1) COLLECTION OF YOUR INFORMATION

We may collect information about you in a variety of ways. The information we may collect on the Site includes:

A. Personal Data You Provide

Personally identifiable information, such as your name, email address, telephone number, username (if applicable), and other information you voluntarily provide when you:

• sign up for communications or newsletters,

• submit a form or inquiry,

• create or manage an account (where available), or

• participate in interactive features of the Site (such as commenting, message boards, or community features, where applicable).

Where you sign up to receive email communications from us, we may process your information through our email communications provider (for example, Mailchimp).

You are under no obligation to provide personal information; however, refusing to provide certain information may limit your ability to use some Site features.

B. Event Registration and Participation Data (Collected via Registration Partners)

Event registrations are typically handled by an event registration provider and/or its payment processor (each, a “Registration Partner”). Depending on the event and jurisdiction, information collected during registration may include:

• name, email, phone, and address (where required by the event),

• emergency contact information,

• date of birth or age category, gender, nationality (where relevant),

• team/club, category selections, bib preferences, and other event-specific details,

• medical/safety information you choose to provide where relevant to participation (for example, allergies or medical notes), and

• results/timing information (for example, finish time, ranking, splits), where applicable.

For XTERRA-owned events, XTERRA currently uses ACTIVE Network, LLC (“ACTIVE”) as a Registration Partner in many cases. For licensed events, the independent Event Organizer may use a different Registration Partner. Registration Partners process information under their own privacy policies and terms, and you should review those notices during registration.

C. Payment and Transaction Data

Payment processing for event registrations is typically handled by a Registration Partner and/or its payment processor. XTERRA does not receive or store full payment card numbers when payments are processed by Registration Partners. We may receive limited transaction information (such as confirmation of payment, amount, currency, date/time, and a transaction reference) for accounting, refunds (where applicable), customer support, and fraud prevention.

D. Derivative Data (Automatically Collected)

Information our servers automatically collect when you access the Site, such as your IP address, browser type, operating system, device identifiers (as available), access times, referring/exit pages, and pages you viewed before and after accessing the Site.

E. Cookies and Similar Technologies

We and our partners may collect information through cookies, pixels, web beacons, and similar technologies as described in the “Cookies, advertising, and analytics” section below.

F. Data From Social Networks (If You Choose to Interact)

If you interact with the Site through social networks (such as Facebook, Instagram, Pinterest, X (formerly Twitter), or other platforms), we may receive information you choose to make available to us or that the platform shares according to your settings, such as your name, username/handle, profile picture, and public profile information.

G. Data From Contests, Giveaways, and Surveys

Personal and other information you may provide when entering contests or giveaways and/or responding to surveys.

2) USE OF YOUR INFORMATION

Having accurate information about you allows us to provide, maintain, and improve the Site and related services. We may use information collected about you to:

• Provide and operate the Site and its features.

• Respond to your inquiries and provide customer support.

• Send administrative information, such as updates to policies, security notices, and service messages.

• Deliver newsletters and other communications you request or consent to receive.

• Manage and send email communications through our service providers (for example, Mailchimp), including measuring engagement (such as opens and clicks) to improve communications.

• Facilitate event-related communications and participant services where applicable (for example, confirmations, essential event updates, safety notices, and customer support).

• Administer promotions, contests, sweepstakes, surveys, or similar initiatives.

• Monitor and analyze usage and trends to improve user experience and Site performance.

• Maintain the security and integrity of the Site, including fraud prevention and abuse monitoring.

• Comply with legal obligations and enforce our Terms & Conditions and other policies.

• Conduct legitimate business activities not otherwise prohibited by law.

3) DISCLOSURE OF YOUR INFORMATION

We may share information we have collected about you in certain situations, as described below.

A. By Law or to Protect Rights

We may disclose your information where we believe it is necessary to comply with legal process, respond to lawful requests, investigate or remedy potential violations of our policies, protect the rights, property, and safety of XTERRA, our users, or others, or to prevent fraud and security issues.

B. Service Providers

We may share your information with service providers that perform services for us or on our behalf, such as website hosting, analytics, customer support tools, email delivery, fraud prevention, and marketing support. For example, we use Mailchimp to manage and send email communications. Service providers are permitted to process personal information only to provide services to us and must protect it consistent with applicable contractual and legal requirements.

C. Event Registration, Event Organizers, and Registration Partners

XTERRA events may be operated directly by XTERRA Global, LLC (“XTERRA-owned events”), by XTERRA affiliates, or by independent event organizers operating under an XTERRA license (“Event Organizers”).

When you register for an event, your personal information may be collected through a Registration Partner selected by the applicable Event Organizer. Registration Partners may collect information directly from you and process it under their own privacy policies and terms.

For XTERRA-owned events, XTERRA currently uses ACTIVE as a Registration Partner in many cases. For licensed events, the Event Organizer may use a different Registration Partner.

XTERRA and/or the Event Organizer may receive registration information from the Registration Partner to:

• administer the event,

• provide participant services and communicate essential event updates,

• manage safety and medical support where applicable,

• handle refunds and customer service, and

• publish results and rankings (where applicable).

D. Optional Add-Ons and Third-Party Services You Request

If an event includes optional add-ons or third-party services (for example, charity fundraising, photography, transportation, or other services offered in connection with the event), your information may be shared with relevant providers where you have requested, authorized, or purchased those services.

E. Marketing Communications

With your consent, or with an opportunity for you to withdraw consent, we may share your information with third parties for marketing purposes as permitted by law.

F. Interactions With Other Users; Public Content

If you interact with other users of the Site (where applicable), those users may see information you choose to make available, such as your name, profile photo, and activity. Any content you post publicly may be viewed by others and may be publicly distributed outside the Site.

G. Advertising and Analytics Partners

We may share certain information with advertising and analytics partners as described in the “Cookies, advertising, and analytics” section, subject to your choices and applicable law.

H. Affiliates

We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy.

I. Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to applicable law.

J. With Your Consent

We may share your information with other third parties for which we have received your consent.

4) COOKIES, ADVERTISING, AND ANALYTICS

A. Cookie Banner and Preferences Tool

We use a cookie banner and preferences tool to provide you with choices about cookies and similar technologies used on our Site. When you first visit the Site, you can choose which categories of cookies to allow (except for strictly necessary cookies, which are required for the Site to function). You may update your choices at any time through the cookie preferences tool available on the Site.

B. Cookies and Similar Technologies

We and our partners may use cookies, web beacons, tracking pixels, SDKs, and similar technologies to:

• operate the Site and enable core functionality,

• remember preferences and settings,

• customize content,

• measure the effectiveness of communications, and

• support advertising and analytics.

You can also remove or reject cookies through your browser settings. However, disabling certain cookies may affect the availability and functionality of the Site.

C. Internet-Based Advertising

We may allow third-party advertising partners to use cookies or similar technologies to collect information about your activity over time and across websites to display interest-based advertising and measure ad performance, where permitted by law and subject to your cookie preferences.

D. Website Analytics

We may use analytics providers (such as Google Analytics) to help analyze and understand how users use the Site. These providers may use cookies or similar technologies to collect information. You can control the information provided to Google and opt out of certain analytics by using Google’s opt-out browser add-on and other resources provided by Google.

5) THIRD-PARTY WEBSITES

The Site may contain links to third-party websites and applications that are not affiliated with us. This Privacy Policy does not apply to third-party sites. We are not responsible for the privacy practices, content, or security of third-party sites. You should review the privacy policies of any third-party site you visit.

6) SECURITY OF YOUR INFORMATION

We use administrative, technical, and physical security measures designed to help protect your personal information. However, no security measures are perfect or impenetrable, and no method of transmission can be guaranteed against interception or misuse. Therefore, we cannot guarantee absolute security.

7) POLICY FOR CHILDREN

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete it as soon as reasonably practicable.

In certain jurisdictions (including parts of the EU/EEA), additional protections may apply to minors under 16. Where required, we will obtain appropriate consent.

8) CONTROLS FOR DO-NOT-TRACK FEATURES

Some web browsers and mobile operating systems include Do-Not-Track (“DNT”) features. Because there is no common standard for interpreting DNT signals, we do not respond to all DNT signals in a uniform way. You can generally control tracking through the cookie preferences tool on the Site and browser controls.

9) OPTIONS REGARDING YOUR INFORMATION

A. Account Information (Where Applicable)

If the Site provides account features, you may review, correct, or update your account information by logging into your account settings or contacting us.

B. Deletion Requests

You may request deletion of certain personal information by contacting us. We may retain information as required or permitted by law for legitimate purposes, such as compliance, dispute resolution, fraud prevention, and enforcing our agreements.

C. Marketing Communications

You may opt out of marketing emails by using the unsubscribe link in those communications. Even if you opt out, we may still send non-marketing messages (for example, essential service notices or event-related transactional communications where applicable).

10) YOUR CALIFORNIA PRIVACY RIGHTS

A. Shine the Light

California Civil Code Section 1798.83 permits California residents to request certain information about disclosures of personal information to third parties for direct marketing purposes. To make a request, contact us using the information in the “Contact us” section.

B. California Consumer Privacy Act (CCPA/CPRA) Rights

If you are a California resident, you may have the right to:

• know what personal information we collect, use, disclose, and share,

• access specific pieces of personal information,

• request deletion of personal information (subject to exceptions),

• correct inaccurate personal information (subject to exceptions),

• opt out of the “sale” or “sharing” of personal information (as those terms are defined under California law),

• limit the use and disclosure of sensitive personal information (where applicable), and

• not be discriminated against for exercising your rights.

California “Sale” / “Sharing” for Advertising:

We do not sell personal information in exchange for money. However, we may allow certain advertising and analytics partners to collect information about your activity on our Site to help deliver and measure ads, perform analytics, and support fraud prevention. Under some California privacy laws, this may be considered “selling” or “sharing” personal information. Where applicable, you can opt out through the cookie preferences tool on the Site.

C. How to Submit a California Request

You may submit a request by emailing [email protected] or writing to the address in the “Contact us” section. We will take reasonable steps to verify your identity before fulfilling requests.

You may also designate an authorized agent to make a request on your behalf, subject to verification and applicable law.

11) RESIDENTS OF CANADA

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canadian residents may have rights to access and challenge the accuracy of their personal information, subject to certain exceptions. Personal information may be transferred outside Canada (including to the United States) and may be accessible to law enforcement and national security authorities in those jurisdictions.

Under Canada’s anti-spam legislation (CASL), we may be required to obtain your express consent before sending certain promotional messages. Where required, we will seek appropriate consent and provide opt-out mechanisms.

12) RESIDENTS OF THE EUROPEAN UNION, EEA, AND SWITZERLAND (GDPR)

This section applies if you are located in the EU, EEA, or Switzerland.

A. Purposes and Legal Bases

We process personal data to operate the Site, respond to inquiries, provide communications you request, and support event-related services where applicable. Legal bases may include:

• performance of a contract,

• legitimate interests (for example, operating and improving the Site, security and fraud prevention),

• compliance with legal obligations, and

• consent (for example, certain marketing communications and non-essential cookies where required).

B. Your Rights

Subject to applicable law, you may have the right to:

• access your personal data,

• rectify inaccurate data,

• erase data,

• restrict processing,

• object to processing,

• data portability, and

• withdraw consent (where processing is based on consent).

You also have the right to lodge a complaint with your local supervisory authority.

C. International Transfers

Personal data may be transferred to and processed in the United States and other countries where we or our service providers operate. Where required, we implement appropriate safeguards for cross-border transfers (such as standard contractual clauses) or rely on another lawful basis permitted by law.

D. Retention

We retain personal data for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

To exercise your rights, contact us at [email protected].

13) RESIDENTS OF MEXICO

Under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, you may have rights to access, rectify, cancel, or oppose processing of your personal data (ARCO rights), subject to legal requirements and exceptions. To exercise rights, contact [email protected].

Cross-border transfers may occur, including to the United States, to enable operations such as email communications and Site services. Where required, we will obtain consent for transfers and implement appropriate protections.

Service Provider (example):

• Mailchimp – Email communications management.

14) CHANGES TO THIS POLICY

We reserve the right to make changes to this Privacy Policy at any time. We will update the “Last updated” date at the top of this Privacy Policy. Your continued use of the Site after changes are posted constitutes your acceptance of the updated policy.

15) CONTACT US

If you have questions or comments about this Privacy Policy, please contact us at:

XTERRA Global, LLC

45 South 7th Street #1810

Minneapolis, Minnesota 55402

United States

Email: [email protected]