Endeavor, technology partners, and third party advertising networks (as discussed above in the "INFORMATION WE COLLECT AND HOW WE USE IT" section). These transfers, which are used to provide you with certain Services and/or to more effectively provide you with personalized services (including advertising), can be deemed a sale under some data privacy laws, including the California Consumer Privacy Act and Nevada law.

You may opt out of the sale of personal information about you by clicking on the Do Not Sell My Personal Information link on the appropriate Site or calling 1-866-983-0571. You will be asked to provide certain information to us in order to exercise this option so we can verify your identity and locate your records with us.

If you are a 13-16 years old, you may opt in to the sale of personal information, including by submitting a request through this webform.

Please note if do not provide us with certain information, we may be unable to provide you with certain corresponding Services.

EEA AND UK

If you are in, the EEA or UK, the disclosures set out below apply to you (as applicable) in addition to the disclosures set out in the general sections of this Privacy Policy.
In order to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR") and the UK General Data Protection Regulation and/or the UK Data Protection Act 2018 (together, the " UK GDPR"),

We process personal information about you on the legal basis specified in the table.

Depending on your jurisdiction, certain laws may apply to you and personal information about you, and you may have certain rights in relation to personal information about you:

• Access. You have the right to access personal information we hold about you and ask us for other information such as purposes of processing, categories of personal information and recipients of the information.
• Portability. You have the right to request a copy of personal information about you and request that we transfer it to a third party (with certain exceptions).
• Correction. You may be entitled to request correction of any personal information about you which is incomplete or inaccurate.
• Erasure. In certain circumstances, you have the right to request deletion or erasure of the personal information we hold about you.
• Restriction of processing to storage only. You have the right to require us to stop processing the personal information we hold about you other than for storage purposes in certain circumstances.
• Objection. Where we are processing personal information about you on the basis of legitimate interests, you have the right to object to our processing of personal information about you. You also have the right to object to marketing at any time by opting out at the bottom of our emails to you.
• Withdrawal of Consent. Where we rely on consent to process personal information about you, you have the right to withdraw this consent at any time by contacting us using the webform.
• Appeal. Where applicable, you may have the right to appeal actions regarding your privacy request.
• Complaint. You also have a right to lodge a complaint with a supervisory authority should you feel unsatisfied with our treatment of your personal information.

These rights apply under and subject to applicable law and in many cases are limited by applicable law. For example, where fulfilling your request would adversely affect other individuals or our trade secrets or intellectual property or where there are overriding public interest reasons or where we are required by law to retain personal information about you. If you want to exercise any of these or other rights under applicable law, please contact us using the webform. We may require you to prove your identity with approved identification. We will respond to any requests to exercise your rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances).

We will retain personal information about you for as long as needed to provide you with the Services you have requested. We will retain and use personal information about you as necessary to comply with our legal obligations, resolve disputes and enforce our agreements.

SECURITY

We use a variety of administrative, physical, and technology solutions to protect your data from unauthorized access, loss, or misuse. Because there is always some risk in transmitting data over the internet and otherwise processing data, we cannot and do not guarantee or warrant the security of any data that you transmit on or through the Services or that we otherwise maintain.

LINKS TO THIRD PARTY WEBSITES

Our Services, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others, including our partner networks and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.

UPDATES

Any updates we may make to our Privacy Policy will be posted on this page, and we may also provide a website notice of any material changes for a reasonable period of time. Please check back frequently to see any updates or changes to our Privacy Policy. If you do not agree or consent to these updates or changes, do not continue to use the Services.

CONTACT

Questions or comments regarding this Privacy Policy should be submitted to us using the webform.