1. Information We Collect and Receive

We collect and receive the following categories of information:

2. How We Use the Information We Collect and Receive

We use each of the categories of information we collect and receive for the following business purposes:

• Solicit input and feedback about our Services;
• Identify and address technical issues on our Services;
• Better understand the visitors who come to our Services and the content of interest to them; and
• Customize your experiences on our Services based on location information or your online activities, including the content you view, the products you bid on or purchase, other Services of ours you use, and other information we collect and receive.

We also may use the information we collect and receive for other purposes that may be described to you at the point of collection or for which you provide your consent.

3. How We Disclose the Information We Collect and Receive

We may disclose information that we collect and receive with third parties when we have your consent or as described below.

We disclose information with the following types of third parties:

• Our affiliates and related entities. We share information with current and future "affiliates," a term that includes our parent and subsidiary companies, joint venture partners, or other companies we control, are controlled by, with which we are under common control, or with which we share at least one common owner, for the purposes set out in this Privacy Policy. We also share information with the NHL and its affiliates.
• Our service providers. We provide information to affiliated and unaffiliated service providers and others that perform certain functions or services for us, such as to host our Services and data, fulfill orders, provide products and services, manage databases, perform analyses or advertising services (including vendors that provide enhanced data to allow us to append data and build customer profiles), administer our contests and sweepstakes, collect location data, provide location-based services, process credit card payments, provide customer service, or send communications for us.
• Business Partners. When you consent to receive news and offers from them, we share information about you with select Business Partners, such as our sponsors, retailers, and broadcast partners, so that they can provide you with special offers, promotional materials, and other materials and information that may be of interest to you. To opt out of receiving further communications directly from these Business Partners, please contact the Business Partner. Please see the Your Other Privacy Choices section for more information on the choices we provide you. We also may disclose personal information with co-brand and other partners when you choose to be involved in their programs or where you provide your information to us in order to transact with, donate to, or otherwise interact with the partner. We are not responsible for the privacy practices of our Business Partners or other third party partners, which may use your information for their own purposes.
• Advertising partners. We may also disclose information to our advertising partners for targeted advertising purposes, including through the use of cookies, web beacons, and other technologies as described further in Section 4 below.
• Other parties in response to legal process or when necessary to protect us or our Services. We or our service providers may disclose your information -- including the contents of your communications -- to other parties when required or permitted by applicable law in the jurisdictions in which we or our service providers are located, such as when we have a good faith belief that:
  • Doing so is necessary to respond to lawful governmental requests or legal process (for example, a court order, search warrant, or subpoena);
  • The information is relevant to a crime that has been or is being committed;
  • An emergency exists that poses a threat to your safety or the safety of another person or persons; or
  • Doing so is necessary to protect our rights or property or to enforce our Terms of Service.
• Other parties in connection with certain business transactions. In the event of a prospective or actual change in ownership of any of the HBSE Parties (or any portion of our assets) as a result of a merger, acquisition, or in the unlikely event of a bankruptcy, your information may be transferred to another entity. If such a transaction occurs, we will notify you in an update to this Privacy Policy or through another appropriate means.
• Interactive features. Information may also be shared with or made available to third parties when you post information to a public user profile or a public area of our Services, such as a chat room, forum, blog, or other community tool, or when you participate in public events or activities. You are responsible for any information you post to these interactive features. We cannot ensure that parties who have access to such information will respect your privacy. Please exercise caution when using these features.

While we do not sell Personal Information in exchange for any monetary consideration, we do share Personal Information for other benefits as defined by California and Connecticut law. We have shared in the preceding 12 months, Personal Information as necessary for specific business purposes above. We do not knowingly sell or share the personal information of children under the age of 16 without affirmative authorization.

We also may share other information with third parties in a manner that does not identify particular users, including, for example, aggregated or deidentified information.

If you would like to opt-out of the selling and sharing of personal information, please see Section 6 or the “Do Not Sell or Share Personal Information” link on our website.

4. Third Parties That Provide Content, Advertising, or Functionality On Our Services

Some of the content, advertising, and functionality on our Services may be provided by third parties that are not affiliated with us. Such third parties include, for example:

• Content providers, which may operate contests, sweepstakes, fantasy or interactive games, or public forums on our Services;
• Advertising providers, such as ad networks and other advertising companies, which help us and our advertisers provide ads (on our Services or elsewhere online) that may be tailored to users' interests, including targeted advertising, and to understand users' response to those ads;
• Audience-measurement companies, which help us measure the overall usage of our Services and compare that usage to other online services;
• Social networking services (such as Meta and X), which may enable you to log in to certain of our Services, to comment on content available on our Services, and to share things you find on our Services with your social network; and
• Mobile location analytics providers, which use geolocation data to facilitate the transmission of informational, marketing, and public service communications to you.

Targeted Advertising: These and other third parties may collect and receive information about your use of our Services, including through the use of cookies, web beacons, and other technologies, and this information may be collected over time and combined with information collected on different websites and online services (such as web pages you visit and your interaction with advertising and other content) across your devices, including, for example, to make predictions about your preferences and deliver targeted advertising to you, both on and off our Services. Social networking services may be able to collect information about you, even if you do not click on or interact with their content on our Services or have an account with the social networking service.

Note that some of these companies participate in industry-developed programs designed to provide consumers with choices about whether to receive targeted ads. To learn more and to opt out of such targeted advertising, please see the Your Other Privacy Choices section below.

Social Networking Services: The third-party social networking services with which we partner may notify your friends and other connections, both on our Services and on the social networking services themselves, that you are a user of our Services or about your use of our Services. If you choose to access or make use of third-party social networking services, we may receive information about you that you have made available to those social networking services depending on your settings. We may use the information pursuant to this Privacy Policy, such as to enhance your personal and social experience on our Services.

You also may be able to link an account from a social networking service to an account through our Services. This may allow you to use your credentials from such third-party service to sign in to certain features on our Services. If you link your account from a third-party site or service, we may collect information from those third-party accounts, and any information that we collect will be governed by this Privacy Policy.

5. Data Subject Rights

Depending on the jurisdiction in which you live, you may have certain rights as a data subject under local law, including:

• To request to access your personal information, including, where applicable, in a commonly-used electronic format, and to request other information about our data processing practices;
• To request to update or correct inaccuracies in your personal information;
• To request to delete certain personal information in our custody and control;
• To request to withdraw or revoke consent, such as where we are relying on consent as the legal basis to process your personal information (where that concept is recognized) or where we are processing your sensitive personal information pursuant to your consent; and
• To request to object to or restrict the processing of your personal information.

In each case, these rights are subject to certain exceptions prescribed by law. If you would like to access, delete, or correct your information or otherwise exercise your rights, please contact us as set out in the Contact Us section below. Depending on the type of request you have made, we may request further information from you to verify your request, such as your account details and, where necessary, copies of government issued identification. You may also be entitled to appeal our decisions with respect to your data rights in accordance with local laws, and may do so by following the instructions provided in the correspondence we sent to you communicating our decision. You may also be entitled to appoint an authorized agent to exercise rights on your behalf, in which case we may request further information to validate the identity of your agent or that the agent is authorized to act on your behalf.

Depending on the jurisdiction in which you live, you also may have the right to request to limit the use or disclosure of your sensitive personal information. You can exercise your right to limit by clicking on the "Your Privacy Choices" link in the footer of relevant websites and mobile applications. You may also, depending on the jurisdiction in which you live, have rights to opt out of the "sale" of your personal information, the "sharing" of your personal information (for targeted advertising), or all processing of your personal information for targeted advertising. You may also click on the "Your Privacy Choices" link to exercise these rights. Please also review the "Your Other Privacy Choices" section below for more information about how to make these advertising-related requests.

We may disclose your personal data by allowing certain third parties (such as online advertising services, social networks, and data analytics providers) to collect personal data through automated technologies on our Services for targeted advertising purposes. We also may disclose your personal data to Business Partners and other third parties for their own marketing purposes. These kinds of sharing activities may be considered “sales” under certain laws. They also may be considered sharing or processing of personal data for targeted advertising under applicable law.

We will not discriminate against you for exercising these rights, although some of the functionality and features available to you may change or no longer be available to you.

6. Your Other Privacy Choices

You have several additional choices about how we handle information we collect and receive about you.

• Email. You may opt out of receiving future promotional email communications from us by clicking the "Update Your Email Preferences" or "Unsubscribe" links in the footer of promotional email communications and updating your preferences. Please note that we may continue to send you transactional or service-related emails regarding your account. To opt-out of receiving emails from Business Partners, please contact those parties directly.
• SMS and MMS. You may opt out of receiving promotional SMS and MMS messages (i.e., text messages) from us by replying "STOP" to any message, which is free of charge. Please note that we may respond to your opt-out request with a message confirming that you have successfully opted out.
• Targeted Advertising. You have various choices related to targeted advertising.
  • You may opt out of receiving certain targeted advertising from participating companies by visiting the websites of the Network Advertising Initiative, Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.
  • Where available, and depending on the jurisdiction in which you live, you also may disable optional cookies, web beacons, and other technologies through your web browser.
  • Depending on your jurisdiction, we also will support the Global Privacy Control ("GPC"), a universal opt-out preference signal that communicates your privacy preferences to the websites you visit. For more information on the GPC, please visit their website at GlobalPrivacyControl.org.

These choices generally apply to the web browser you use, which means that you generally must opt out of each web browser on each device you use. If you opt out, you may still see ads from us, but the ads will be less relevant to you and your interests.

In addition, depending on the jurisdiction in which you live, you may have the right to opt out of the sharing of hashed or encrypted email addresses and similar personal information with third parties (such as social media platforms) for targeted advertising purposes. Please submit a request by sending an email to: privacy@prucenter.com. Please write "Privacy" in the subject line and include your first name, last name, and email address in the body of the email. Please also include the following in your email: "Opt Out of Sale/ Opt Out of Sharing for Targeted Advertising."

Do Not Track. As distinct from the choices described above, some web browsers may transmit "do not track" signals to the websites and other online services with which the browser communicates. There is no standard that governs what, if anything, websites and online services should do when they receive these signals. We currently do not take action in response to these signals. If and when a standard for responding is established, we may revisit our policy on responding to these signals.

• Disclosure of Personal Information to Business Partners.
  • Depending on the jurisdiction in which you live, you may have the right to request to opt out of the "sale" or "sharing" of your personal information in accordance with state laws. Please submit a request by sending an email to: privacy@prucenter.com. Please write "Privacy" in the subject line and include your first name, last name, and email address in the body of the email. Please also include the following in your email: "Opt Out of Sale/ Opt Out of Sharing for Targeted Advertising." If you are a California or Connecticut resident, please see the appropriate section below regarding your rights.
  • You can opt out of (or, where you have provided consent, withdraw your consent to) the future sharing of your personal information with Business Partners for those parties' own promotional purposes by sending an email to privacy@prucenter.com. Please write "Privacy" in the subject line and include your first name, last name, and email address in the body of the email. Please also include the following in your email: "Opt Out of Business Partner Sharing" or "Opt Out of Member Club Sharing." Please note that even if you exercise these choices, we may still share your information with Business Partners where we are permitted to do so such as when they use that information to perform services we request and at your direction or pursuant to your interactions with them.
• Location Information. If you use location-enabled services or applications covered by this Privacy Policy, you may opt out of having your location information collected and/or used for certain purposes. However, if you exercise such an opt-out option you may not be able to enjoy all of the functionalities offered by those services or applications. You also may be able to limit the collection of your location information through the settings on your device.

7. Security & Retention

We have adopted physical, technical, and administrative safeguards to help protect against theft, loss, misuse, and unauthorized access to or disclosure of the information we collect and receive. However, please note that no data transmission or storage can be guaranteed to be 100% secure. As a result, while we strive to protect your information and privacy, we cannot and do not guarantee or warrant the security of any information you disclose or transmit to our Services and cannot be responsible for the theft, destruction, or inadvertent disclosure of your information, or any other disclosures out of our control.

Your online access to some of your information may be protected with a password that you select. We strongly recommend that you select a unique password that is difficult to guess and that you do not disclose your password to anyone. We will never ask you for your password in any unsolicited communication (such as letters, phone calls, or email messages).

We retain personal information for only as long as we need it to provide the Services, for purposes described in this Privacy Policy, after which we take steps to delete or anonymize information. Among the criteria used to determine our retention periods include the length of your relationship with us, any retention periods that are mandated by law, and whether retention is required pursuant to litigation or regulatory investigations.

8. Children's Privacy

Our Services are not directed at children under the age of 16, and we do not knowingly collect, use, or disclose personal information from children under the age of 13 or as otherwise defined by local law without prior parental consent, except as permitted by the Children's Online Privacy Protection Act ("COPPA") or other applicable local law. For certain activities in which children are allowed to participate (for example, youth clinics, camps, kids clubs and community outreach events), any request for personal data (such as registration data) is intended for and directed to the parent or legal guardian. If you have reason to believe that a child under the age of 13 has provided personal data to us without parental consent, please contact us using any of the methods described in the “Contact Us” section to request that we delete the personal data.

9. Third Party Links

Our Services may contain links to other sites that we do not own or operate. Also, links to our Services may be featured on third party services on which we advertise. We provide links to third-party services as a convenience to our users. These links are not intended as an endorsement of or referral to the linked services. The linked services should have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully. We do not have any control over such services, and therefore we take no responsibility and assume no liability for the manner in which the entities that operate such linked services may collect, use, disclose, secure, or otherwise treat your information.

10. Additional California Disclosures

This section provides certain disclosures intended to address California law requirements. The disclosures in this section should be read to supplement the above sections with disclosures designed to conform to specific California law requirements.

This Privacy Policy provides information about the categories of personal information that we have collected and disclosed or otherwise made accessible to third parties during the preceding 12 months. This information includes, for example:

Identifiers, such as your name, address, phone number, zip code, IP address, and online identifiers. We may use this information to respond to your questions, to enable you to participate in our programs (including sweepstakes or contests), to process your registration with our Services, and for other business purposes.

Commercial information, such as a record of your purchases, transfers, receipts and services you have obtained. We may use this information to improve your experience with our Services, to serve you ads about products and offers, and for other business purposes.

Internet and electronic network activity information, such as information about your interactions with our Services. We may use this information to improve our Services, to better understand the visitors who come to our Services and the content of interest to them, and for other business purposes.

Geolocation data. We may use this information to improve the quality, security, and relevance of our Services and for other business purposes.

Inferences about you, including about your preferences and characteristics. We may use this information to provide our Services to you in an individual and personalized way and to send you marketing we believe may interest you, and for other business purposes.

Sensitive Personal Information. We may use this information to improve the quality, security, and relevance of our services and for other business purposes. Please note, in the limited circumstances we process sensitive personal information, we do not use or disclose it other than for disclosed and permitted business purposes.

11. Additional California Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) may provide you with the right to:

• 1. Know About Your Personal Information, including:
  • categories and/or specific pieces of Personal Data we have collected about you,
  • categories of sources for that personal information,
  • Purposes for which we use that information,
  • Categories of third parties with whom we disclose the information to,
  • Categories of information we sell or disclose to third parties.
• 2. Delete Your Personal Information
  • You may request we delete personal information that we have collected from you, subject to exemptions.
• 3. Correct Your Personal Information
  • You may ask us to correct certain personal data we hold about you.
• 4. Opt-Out of the Selling or Sharing of Personal Information
  • You may ask us to stop selling or sharing your personal information.
• 5. Non-Discrimination
  • We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please submit a request by either emailing privacy@prucenter.comor by calling (833) 757-6335. For email requests, please write “Privacy” in the subject line and include in the body of the email your first and last name, email address, mailing address, and nature of the request. We will respond to your request within forty-five (45) days. However, in certain circumstances, we may require additional time to process your request, as permitted by the CCPA. We will advise you within forty-five (45) days after receiving your request if an extension is necessary and why it is needed. If we cannot fulfill your request, our response to you will explain the reason why we cannot fulfill your request. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf.

Please see the Your Other Privacy Choices section for information on how to request to opt out of the sale/sharing of personal information. We do not knowingly sell or share the personal information of children under the age of 16 without affirmative authorization.

In addition to those rights outlined in the Your Other Privacy Choices section, California residents may also opt out of having their personally identifiable information shared with third parties for those third parties' direct marketing purposes by contacting us as set out in the Contact Us section below.

In addition, California residents who are registered users of the Services and are under the age of 18 are entitled, in accordance with California law, to request and obtain removal of content and information that they themselves post as user content on the Services. You may request such removal by sending an email to: privacy@prucenter.com. Please write "Privacy" in the subject line and include in the body of the email (i) a statement that you are requesting, in accordance with California law, the removal of user content; (ii) a description of the material you want removed and information reasonably sufficient to permit us to locate the material; and (iii) your first name, last name, email address, mailing address (including city, state, and zip) and year of birth so that we can process your request. Please note that your request does not ensure the complete or comprehensive removal of the material.

How We Verify Your Identity and Requests

To process your request, we must be able to verify your identity or authority to make the request and confirm the personal information relates to you. Submitting your request through the authorized mechanisms allows us to verify your identity as required by the CCPA. As such, we cannot accept requests through other channels. We cannot process your request if you do not provide us with sufficient detail to respond to the request. We reserve the right to confirm your California residency. If we are not able to successfully identify your residency, we will inform you of the fact.

12. Additional Connecticut Rights

If you are a Connecticut resident, the Connecticut Data Privacy Act (CTDPA) may provide you with the right to:

• Access your data;
  • You may have the right to confirm whether we process your personal data and to access your personal data.
• Correct inaccuracies in your data;
  • You may have the right to correct inaccuracies in your data.
• Request copies of your data;
  • You may have the right to obtain a copy of personal data, that you previously provided to us, in a portable and usable format.
• Delete personal data; and
  • You may have the right to delete personal data provided to us by you.
• Opt-out of the sale or processing of your personal data for targeted advertising or profiling purposes.
  • You may have the right to opt-out of the sale or processing of your personal data.
• Appeal
  • If we decline to take action regarding your request, you have the right to appeal. We will notify you providing our reasons and instructions for how you can appeal.

To exercise your CTDPA rights, please submit a request by sending an email to: privacy@prucenter.com. Please write "Privacy" in the subject line and include your first name, last name, email address, mailing address, and nature of the request in the body of the email. If you would like to exercise your right to Opt-out of the sale and processing of your personal data, please see “Your Other Privacy Choices.” We will respond to your request within forty-five (45) days. However, in certain circumstances, we may require additional time to process your request, as permitted by the CTDPA. We will advise you within forty-five (45) days after receiving your request if an extension is necessary and why it is needed. If we cannot fulfill your request, our response to you will explain the reason why we cannot fulfill your request.

13. Further Information for visitors outside of the United States, including European Economic Area ("EEA"), United Kingdom, and China Residents

International Transfers of Personal Information

Our headquarters are in the United States, and, regardless of where you use our Services or otherwise provide information to us, your information may be transferred to, maintained, and processed by the HBSE Parties and their affiliates, operational partners and service providers in the United States or other locations outside of your jurisdiction of residence. Please note that U.S. privacy laws, regulations, and standards may not be equivalent to the laws in your country of residence and such information may be subject to lawful access by U.S. courts, law enforcement, and governmental authorities. Please be aware that information we obtain as a result of your use of the Services may be collected, transferred, stored, and processed in the United States or another country in accordance with applicable law.

Legal Basis for Processing for EEA and UK Residents

To the extent our activities are subject to international data protection laws that specify limited legal grounds to process your information, the legal bases for our processing activities are to perform our contract(s) with you; to meet our legal obligations; and for our legitimate business purposes, including to improve our operations and Services, detect and prevent fraud, and enforce our Terms of Service. We rely on your consent to send you direct marketing messages about our products, services and promotions and to deliver targeted advertisements to you, both on and off the Services. If you do not provide certain information to us, we may, in some circumstances, be unable to comply with our obligations or provide you with the services that you request. We will tell you about the implications of not providing certain information.

EEA/UK Privacy Rights

In accordance with the GDPR, EEA/UK data subjects have the following rights:

• If the processing of personal data is based on your consent, the right to withdraw consent for future processing of that data
• The right to request access to and rectification of your personal data
• Subject to limitations as provided for in the GDPR, the right to request restriction of the processing of your personal data
• Subject to limitations as provided for in the GDPR, the right to request erasure of your personal data
• The right to receive, in a structured, commonly used and machine-readable format, the personal data you have provided to us based on your consent or a contract, and have such information transmitted to another company, where technically feasible (Data Portability)
• If you are not satisfied with our response, you also have the right to lodge a complaint about the processing of your personal data with a local data protection authority

Please see the Your Other Privacy Choices section for more information on how to withdraw your consent at any time and your data protection rights. In addition, you may lodge a complaint with the relevant supervisory authority if you consider that our processing of your personal information infringes applicable law. Contact details for all EEA Supervisory Authorities can be found on the European Data Protection Board website at edpb.europa.eu. You may exercise these rights by contacting us as provided in the Contact Us section below.

Where required by applicable law, we will request your consent to use cookies, send you promotional messages and deliver advertisements about products, tickets, services, programs, or events, or disclose your data to our partners and other third parties for these purposes. For more information about our use of cookies, please see our Cookie Policy.

For children located in jurisdictions within the EEA or UK, we comply with the age limits applicable in each Member State. In these instances, the references in our Privacy Policy to the age of 13 will be deemed to be references to the age limits applicable in each Member State. Where this Privacy Policy refers to consent in relation to processing the personal data of any person under the age limits applicable in each Member State, such processing will require the consent of that person’s parent or legal guardian.

We may transfer your personal data from the EEA or UK to other jurisdictions as described in the Data Transfers section of our Privacy Policy. Our practice when transferring personal data is to put in place appropriate safeguards as required by applicable law, such as relying on Standard Contract Clauses (Article 46 of the EU General Data Protection Regulation, the “GDPR”) or, in exceptional cases, individual consent (Article 49 of the GDPR). Subject to applicable law, you may obtain a copy of these safeguards by contacting us as described below.

Information for China Residents

In order to achieve the purposes described in the “How We Use the Information We Collect and Receive” section of this Privacy Policy, we may transfer your personal information to our database or headquarters and affiliates or other third parties outside of China.

If your personal information is transferred to such parties, we will use lawful cross-border transfer mechanisms to transfer your personal information and adopt necessary measures to ensure that such overseas recipients can provide the same level of protection as required under applicable Chinese laws.

14. Changes To This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our privacy practices, so we encourage you to review this Privacy Policy periodically. The “Effective Date” listed at the top of this Policy indicates when it was last revised. If we make significant changes to this Privacy Policy, we will provide appropriate notice to you.

15. Contact Us

If you have any questions about this Privacy Policy or the manner in which we or our service providers treat personal information, please contact us at privacy@prucenter.com and write "Privacy" in the subject line or write to us at:

Privacy Officer
Prudential Center
25 Lafayette Street
Newark, NJ 07102