PRIVACY POLICY FOR 3 STEP SPORTS LLC

Effective Date: July 1, 2026

3 STEP SPORTS LLC and its affiliates and subsidiaries (“3STEP,” "we," "our," or "us"), are committed to protecting the privacy and security of our users' personal information. This Privacy Policy (this “Policy”) describes the information we collect, how we use it, how we disclose it, how we use cookies, pixels, analytics, and advertising technologies, and how we safeguard your privacy when you interact with our products and services, both online and offline, including our website, mobile applications, social media pages, PlayerFirst^™ registration platform, marketplace, and other platforms (collectively referred to as the "Services").

This Policy applies to all individuals using our Services, including parents, guardians, players, and any other users who provide personal information to 3STEP. We are a youth sports company and our commitment to safeguarding your personal information is essential.

By using our Services, whether by visiting our website or otherwise or by voluntarily providing personal information to 3STEP, you acknowledge that you have read and understand the practices described in this Policy. Where applicable law requires consent, we will request consent separately, including through our cookie preference tools or other notices.

This Policy may be changed from time to time. Please review this page periodically to remain informed of any changes. If we make material changes to how we collect, use, disclose, sell, or share Personal Information, including for targeted advertising or analytics-supported advertising, we will update this Policy and provide any additionalnotice required by applicable law.

1. Information We Collect:

A. When you interact with us through the Services, we collect information that you provide, usage information, and information about your device(s). We may also collect information about you from other sources like service providers and optional activities in which you participate, and we may combine this information with other information about you.

B. “Personal Information” is information that identifies, relates to, describes, or can be reasonably linked to, directly or indirectly, a particular individual or household. In accordance with applicable laws, we collect Personal Information from you in connection with certain uses of our Services, such as when you register for our Services, sign up to receive electronic or other marketing communications, sign up to learn more about our upcoming events, enter a contest or sweepstakes, communicate with customer service, complete a questionnaire, or use a “share this article” or any similar feature on our Services. From time to time, we also may receive Personal Information about you from third-party sources to improve the Services and for the various purposes outlined in this Policy. The Personal Information we collect automatically may be combined with other information you provide us directly to personalize content and advertising based on your interests.

C. The Personal Information we collect consists of personal identifiers, commercial information, Internet/other electronic network activity information, geolocation data, professional or employment-related information, characteristics of protected classifications, and inferences drawn from this information. Specifically, the Personal Information we may collect includes:

(i) Identifiers, such as full name, date of birth, email address, telephone number, home address, billing address, shipping address, postal code, signature, usernames, account names, IP address, device identifiers, advertising identifiers, hashed identifiers, or other comparable identifiers

(ii) Demographic Information, such as age, gender, country, language preference, and other protected classifications under California or federal law.

(iii) Financial Information, such credit card information, bank account information, and transaction records.

(iv) Health-Related Information, such as allergies, medical conditions, and emergency contacts only when necessary for participant safety and with explicit consent from parents/guardians.

(v) Biometric Data, such as weight, height, and dominant hand solely for sports performance tracking and statistical purposes

(vi) User Credentials, such as username, password, password hints, and similar security information used to create an account and authenticate users of the Services.

(vii) Device Data, such as the type of device you are using, certain device identifiers which may be unique to your device, your Internet service provider, and, depending on your permissions.

(viii) Usage Data, such as browsing history, search queries, site visits, registrations, marketplace engagement, purchasing behavior, interactions with advertisements, and how you engage with and navigate our Services.

(ix) Log Information, such as information about your interactions with our Services, including the content you view, the programs, events, or products you register for, view, bid on, or purchase, the amount of time spent on our Services, the date on which you accessed our Services, and information in cookies, pixels, tags, software development kits, and similar technologies; and information about how you access our Services, including your browser or operating system, your Internet Protocol (“IP”) address, and the websites you visit before and after visiting our Services.

(x) Location Data, such as IP addresses received from your device and your specific location information drawn from your device’s GPS, Bluetooth, or Wi-Fi signals, including information about nearby Wi-Fi networks, location beacons, and cell towers.

(xi) Sensory Data, such as audio, electronic or other visual information you share with us and/or we photograph or film in public places in connection with our services.

(xii) Third Party Integrations. If you connect your use of the Services through a third-party service (e.g., a social media platform), the third party may share certain information from your third-party account with us.

(xiii) Employment-related information, including details found in resumes and applications you submit for our review and consideration.

(xiv) Educational details, including your school, graduation year, and grade point average (“GPA”).

(xv) Inferences. In addition to what you provide directly, we infer your interests and preferences from other data we collect, such as the content and advertisements you interact with while using the Services, or use information such as sport, team affiliation, program registration, product purchase details, and geography to create audience segments or profiles reflecting your preferences, behaviors, or characteristics (such as traits, psychological patterns, or abilities).

(xvi) Other Third-Party Data, consisting of the categories above, collected from third-party sources outside of the Services, such as data from our affiliates, partners, sponsors, vendors, or public sources.

(xvii) Communications, including the communications you send to us through human agents, AI chatbots, and automated systems, such as customer service inquiries, registration questions, product reviews, and other feedback regarding the Services.

D. We will not collect additional categories of personal data beyond those listed above without providing any notice required by applicable law prior to or at the time of collection.

E. By providing this Personal Information, you (or your parent/guardian if under 18) explicitly consent to our collection and use for the purposes outlined in this Policy.

2. How We Collect Information:

A. Information You Share Directly. We gather the information you choose to provide when using our Services. This includes data you share when creating an account on our website(s), making purchases (like tickets, products, or services), filling out forms, requesting information, signing up for marketing emails, subscribing for event updates, entering contests, contacting customer service, or completing surveys.

B. Cookies, Pixels, Web Beacons, and Other Technologies.

(i) Our Services use various online technologies, including “cookies,” “web beacons,” pixels, tags, software development kits, customer list matching tools, and other local storage methods, to collect information. This information is often combined with what you provide, including PlayerFirst registration-derived attributes, to analyze site visits, registrations, marketplace engagement, and purchasing behavior, and to customize content, onsite experiences, and ads according to your preferences and privacy choices.

(ii) Cookies are small text files placed on your device that help us recognize your browser across different websites and sessions. You can manage cookies through your browser or device settings, either blocking them or setting notifications when they are sent. For guidance on managing cookies, check your browser or device’s help resources. If you choose not to accept cookies, features of the Services might not function fully.

(iii) We also use other local storage methods like Local Shared Objects (commonly called "Flash Cookies"). These technologies operate like cookies, but they may store information in places other than your browser, making them harder to manage via standard browser controls. Your browser settings may offer controls for other types of local storage as well.

(iv) We use cookies, combined with additional data, to enhance your experience when using our Services (or other sites), support analytics, and provide limited adult-directed ad retargeting, including:

(a) Authenticating your identity when using our Services.

(b) Remembering your settings and account details.

(c) Measuring the effectiveness of our Services, advertisements, and emails (for instance, tracking which emails you open or interact with).

(d) Tailoring content, onsite experiences, registration and purchase reminders, and advertisements to your browsing behavior, registrations, purchases, sport, team affiliation, geography, and interests.

(v) We may also partner with third parties for limited targeted advertising and analytics-supported advertising. These partners may use cookies, pixels, tags, customer list matching tools, and similar technologies to display advertisements based on your browsing activity, registrations, purchases, and preferences. These partners may include Meta, Google Marketing Platform, and HighTouch. They may help us show you ads on various sites and apps, measure ad performance, suppress ads, limit ad frequency, personalize onsite experiences, and send registration or purchase reminders. We do not use sensitive Personal Information for advertising or analytics monetization. To opt out, you may use our cookie preference pop-up and select "Necessary Only," or submit a privacy rights request as detailed in the “Contact Us” section below.

(vi) Web beacons are tiny pieces of code embedded in webpages, emails, or videos that collect information about your browser and device. They are used to track page visits, email opens, and deliver cookies to your device.

C. Information from External Sources. We may obtain information about you from various third-party sources, including:

(i) Third-party data providers: For instance, we obtain Personal Information from analytics and advertising services such as Google Analytics, Google Marketing Platform, Meta, and HighTouch, including information about site visits, registrations, marketplace engagement, purchases, ad interactions, and audience segments.

(ii) Service Providers: We may receive Personal Information from our service providers such as Players Health, Exposure, Ironclad, Athlete Trax, LeagueApps, GotSport, SportsEngine, AES, WorldPay, Team Travel Source, Vertical Insure, Teamwork Online, and others who assist with our provision of Services.

(iii) Social Networks: If you engage with us on social media—such as by posting to our pages, tagging us, using hashtags, or commenting on posts—we may collect information from your social media account, including your account name, handle, recent activity, content of posts where we are tagged, and other details found on your profile to better interact with our audience.

(iv) Governing Bodies: For example, we may interact with governing bodies, to comply with the policies and training standards required by organizations governing our Services.

3. How We Use Your Personal Information: We use Personal Information we collect for various purposes, including:

A. Offering, managing, developing, maintaining, or supporting accounts, delivering information about training and leagues, generating statistics and player profiles, providing college recruitment services, validating your information, and analyzing site visits, registrations, marketplace engagement, and purchasing behavior.

B. Promoting our Services to you, which includes sending you messages about the offerings we have, such as products, programs, training resources (like clinics and lessons), events, contests, and exclusive offers. These communications and advertisements may be customized based on the preferences you select when sharing your information, your activity within the Services, and PlayerFirst registration-derived attributes, including sport, team affiliation, program registration, product purchase details, and geography. For example, if you are in the process of completing an incomplete registration form for a program or purchase, we may send you reminders to finish the form and offer to save your information to simplify the process.

C. Offering a more tailored, relevant, and customized experience for our users, including onsite personalization and limited ad retargeting for adult site visitors and app users who have opted into ad personalization signals.

D. Communicating with you via e-mail, text message (i.e., SMS, MMS), phone, push notifications, and other communication channels, to provide information about our Services and updates based on your requests, comments, suggestions, or inquiries.

E. Enabling your interaction with the Services, such as allowing you to post comments and reviews, connect with other users, and share content on social media.

F. Processing payments for Services rendered to you.

G. Identifying security incidents, safeguarding against malicious, deceptive, fraudulent, or unlawful activities, and taking legal action against those responsible.

H. Troubleshooting to find and fix issues that affect the intended functionality.

I. Taking necessary actions to protect the rights, health, and safety of our users, ourselves, and other third parties.

J. Conducting activities to ensure the safety of the Services we manage and offer.

K. Complying with applicable laws, regulations, rules, and requests from law enforcement or other government authorities.

4. How We Share Your Personal Information: We respect your privacy and will not share your Personal Information with third parties except in the following circumstances:

A. Affiliates. We may share Personal information with current and future “affiliates,”a term that includes our parent and subsidiary companies, joint venture partners, or other companies we control, are controlled by, or with which we are under common control.

B. Service Providers. We may share your Personal Information with trusted third-party service providers who assist us in operating our Services (e.g., payment processors, marketing services, analytics providers, tag management providers, customer list matching providers, IT providers, and insurance carriers). These providers must use your Personal Information only to perform services on our behalf and are prohibited from using it for any other purpose.

C. Operational Partners. From time to time, we may partner with third parties to operate certain aspects of our Services. In accordance with applicable laws, we may provide your Personal Information to these operational partners to use for their own purposes. While these operational partners may use your Personal Information to operate the Services, you should presume that these operational partners may use your Personal Information for their own purposes in accordance with their respective privacy policies. We may also disclose limited information to advertising and analytics partners to support ad measurement, offsite retargeting, registration and purchase reminders, email advertising, suppression lists, frequency capping, and onsite personalization, subject to your privacy choices and applicable law.

D. Business Partners. When you consent to receive news and offers from select business partners that are not service providers, we may share your Personal Information with business partners, such as our sponsors, retailers, and broadcast partners, so that they can provide you with special offers, promotional materials, and other materials and information that may be of interest to you. These other business partners are expected to protect the confidentiality, integrity, and security of any information we share with them. However, we are not responsible for our business partners' privacy practices.

E. Business Transfer. If the ownership of 3STEP (or any portion of our assets) changes because of a merger, acquisition, or in the unlikely event of bankruptcy, your information may be transferred to another entity. If such a transaction occurs, we will notify you in an update to this Policy or through another appropriate means.

F. User Referrals. If you refer another individual to our website or Services or use a “share this article” or any similar feature on our Services, we may collect your name, phone number, email address, and user ID, as well as the information of your referral, as provided by you or them. We may use this information for the business purposes described above.

G. Legal Compliance. We or our service providers may share your information, including the contents of your communications, with third parties when required or permitted by law. This may occur when we believe in good faith that: (i) it is required by law, such as through a court order, statute, regulation, or legal process, or for law enforcement purposes; (ii) the information is relevant to a crime that has been committed or is in progress; (iii) there is an emergency that poses a threat to your safety or the safety of others; (iv) we receive requests from law enforcement or other governmental agencies, such as a search warrant, subpoena, or court order; or (v) it is necessary to protect our legal rights, property, or to enforce our Terms of Service.

H. Aggregated Data Sets. We may share other information with third parties in a manner that does not identify users, including, for example, aggregated information.

5. Security of Personal Information:

A. We implement reasonable and appropriate physical, technical, and organizational safeguards to enhance the security of our systems and protect the confidentiality, integrity, availability, and resilience of Personal Information. These safeguards include: (i) pseudonymizing and encrypting Personal Information if deemed appropriate; (ii) ensuring that Personal Information is regularly backed up and accessible in the event of a security breach; and (iii) conducting periodic testing, assessments, and evaluations to measure the effectiveness of our security measures.

B. While we take steps to protect Personal Information, we cannot guarantee that our safeguards will be entirely effective or adequate. Additionally, please be aware that data transmission over the Internet is not always fully secure, and we cannot guarantee the security of information you transmit through the Services.

C. We recommend that you help us keep your Personal Information  safe by taking reasonable steps, such as keeping your passwords private and not disclosing sensitive Personal Information in places that can be accessed publicly.

6. Data Retention:

A. We retain Personal Information for as long as reasonably necessary to fulfill the processing activities outlined in this Policy, including:

(i) while you maintain an active account or use our services,

(ii) as required by applicable laws, regulations, and government requests, and

(iii) to protect our rights, property, safety, and legitimate business interests, as well as those of our users and third parties. 

B. Given the continuous nature of our Services, we do not maintain predetermined retention schedules for all data categories. Instead, we evaluate retention needs based on:

(i) the purpose for which the information was collected,

(ii) applicable legal requirements and statutes of limitations,

(iii) ongoing business relationships and account activity, and

(iv) legitimate business needs, including dispute resolution and fraud prevention.

7. Children’s Privacy:

A. We understand the importance of protecting children’s privacy. We only collect personal information from children with the consent of a parent or legal guardian. Moreover, any request for a minor’s Personal Information (such as registration data) is intended for and directed to the parent or legal guardian. We use best efforts not to retarget users we know to be minors under 16 or to use known minors' Personal Information for audience sharing, targeted advertising, sale, or sharing, unless we obtain any affirmative authorization required by applicable law. Because some users may browse anonymously, we use age-based signals, account information, consent signals, and other available controls to help exclude known minors from retargeting and audience sharing. If you are a parent or legal guardian, you may access, correct, or delete any Personal Information associated with your child’s account by contacting us directly at privacy@threestep.com.

B. We comply with the Children’s Online Privacy Protection Act (“COPPA”), and we do not knowingly collect personal information from children under the age of thirteen (13) without verifiable parent or legal guardian consent.

8. Your Options and Controls:

A. You have various options regarding how we manage the Personal Information we collect and receive about you which include, but are not limited to:

(i) You can opt out of receiving promotional emails from us by clicking the "unsubscribe" link at the bottom of any promotional email and adjusting your preferences. Please note, however, that you may still receive transactional or service-related emails regarding your account.

(ii) To stop receiving promotional text messages (SMS and MMS), reply "STOP" to any message, free of charge. We may send you a confirmation message letting you know the opt-out request was successful.

(iii) You can manage or opt out of push notifications by selecting which notifications you would like to receive. Alternatively, you can disable push notifications through your phone’s settings.

(iv) You can opt out of having your personal information shared with third parties for their direct marketing purposes by reaching out to 3STEP (as detailed in the “Contact Us” section below) with the subject line "Privacy."

(v) Depending on local laws, you may have the right to access, update, delete, or correct your personal information that we hold, subject to specific legal exceptions.

(vi) You may choose whether to receive targeted ads from advertising companies that collaborate with us by using our cookie preference pop-up, selecting "Necessary Only," or submitting a privacy rights request.

(vii) You have the option to opt-out of sharing your location information for specific purposes. Opting out could impact features of the Services (such as applications). You can also manage location data collection settings through your device.

B. You can exercise these rights by contacting 3STEP as outlined in the “Contact Us” section, submitting a Consumer Rights Request, using our cookie preference pop-up and selecting "Necessary Only," following instructions in communications sent to you, adjusting settings on your device (like resetting your advertising identifier or opting out of interest-based ads). A deletion request is available through our Consumer Rights Request process, but deletion and opt-out requests may operate differently depending on the right you exercise and applicable law.

C. Please note that if you choose not to provide Personal Information, we may be unable to offer the Services (including certain products, services, or experiences), and some features may not be able to reflect your preferences and interests. If you opt out of targeted advertising, sale, or sharing, you may still see advertisements, but they should be less tailored to your activity across nonaffiliated websites and services. If any Personal Information is required, we will clearly inform you at the point of collection so you can decide whether to participate. If you have any questions about the Personal Information we collect or retain, or your rights, please reach out using the details in the “Contact Us” section.

9. Your Privacy Rights:

A. Depending on where you are located, you may have certain rights regarding your Personal Information. These rights are not absolute, and in certain cases we may decline your request as permitted by law. These may include:

(i) Access: The right to request access to the Personal Information we hold about you.

(ii) Correction: The right to request corrections or updates to any inaccurate Personal Information.

(iii) Deletion: The right to request the deletion of your Personal Information, subject to certain exceptions. 

(iv) Opt-out of Marketing, Sale, Sharing, and Targeted Advertising: The right to opt out of receiving marketing communications from us at any time and, where applicable, to opt out of the sale or sharing of Personal Information, targeted advertising, profiling, and analytics-supported advertising that uses Personal Information across nonaffiliated websites or services.

B. We are required to provide the categories of Personal Information that we that we collect and/or share for the purposes described in the section “How We Use Your Personal Information” and to the third parties listed in the section “How We Share Your Personal Information.”

C. For more information on how to exercise your rights, including the list of privacy rights that may be available to you, please see sections “Your Privacy Rights” and “Your Options and Controls” in this Policy. If you would like to access, review, update, correct, delete any Personal Information we hold about you, or exercise any other privacy rights available to you, including the right to opt out from selling or sharing your Personal Information, targeted advertising, or analytics-supported advertising, please use our cookie preference pop-up, select "Necessary Only," reach out using the details in the “Contact Us” section.

D. We endeavor to respond to a privacy rights request within the required timeframes. If we need more time, we will inform you of the reason and extension period in writing. If you submit your request electronically through our request form, we will deliver our written response to the verified email associated with the request. We will deliver our written response by mail or electronically, at your option. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. 

E. Right to Appeal. Depending on the laws applicable to you, if you are not satisfied with our response to you, you may have the ability to appeal our response. If an appeal right is applicable to you, we will let you know in our response to you.

F. Categories of Personal Information. We collect and in the past twelve (12) months have collected the following categories of Personal Information for our business purposes:

(i) Personal Identifiers.

(ii) Personal information categories listed in the California Customer Records statute (Cal. Civ. Code 1798.80(e)).

(iii) Commercial information (such as transaction data).

(iv) Internet or other similar network activity.

(v) Geolocation data.

(vi) Audio, electronic, visual, or similar information.

(vii) Inferences drawn from any of the above categories of personal information.

G. Sources of Personal Information. The sources from which we collect Personal information are described in the section “Personal Information We Collect.”  

H. Purposes for Collecting Personal Information. We collect, use, disclose, sell, and sharethe Personal Information identified in the lists above for the purposes outlined in the section "How We Use Your Personal Information," including analytics, limited targeted advertising, offsite retargeting, registration and purchase reminders, email advertising, suppression, frequency capping, onsite personalization, and analytics-supported advertising.

I. California-Specific Rights. California residents may have additional rights under the California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”), and California Shine the Light. These rights include the rights listed below, including rights related to sale, sharing, cross-context behavioral advertising, and sensitive Personal Information:

(i) Right to Know: You have the right to request the categories and specific pieces of Personal Information we collect about you, the purposes for which the Personal Information is used, the categories of third parties to whom we disclose, sell, or share Personal Information, and whether we sell or share the Personal Information.

(ii) Right to Delete: You have the right to request that we delete your Personal Information, subject to certain exceptions.

(iii) Right to Opt-Out of Sale or Sharing: If applicable, you have the right to opt out of the sale or sharing of your Personal Information, including sharing for cross-context behavioral advertising, targeted advertising, or analytics-supported advertising.

(iv) Right to Limit Sensitive Personal Information and Non-Discrimination: If applicable, you have the right to limit certain uses and disclosures of sensitive Personal Information. We do not use sensitive Personal Information for advertising or analytics monetization. We will not discriminate against you for exercising any of your privacy rights.

J. California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our customers who are California residents to request and obtain from us once a year, free of charge, information about the Personal Information we disclose to third parties for direct marketing purposes in the preceding calendar year. Not all information sharing is covered by the "Shine The Light" requirements, and only information on covered sharing will be included in our response. Under California law, businesses are only required to respond to a request once during any calendar year. If you are a California resident and would like a copy of this notice, please reach out using the details in the “Contact Us” section.

K. Categories of Personal Information Sold or Shared in the Preceding twelve (12) months: 3STEP does not sell Personal Information in exchange for monetary consideration. We may disclose, make available, or share Personal Information for other benefits as defined by Cal. Civ. Code 1798.140(ad), and some of these activities may be deemed a “sale” or "sharing" under applicable law. Select third parties, such as advertising technology partners, data analytics providers, customer list matching providers, tag management providers, data activation providers, and social networks, including Meta, Google Marketing Platform, and HighTouch, may collect or receive identifiers, Internet or other electronic network activity, commercial information, geolocation data, inferences, and other Personal Information so that 3STEP can engage in limited targeted advertising, offsite retargeting, registration and purchase reminders, email advertising, suppression, frequency capping, onsite personalization, and analytics-supported advertising. You have a right to direct 3STEP not to sell or share your Personal Information. 3STEP does not knowingly sell or share the Personal Information of consumers it knows to be under sixteen (16) years of agewithout any affirmative authorization required by applicable law.

L. Recipients of Personal Information: We have disclosed in the preceding twelve (12) months Personal Information as necessary for specific “business purposes,” as defined by Cal. Civ. Code 1798.140(e) and specified in the section “How We Share Your Personal Information.” This includes sharing personal identifiers, commercial information, Internet or other electronic network activity, geolocation data, and inferences with payment processing providers, customer relationship management, consulting, e-mail, product feedback, helpdesk services, advertising networks, website analytics companies, social networks, tag management providers, data activation providers, customer list matching providers, and event sponsors.

M. Other State-Specific Rights: Eligible residents of Colorado, Connecticut, Delaware, Maryland, Massachusetts, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states with applicable privacy laws have rights with respect to the Personal Information that 3STEP collects about them. Any terms not defined in this section have the same meaning as defined under applicable laws, acts, and regulations. Subject to certain exceptions, if you are an eligible resident of one of these states, you have certain privacy rights which may include, depending on your state of residency:

(i) Right to Know/Access. You have the right to confirm whether 3STEP processes your Personal Information and accesses such Personal Information. You also have the right to obtain your Personal Information in a portable, and to the extent reasonably feasible, readily usable format that you can transmit without hindrance. In addition, eligible Oregon residents have the right to receive a list of specific third parties to which 3STEP has disclosed any Personal Information.

(ii) Right to Delete. You have the right to request that 3STEP delete the Personal Information you have provided to us or that 3STEP has otherwise obtained about you. 

(iii) Right to Correct. You have the right to request that 3STEP correct inaccuracies in your Personal Information, considering the nature of the Personal Information and the purposes of the processing of your Personal Information.

(iv) Right to Opt-Out. You have the right to opt out of the processing of your Personal Information for the purposes of (i) targeted advertising, (ii) the sale of your Personal Information, (iii) sharing or processing for analytics-supported advertising, and (iv) profiling in furtherance of decisions, including, for eligible residents of Connecticut and Montana, solely automated decisions, which produce legal or similarly significant effects.You may exercise these rights through our cookie preference pop-up by selecting "Necessary Only," or by submitting a privacy rights request.

(v) Right to Appeal. You have the right to appeal 3STEP’s decision regarding your request to exercise any rights described herein.

N. Supplemental Notice to Residents of California and Delaware: Privacy regulations in the United States, such as the laws of California and Delaware, require 3STEP to indicate whether it honors your browser’s “Do Not Track” settings concerning targeted advertising. 3STEP adheres to the standards set out in this Policy and does not monitor or respond to “Do Not Track” browser requests.

O. Supplemental Notice to Residents of Nevada: Nevada law gives Nevada consumers the right to request that a company not sell their Personal Information for monetary consideration to certain other parties. This right applies even if their Personal Information is not currently being sold. If you are a Nevada consumer and wish to exercise this right, please send an email with the subject line “Nevada Resident Do Not Sell Request” to privacy@threestep.com

P. Additional Disclosures for Colorado Residents: We may sell or use your Personal Information as described in the section “How We Use Your Personal Information” of this Privacy Policy for targeted advertising purposes. Colorado residents may opt out of targeted advertising or sale through our cookie preference pop-up, or by submitting a privacy rights request.

Q. Our Privacy Team will review verified privacy rights requests and respond to you as quickly as possible. If we are unable to comply with your request due to an exception or limitation, we will explain this in writing. If we need more time, we will inform you of the reason and extension period in writing. 

R. If you would like an authorized agent to make a privacy rights request on your behalf, the agent may do so by contacting 3STEP as detailed in the “Contact Us” section below. We will ask for written, signed permission that the agent has been authorized to act on your behalf. Once written authorization is provided, we will review your privacy rights request and respond to you as quickly as possible. We will respond directly to the e-mail address provided by the authorized agent regarding the fulfillment of the privacy rights request.

S. We remind you that you have a right to lodge a complaint with a supervisory authority should you feel unsatisfied with our treatment of your Personal Information. Depending on the laws applicable to you, if you are not satisfied with our response to you, you may have the ability to appeal our response. If an appeal right is applicable to you, we will let you know in our response to you.

10. Notice of Collection of Prospective Employee Personal Information:

A. As a prospective employee, we may collect the following categories of Personal Information about you: identifiers, demographic information (such as gender and age), state or federally issued identification information, contact information, banking or other financial information, biometric data, employment related information, educational history, and audio, electronic, visual or similar information.

B. We collect this Personal Information so that we can identify you and evaluate you as a prospective employee, operate our business and best serve you. You are entitled to all the same rights as consumers set forth above.

C. If you have any questions regarding your Personal Information as a California prospective employee, please reach out using the details in the “Contact Us” section.  

11. International Data Transfers and Use. Our Services are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Any Personal Information you provide through use of the Services may be stored and processed, transferred between, and accessed from the United States and other countries which may not guarantee the same level of protection of Personal Information as the one in which you reside. However, we will handle your Personal Information in accordance with this Policy regardless of where your Personal Information is stored or accessed.

12. Third-Party Links. Our Services may contain links to other sites that we do not own or operate. Also, links to our Services may be featured on third-party services we advertise. We will only provide your Personal Information to these third parties asdescribed in this Policy or otherwise with your consent. We provide links to third party services as a convenience to our users. These links are not intended as an endorsement of or referral to the linked services. The linked services should have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully. We do not have any control over such services, and therefore we take no responsibility and assume no liability for the manner in which the entities that operate such linked services may collect, use, disclose, secure, or otherwise treat your Personal Information.

13. Use of Artificial Intelligence (“AI”).

A. When interacting with you, we may use artificial intelligence and automated systems to enhance our customer service experience, including:

(i) Customer Service Chatbots: AI-powered chatbots assist with registration questions, account inquiries, and general support during business and non-business hours

(ii) Automated Response Systems: AI helps categorize and route customer inquiries to appropriate support staff for faster resolution

(iii) Registration Assistance: Automated systems help guide users through the registration process and identify common issues or incomplete forms

(iv) FAQ and Help Systems: AI-powered search and recommendation systems help users find relevant answers to their questions

B. When you interact with our AI customer service systems AI responses are generated based on your inquiry and our knowledge base. Your conversations  (which may include Personal Information) may be recorded and analyzed to improve service quality.

14. Updates to This Policy. We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make changes, we will update the "Effective Date" at the top of the Privacy Policy. We encourage you to review this Privacy Policy periodically.

15. Contact Us. To contact us with questions about this Policy or exercise your consumer rights, including access, correction, deletion, opt-out of sale or sharing, opt-out of targeted advertising, or limitation of sensitive Personal Information where applicable, please:

• Email us at privacy@threestep.com with the subject line "[State] Consumer Request," "Do Not Sell or Share," "Opt Out of Targeted Advertising," or the relevant right identified in the body of the email, or

• Call us at 1-888-414-0098.