1. Introduction

NPTournaments Pty Ltd (ABN: 71 678 124 822) (we, us, our) owns and operates the LADER technology platform (LADER or the Platform). LADER is a cloud-based sports administration and tournament management platform that enables sports clubs, associations, and other organisations to manage members, events, bookings, payments, communications, and competition data.

This Privacy Policy (Policy) explains how we collect, hold, use, and disclose personal information in connection with the LADER Platform and any related websites, mobile applications, APIs, and services operated by NPTournaments Pty Ltd.

We are committed to handling personal information responsibly and in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we operate in other jurisdictions, we comply with applicable local privacy obligations as set out in this Policy and in Schedule B.

By creating an account, accessing, or using the LADER Platform, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Platform.

2. Who This Policy Applies To

This Policy applies to all individuals whose personal information is handled by NPTournaments Pty Ltd in connection with LADER, including:

• Club Administrators — individuals who create and manage a club or organisation account on LADER, including staff, volunteers, and contractors accessing the Platform on behalf of a club.

• Individual Users — players, participants, and members who are registered on LADER, either directly or through a club account.

• Officials and Referees — individuals whose details are recorded or scheduled through the Platform in connection with competitions or events.

• Visitors — individuals who visit LADER-operated websites or landing pages without creating an account.

Where a Club Administrator has created accounts or entered data on behalf of other individuals, that Club Administrator is responsible for ensuring they have appropriate authority and consent to provide that personal information to LADER and for notifying those individuals about this Policy.

3. What Information We Collect

We collect different categories of personal information depending on how you interact with LADER.

3.1 Account and Identity Information

When an account is created on LADER — whether by a Club Administrator or an individual — we collect:

• Full name

• Email address

• Username and password (stored in encrypted form)

• Contact phone number

• Role within the club or organisation (e.g. administrator, coach, player)

• Profile photo (optional)

3.2 Organisation and Club Information

When a club or organisation registers on LADER, we collect information about that entity, including:

• Club or organisation name and logo

• Business address and contact details

• Registered contacts and authorised users

• Membership structures, rosters, and team configurations

• Subscription tier and billing contact details

3.3 Participant and Player Data

Clubs and administrators may enter or import data about their members and participants, which can include:

• Player name, date of birth, and gender

• Contact details (email, phone, address)

• Membership category and status

• Emergency contact details

• Medical or health information where provided voluntarily (e.g. relevant conditions affecting participation)

• Ranking, grading, skill level, and match or competition history

• Results, statistics, and performance records

We note that some of this information — particularly health information — is sensitive information under the Privacy Act. We handle sensitive information with additional care and only use it for the purpose for which it was provided.

3.4 Event and Tournament Data

In connection with events and tournaments managed through LADER, we collect:

• Registration details (entrant name, category, draw entry)

• Match results and draw progressions

• Court schedules and venue allocations

• Referee and official assignments

• Scoring and competition history

3.5 Payment and Transaction Information

LADER facilitates payment processing for membership fees, event registrations, and other club charges. All payment transactions are processed through Stripe, a third-party payment service provider. We do not collect, store, or have access to your full credit card number, CVV, or bank account details.

We do receive and retain limited transaction records, including:

• Transaction reference numbers and amounts

• Payment status (completed, pending, failed, refunded)

• Billing name and country

• The last four digits of the card used (provided by Stripe for display purposes only)

Stripe handles all sensitive payment card data directly and operates under its own privacy policy and PCI-DSS compliance programme. We encourage you to review Stripe's privacy policy at stripe.com/privacy.

3.6 Technical and Usage Information

When you access or use the LADER Platform, we automatically collect certain technical information, including:

• IP address and approximate location (country/region level)

• Browser type, version, and operating system

• Device type and identifiers

• Pages accessed, features used, and time spent on the Platform

• Session logs and error reports

• Referring URLs

This information is used to maintain Platform security, diagnose technical issues, and improve the user experience. We do not currently use third-party advertising or behavioural tracking tools on the LADER Platform.

3.7 Communications

If you contact us directly, we retain records of that communication, including:

• The content of emails, support requests, and in-platform messages

• Attachments and supporting information provided

• Correspondence and resolution history

4. How We Collect Information

We collect personal information in the following ways:

• Directly from you: when you register an account, complete a profile, submit a form, register for an event, or contact us.

• From your organisation: when a Club Administrator imports, enters, or configures data about members, players, or participants on your behalf.

• Automatically: through your use of the Platform, including server logs, session data, and technical diagnostics.

• From third parties: such as payment processors (Stripe) who confirm transaction outcomes, or sports bodies that provide licensing or accreditation data relevant to your registration.

Where it is reasonably practicable to do so, we collect personal information directly from the individual concerned. Where we collect information from a third party (such as a Club Administrator providing player data), we take reasonable steps to ensure that collection is lawful and appropriate.

5. How We Use Your Information

We use personal information only for the purposes for which it was collected and for related purposes that would be reasonably expected, including:

5.1 Providing and Operating the LADER Platform

• Creating and managing accounts, clubs, and memberships

• Processing event registrations, draws, and competition scheduling

• Facilitating payment processing and issuing receipts

• Displaying match results, draws, rankings, and statistics

• Enabling communication features between clubs and their members

• Assigning officials and referees to scheduled events

5.2 Platform Improvement and Development

• Diagnosing and resolving technical issues

• Analysing usage patterns to improve Platform features and performance

• Developing new features and functionality based on how the Platform is used

• Conducting internal research and analytics (using aggregated or de-identified data where possible)

5.3 Communications and Support

• Responding to enquiries, support requests, and complaints

• Sending transactional notifications (e.g. registration confirmations, payment receipts, event reminders)

• Sending account and Platform updates, including security alerts

• Sending product updates, feature announcements, and service communications (you may opt out of non-essential communications at any time)

5.4 Legal and Compliance Obligations

• Complying with applicable laws, regulations, and court orders

• Preventing, detecting, and investigating fraud, security incidents, and Platform misuse

• Enforcing our Terms of Service and other agreements

• Maintaining records for tax, audit, and financial reporting purposes

We do not sell, rent, or trade personal information to third parties for marketing or commercial purposes.

6. Disclosure of Information

We may disclose personal information to the following categories of recipients:

6.1 Club Administrators

Where an individual's data has been entered or managed through a club account, the Club Administrator who manages that account can access, view, and update that individual's profile and activity data within the Platform. Club Administrators are responsible for ensuring they use that access appropriately and in compliance with applicable privacy laws.

6.2 Service Providers

We engage third-party service providers who assist us in delivering and operating the LADER Platform. These providers act on our instructions and are not authorised to use personal information for their own purposes. Current categories of service providers include:

• Cloud hosting and infrastructure providers (for data storage and Platform operation)

• Payment processors (Stripe, for transaction processing)

• Email delivery services (for transactional and system notifications)

• Cybersecurity and monitoring services (for Platform security)

• Software development and support contractors

6.3 Other Platform Users

Certain information — such as names, rankings, match results, and competition draw positions — may be visible to other Platform users in the context of events or competitions. By registering for a competition or event through LADER, you consent to this form of disclosure. Clubs control the visibility settings for their own member data within the Platform.

6.4 Sports Bodies and Governing Organisations

Where required for competition sanctioning, accreditation, or regulatory compliance, we may disclose relevant participant data (such as name, grade, and results) to the governing sporting body associated with an event.

6.5 Legal Disclosures

We may disclose personal information where required by law, court order, or government direction, or where we reasonably believe disclosure is necessary to:

• Comply with a legal obligation

• Protect and defend our legal rights or property

• Prevent or investigate fraud, security threats, or Platform misuse

• Protect the safety of individuals or the public

6.6 Business Transfers

If NPTournaments Pty Ltd undergoes a merger, acquisition, restructure, or sale of assets, personal information held by us may be transferred to the acquiring entity as part of that transaction. We will provide reasonable notice of any such transfer and the acquiring entity will be required to handle personal information in accordance with this Policy or an equivalent standard.

7. International Data Transfers

LADER operates internationally and serves users in Australia, the United States, Canada, and the Asia-Pacific region. Personal information may be stored and processed in countries other than your country of residence, including in Australia and in the countries where our cloud infrastructure providers operate.

Before transferring personal information overseas, we take reasonable steps to ensure that the recipient is subject to a law, binding scheme, or contractual obligation that provides substantially similar privacy protections to those applicable under Australian law.

If you are located outside Australia, you acknowledge that your information may be transferred to and processed in Australia. International users also have rights under their applicable local laws — these are described in Schedule B of this Policy.

Our cloud infrastructure is hosted by providers operating data centres in multiple regions. We select hosting regions appropriate to the location of users where practicable and contractually require our cloud providers to maintain appropriate security standards.

8. Data Security

We implement and maintain reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss, and destruction. These measures include:

• Encryption of data in transit (TLS) and at rest

• Role-based access controls limiting which personnel and systems can access personal information

• Secure password hashing and credential management

• Regular vulnerability assessments and security patching

• Data segregation between club accounts to prevent cross-account access

• Audit logging of access to sensitive data and administrative functions

No security system is completely impenetrable. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and, where required, the relevant regulatory authority, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and equivalent obligations in other applicable jurisdictions.

You are responsible for maintaining the confidentiality of your own login credentials. If you believe your account has been compromised, please contact us immediately.

9. Data Retention

We retain personal information for as long as it is needed to fulfil the purposes described in this Policy, or as required by applicable law.

• Active account data: retained for the duration of your account or subscription.

• Transaction and payment records: retained for a minimum of 7 years in accordance with tax and financial record-keeping obligations.

• Competition and event records: retained indefinitely as part of the historical record of a club's or association's activity, unless the relevant club requests deletion.

• Technical and usage logs: retained for up to 12 months before deletion or aggregation.

• Closed or deleted accounts: core account data is deleted or anonymised within 90 days of account closure, subject to legal retention obligations.

Where a club or organisation terminates its LADER subscription, we provide a data export facility prior to account closure. Following the export window, account data is deleted in accordance with our standard retention schedule.

10. Children and Young People

Sports clubs and associations using LADER regularly include junior participants — individuals under the age of 18 — in their programs, competitions, and events. We recognise the particular importance of protecting children's personal information.

LADER does not permit individuals under 18 to create their own accounts directly. Where a junior participant's data is added to the Platform, this must be done by a Club Administrator or by a parent or guardian acting on the junior's behalf. The Club Administrator or parent/guardian is responsible for ensuring they are authorised to provide that information.

We handle the personal information of junior participants with additional care. We limit the collection of information about minors to what is reasonably necessary for the sporting or administrative purpose at hand. Health and sensitive information about minors is used strictly for the purposes for which it was provided.

We comply with applicable child safety and privacy laws in all jurisdictions where we operate. Parents or guardians who wish to review, update, or request deletion of a junior participant's information should contact us using the details in Section 14.

11. Your Privacy Rights

Subject to applicable law, you have the following rights in relation to your personal information:

To exercise any of these rights, please contact us using the details in Section 14. We will respond within 30 days of receiving a valid request. In some cases, we may be unable to provide access or comply with a request — for example, where disclosure would unreasonably affect the privacy of another individual, or where a legal obligation requires us to retain the information. We will explain the reason for any refusal.

If you are located outside Australia, please also refer to Schedule B for information about rights specific to your jurisdiction.

If you believe we have not handled your personal information in accordance with applicable privacy law, you have the right to make a complaint to the relevant privacy authority. In Australia, this is the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Contact details for privacy authorities in other jurisdictions are included in Schedule B.

12. Cookies and Tracking Technologies

The LADER Platform uses cookies and similar tracking technologies to operate core Platform functions and to maintain session state. We currently use the following categories of cookies:

• Strictly necessary cookies: required for the Platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without affecting Platform functionality.

• Functional cookies: used to remember your preferences, language settings, and logged-in state.

• Performance and analytics cookies: used to collect aggregated information about how users interact with the Platform, to help us improve the service. We do not use third-party advertising or behavioural tracking cookies.

You can manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may affect your ability to use the Platform.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, our operations, or the services we provide. The effective date at the top of this Policy indicates when the current version was last updated.

Where we make material changes to this Policy, we will notify registered users via email and/or a prominent notice on the LADER Platform before the changes take effect. Your continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the updated terms.

We encourage you to review this Policy periodically to stay informed about how we handle your personal information.

14. Contact Us

If you have any questions, concerns, or requests relating to this Policy or to the handling of your personal information, please contact us:

We will acknowledge your request within 5 business days and aim to resolve your enquiry or complaint within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Schedule A — Summary of Data Collected and Purposes

The following table summarises the key categories of personal information collected through LADER and the primary purpose(s) for which each is used.

Schedule B — International User Rights

This Schedule applies to users located outside Australia. It sets out additional rights and disclosures that apply under local privacy laws in the jurisdictions where LADER currently operates.

B.1 United States (California)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the purposes for collection, and the categories of third parties with whom it is shared.

• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g. legal obligations, security).

• Right to Correct: You may request correction of inaccurate personal information we hold about you.

• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information with third parties for cross-context behavioural advertising.

• Right to Limit Use of Sensitive Personal Information: Where we process sensitive personal information, we use it only for the purposes for which it was collected.

• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us using the details in Section 14. You may also designate an authorised agent to make a request on your behalf, in which case we may require verification of the agent's authority.

California residents may also direct complaints to the California Privacy Protection Agency at cppa.ca.gov.

B.2 Canada

If you are located in Canada, your personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Under Canadian law, you have the right to access personal information we hold about you and to request correction of inaccurate information. You may withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions, by contacting us using the details in Section 14.

We collect, use, and disclose personal information only with your knowledge and consent, and only for purposes that a reasonable person would consider appropriate in the circumstances. If you have concerns about our privacy practices, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

B.3 Asia-Pacific (excluding Australia)

If you are located in the Asia-Pacific region outside Australia, we comply with the applicable privacy laws of your jurisdiction to the extent that those laws apply to our processing activities. These may include:

• New Zealand: The Privacy Act 2020 (NZ) grants New Zealand residents rights of access to and correction of personal information held about them. Complaints may be directed to the New Zealand Privacy Commissioner at privacy.org.nz.

• Singapore: The Personal Data Protection Act 2012 (PDPA) applies to personal data collected, used, or disclosed in Singapore. You have rights of access and correction, and we comply with PDPA obligations including the notifiable data breach requirements. Complaints may be directed to the Personal Data Protection Commission at pdpc.gov.sg.

• Other jurisdictions: Where other APAC-region laws apply to our processing activities, we take reasonable steps to comply with applicable obligations. Contact us if you have specific questions about how we handle your personal information under local law.

Regardless of your location, our foundational approach to privacy — described in this Policy — applies to all users of the LADER Platform.