PRIVACY POLICY
CHAPTER I – IDENTIFICATION OF THE CONTROLLER
1.1. This Privacy Policy governs the processing of personal data carried out by HEXAGON SPORTS TECNOLOGIA LTDA, a company incorporated under the laws of Brazil, enrolled with the CNPJ under No. 65.251.728/0001-31, headquartered at Rua Serra de Bragança, No. 1555, Vila Gomes Cardim, ZIP 03318-000, São Paulo/SP, Brazil, hereinafter referred to simply as “HEXAGON”.
1.2. For the purposes of the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018), HEXAGON acts as the Data Controller, pursuant to Article 5, item VI, of the LGPD.
CHAPTER II – SCOPE
2.1. This Policy applies to the processing of personal data carried out by HEXAGON across its websites, mobile applications, administrative panels, integrations, APIs, systems, and other products or services made available to Users (the “Platform”).
2.2. This Policy shall be construed together with the Platform Terms of Use, which govern matters related to the use of the services, Content, images, videos, features, rights, and responsibilities of Users.
CHAPTER III – DATA WE MAY PROCESS
3.1. HEXAGON may collect and process personal data provided directly by Users, generated during the use of the Platform, or lawfully obtained through integrations, partners, and service providers.
3.2. The data processed may include information necessary for identification, authentication, use of the Platform, participation in sports activities, interaction between Users, processing of Content, use of features, processing of payments, and operation of the services made available by HEXAGON.
3.3. The processing of images, videos, audiovisual Content, sports statistics, sports Highlights, team information, championships, and other Content made available by Users shall comply with this Policy and the Platform Terms of Use.
3.4. HEXAGON does not intentionally collect personal data beyond that which is necessary to provide its services, in compliance with the principles of purpose, suitability, and necessity set forth in Article 6 of Law No. 13.709/2018.
CHAPTER IV – PURPOSES AND LEGAL BASES FOR PROCESSING
4.1. HEXAGON may process personal data to enable the use of the Platform, manage User Accounts, make features available, organize sports activities, authenticate access, prevent fraud, generate statistics, improve products and services, comply with legal and regulatory obligations, conduct institutional and promotional communications, and perform the features described in the Terms of Use.
4.2. The processing of personal data may be based on the legal grounds set forth in Law No. 13.709/2018 (LGPD), particularly upon the Data Subject’s consent, compliance with a legal or regulatory obligation, performance of a contract, regular exercise of rights, and HEXAGON’s legitimate interest, as applicable to each processing operation.
4.3. Where required by applicable law, HEXAGON shall request specific, prominent, and unambiguous consent for certain personal data processing operations.
4.4. HEXAGON may use personal data in anonymized or aggregated form for statistical, analytical, technological, academic, commercial, or new product and feature development purposes, in compliance with the provisions of Articles 12 and 13 of Law No. 13.709/2018.
CHAPTER V – IMAGES, VIDEOS, AND AUDIOVISUAL CONTENT
5.1. HEXAGON may process images, videos, sports clips, Highlights, statistics, and other audiovisual Content made available by Users or generated within the context of the Platform’s features.
5.2. The processing of such Content may occur to enable the operation of the Platform, allow sharing between Users, make sports features available, enhance the user experience, and promote HEXAGON’s services, as provided in the Terms of Use.
5.3. The rules concerning the publication, sharing, download, circulation, and use of such Content are set forth in the Platform Terms of Use, which supplement this Privacy Policy.
CHAPTER VI – DATA SHARING
6.1. HEXAGON may share personal data with partners, suppliers, service providers, event organizers, arenas, payment processors, technology infrastructure providers, and other agents necessary for the regular operation of the Platform.
6.2. Sharing shall occur only when necessary for the performance of the services, compliance with legal obligations, regular exercise of rights, HEXAGON’s legitimate interest, or upon the Data Subject’s consent, where required by applicable law.
6.3. HEXAGON may share data with administrative, regulatory, or judicial authorities whenever there is a legal obligation, court order, or valid request from a competent authority.
6.4. HEXAGON does not sell the personal data of its Users.
CHAPTER VII – GEOLOCATION AND LOCATION-BASED FEATURES
7.1. Certain Platform features may use location data to identify arenas, venues, hubs, sports events, nearby services, or other features related to the sports ecosystem.
7.2. Whenever required by the operating system or by applicable law, the collection of location data shall depend on the User’s prior authorization.
7.3. Users may manage location permissions directly in their device settings, subject to the technical limitations of the features used.
CHAPTER VIII – ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
8.1. HEXAGON may use automated technologies, algorithms, artificial intelligence, machine learning, and related tools to improve the Platform and develop new features.
8.2. Such technologies may be used for organizing Content, generating sports statistics, identifying sports events, creating Highlights, providing recommendations, analyzing performance, preventing fraud, and improving the user experience.
8.3. Automated processing shall comply with the principles and safeguards set forth in Law No. 13.709/2018 (LGPD), particularly those related to transparency, security, and non-discrimination.
CHAPTER IX – INTERNATIONAL DATA TRANSFER AND CROSS-BORDER USERS
9.1. HEXAGON may use storage, hosting, processing, security, data analytics, authentication, and technology infrastructure services provided by companies located in Brazil or abroad.
9.2. As a result of the use of such services, certain personal data may be processed or stored outside Brazilian territory, in compliance with the provisions of Articles 33 to 36 of Law No. 13.709/2018 (LGPD).
9.3. HEXAGON shall adopt measures to ensure that any international transfers are carried out in accordance with applicable law and observe adequate levels of protection for personal data.
9.4. The Platform is operated from Brazil. Users located in the United States and other countries acknowledge and understand that their personal data may be transferred to, processed, and stored in Brazil, where data protection laws may differ from those of their jurisdiction. By using the Platform, such Users consent to this cross-border processing.
CHAPTER X – CHILDREN AND ADOLESCENTS
10.1. HEXAGON may make its services available to children and adolescents, in compliance with the provisions of Law No. 8.069/1990 (Statute of the Child and Adolescent – ECA), Law No. 13.709/2018 (LGPD), Law No. 15.211/2025, and other applicable rules.
10.2. The processing of personal data of children and adolescents shall observe the principle of the best interests of the minor and the other applicable legal safeguards.
10.3. Where required by law, HEXAGON may request authorization, consent, or validation from a legal guardian for the use of certain Platform features.
10.4. HEXAGON may adopt reasonable mechanisms for age verification, privacy protection, and security intended to protect children and adolescents in the digital environment.
10.5. With respect to Users located in the United States, HEXAGON complies with the U.S. Children’s Online Privacy Protection Act (COPPA). HEXAGON does not knowingly collect personal information from children under the age of 13 residing in the United States without verifiable parental consent. If HEXAGON becomes aware that it has collected personal information from a U.S. child under 13 without such consent, it will take reasonable steps to delete that information.
10.6. A parent or legal guardian of a U.S. child under 13 may request to review, refuse further collection or use of, or delete their child’s personal information by contacting HEXAGON through the channels set forth in Chapter XVII of this Policy.
CHAPTER XI – DATA RETENTION AND DELETION
11.1. Personal data shall be stored for the period necessary to fulfill the purposes described in this Policy, the Terms of Use, legal or regulatory obligations, and the regular exercise of HEXAGON’s rights.
11.2. Upon the conclusion of processing, data may be deleted, anonymized, or retained in the cases authorized by applicable law, particularly those set forth in Article 16 of Law No. 13.709/2018.
11.3. The deletion of data may be limited where necessary for compliance with legal, regulatory, or contractual obligations, audits, fraud prevention, or defense in administrative, arbitral, or judicial proceedings.
CHAPTER XII – COOKIES AND SIMILAR TECHNOLOGIES
12.1. HEXAGON may use cookies, pixels, device identifiers, SDKs, and similar technologies to enable the operation of the Platform, improve the user experience, generate statistics, and enhance its products and services.
12.2. These technologies may be used for authentication, security, content personalization, performance analysis, fraud prevention, and features related to navigation on the Platform.
12.3. Users may manage certain preferences related to cookies and similar technologies through their browser, device, or operating system settings, subject to applicable technical limitations.
CHAPTER XIII – COMMUNICATIONS AND MARKETING
13.1. HEXAGON may carry out institutional, operational, informational, and promotional communications, as well as communications related to the services made available on the Platform.
13.2. Communications may take place by email, in-app notifications, SMS messages, WhatsApp, push messages, or other electronic means provided by the User.
13.3. Where applicable, Users may request to stop receiving promotional communications, without prejudice to communications necessary for the operation of the Platform or for compliance with legal obligations.
CHAPTER XIV – INFORMATION SECURITY
14.1. HEXAGON adopts reasonable technical, administrative, and organizational measures to protect the personal data under its responsibility against unauthorized access, destruction, loss, alteration, disclosure, or any form of inappropriate or unlawful processing.
14.2. The security measures shall be implemented in a manner compatible with the nature of the data processed, the risks involved, and the available technologies, in compliance with the provisions of Articles 46 to 49 of Law No. 13.709/2018.
14.3. No system is absolutely secure. For this reason, although HEXAGON adopts reasonable protection measures, it cannot guarantee the absolute absence of security incidents.
CHAPTER XV – RIGHTS OF DATA SUBJECTS
15.1. Pursuant to Articles 17 to 22 of Law No. 13.709/2018 (LGPD), Data Subjects may exercise the rights set forth in applicable law.
15.2. Among other legally guaranteed rights, the Data Subject may request information about the processing of their personal data, correction of incomplete or outdated data, deletion of data where applicable, portability, withdrawal of consent, and other rights provided for by law.
15.3. Requests shall be analyzed and answered by HEXAGON within the limits and timeframes provided for by applicable law.
CHAPTER XVI – U.S. STATE PRIVACY RIGHTS (CCPA/CPRA)
16.1. This Chapter applies to Users who are residents of U.S. states that have enacted applicable consumer privacy laws, including, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”). It supplements, and does not replace, the rights described elsewhere in this Policy.
16.2. Subject to the conditions and exceptions set forth in applicable law, eligible Users have the following rights with respect to their personal information: (i) the right to know and access the categories and specific pieces of personal information collected, the sources of such information, the purposes for collecting it, and the categories of third parties with whom it is shared; (ii) the right to delete personal information; (iii) the right to correct inaccurate personal information; (iv) the right to opt out of the “sale” or “sharing” of personal information; (v) the right to limit the use and disclosure of sensitive personal information; and (vi) the right not to receive discriminatory treatment for exercising any of these rights.
16.3. HEXAGON does not sell personal information for monetary consideration. To the extent that any disclosure of personal information for cross-context behavioral advertising may be deemed “sharing” under applicable law, eligible Users may opt out of such sharing through the channels set forth in Chapter XVII of this Policy.
16.4. Eligible Users may exercise their rights by contacting HEXAGON through the channels described in Chapter XVII. HEXAGON may request additional information to verify the identity of the requester before fulfilling a request, and an authorized agent may submit a request on the User’s behalf where permitted by applicable law. HEXAGON will not discriminate against any User for exercising these rights.
CHAPTER XVII – PRIVACY CHANNEL
17.1. Requests related to the protection of personal data, privacy, the exercise of rights under the LGPD or applicable U.S. state privacy laws, or questions concerning this Policy may be submitted through the official channels made available by HEXAGON, including by email at privacy@hexagonsports.com.br or through the contact form available on HEXAGON’s website.
17.2. HEXAGON may request additional information to confirm the identity of the requester and to protect the personal data involved.
CHAPTER XVIII – CHANGES TO THIS POLICY
18.1. This Privacy Policy may be amended at any time for legal, regulatory, operational, technological, or commercial purposes.
18.2. Updated versions shall be made available through HEXAGON’s official channels.
18.3. Continued use of the Platform after the publication of changes shall be construed as acknowledgment of the new version of the Policy, without prejudice to the cases in which the law requires specific consent.
CHAPTER XIX – FINAL PROVISIONS
19.1. This Privacy Policy shall be construed together with the Platform Terms of Use and applicable law.
19.2. Should any provision of this Policy be deemed invalid, illegal, or unenforceable, the remaining provisions shall remain valid and fully effective.
19.3. This Policy enters into force on the date of its publication and shall remain in effect for as long as there is processing of personal data related to HEXAGON’s activities.