Privacy Policy

Effective Date: July 2, 2026

INTRODUCTION

Troon Golf, LLC, and its brands, affiliates and subsidiaries (“Troon,” “we,” “our,” or “us”), respects the privacy of your information. This Privacy Policy is designed to assist you in understanding how we collect, use, safeguard and disclose the information you provide to us in using our website, Troon.com, and the websites that link to this Privacy Policy (each, a “Site”), the services provided through our Site, such as loyalty programs, and the mobile applications (each, an “App”) we offer that reference this Privacy Policy (the Apps, together with such services, the “Services”). For example, the Sites include, without limitation, troon.com, caddiemaster.com, cliffdrysdale.com, pbitennis.com, rfhsd.com, casaverdegolf.com, and golfwithaccess.com. This Privacy Policy also applies to golf courses managed by Troon whose website links to this Privacy Policy.

If you reside in the State of California, please click here to learn more about your privacy rights. To the extent that there is a conflict between this Privacy Policy and the Notice to California Residents below, the Notice to California Residents will prevail with respect to California Residents (as defined below) only.

If you reside in the Commonwealth of Virginia or the States of Colorado, Utah, Connecticut, Texas, Oregon, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, or Maryland, please click here to learn more about your privacy rights. To the extent that there is a conflict between this Privacy Policy and the Privacy Notice for Covered Residents, the Privacy Notice for Covered Residents will prevail with respect to Covered Consumers (as defined below) only.

If you reside in the European Economic Area, United Kingdom or Switzerland, please click here to learn more about your privacy rights. To the extent that there is a conflict between this Privacy Policy and the Notice for European Residents section below, the Notice for European Residents will prevail with respect to residents of the European Economic Area, United Kingdom or Switzerland only.

This Privacy Policy applies to information Troon collects through the Sites and Services, as well as other information provided to us online or offline by third parties, when we associate that information with customers or users of the Sites and Services; however, it does not apply to information collected from our employees or job applicants, contractors, or vendors. It also does not apply to information that you ask us to share with third parties or is collected by Online Tool Providers or Payment Processors (as further described below). You acknowledge and agree that Troon is not responsible for the data collection or use practices of any other user of the Sites or Services.

This Privacy Policy describes, among other things:

• Personal and other information we collect about you;

• How we use your information;

• How we may share your information with third parties; and

• Your choices regarding the personal information we collect about you.

CONSENT

By accessing or using the Sites or Services, you consent to this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Services. Information gathered through the Sites and Services may be transferred, used, and stored in the United States or in other countries where our service providers or we are located. If you use the Sites or Services, you agree to the transfer, use, and storage of your Personal Information (as defined below) in those countries. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. You agree that all transactions relating to the Sites or Services or Troon are deemed to occur in the United States, where our servers are located.

COLLECTING AND USING INFORMATION

Personal Information We Collect Online

Through your use of the Sites and Services, we may collect Personal Information from you. By “Personal Information” we mean information that can identify or reasonably be linked to an individual. For example, we collect the following types of Personal Information:

Personal Information You Provide

We may collect the following Personal Information that you voluntarily provide to us:

• Book Tee Times. When you book a tee time on our Site, you will provide your first and last name, email address, and telephone number, and may be asked to provide your mobile phone number, work phone number, postal address, gender, date of birth, home club membership number, and any additional Personal Information that you choose to provide. You may be required to login with a username and password. You may also be required to provide a credit or debit card number or other payment data. We use third-party Payment Processors to process your purchase. We also maintain this information and a record of your purchase.

• Contact Us. When you submit a web form on our Sites to contact us or request more information from us, you will provide your first and last name and email address, and may provide us with additional Personal Information such as your postal address, telephone number, mobile phone number, home club membership number, Troon Rewards card number, and Access account number.

• Newsletter. When you complete a newsletter request form on a Site, (available on select Sites), you will provide your email address and may provide us with additional Personal Information such as your first and last name, telephone number, address and more.

• Troon Rewards. When you register for our “Troon Rewards” program, you will provide your first and last name, email address, zip code, and country. To login to Troon Rewards, you will provide your email address, password, and rewards number.

• Access. When you register for our “Access” program, including Access Premium and Access Premium Plus, you will provide your first and last name, email address, home address, mobile number, credit card information, and any additional Personal Information that you choose to provide. To login to Access, you will provide your email address, password, and account number. We use third-party Payment Processors to process your purchase. We also maintain this information and a record of your purchase.

• Marketing Emails. When you sign up to receive marketing messages from us and our preferred partners, you will provide your first and last name, email address, and zip code and may be requested to provide your country and home club.

• Troon Mobile App. When you create an account on the Troon App, you are also creating a Troon Rewards profile which include the same collection of information as stated with Troon Rewards bullet above. Additionally, we may collect your credit card information if you choose to pay through the Troon App.

• Course Mobile App. When you create an account with our Course-specific Apps, (available on select Sites), you will provide your first and last name, email address and possibly other Personal Information.

• Access Mobile App. When you create an account on the Access App, you are also creating an Access profile which include the same collection of information as stated with Access bullet above. Additionally, we may collect your credit card information if you choose to pay through the Access App.

• Text Club. When you sign up for text club (available on select Sites) you will provide your mobile phone number.

• Subscribe to eMagazine. When you subscribe to our free Troon or Troon Privé e-magazine, or Cliff Drysdale Tennis’ Experience Magazine, you will provide your first and last name, state, country, and email address.

• Purchase Gift Cards. We use third-party Payment Processors to process your purchase of Troon gift cards. We do not collect this payment information.

• Online Store. When you purchase gift cards, merchandise, prepaid rounds, and other various items on our “Course Site” stores (available on select Sites), you will provide your first and last name, email address, address, telephone number, and credit and debit card number or other payment data. We use Online Tool Providers to operate certain online stores and Payment Processors to process your purchases.

• Troon Junior Club Registration. If you are under the age of 18, when a parent or legal guardian registers you for our “Troon Junior Club”, your parent or legal guardian will provide your first and last name, email address, telephone number, and postal address, and will provide certain information about the junior golfer, such as name, gender, and date of birth. See the Children’s Privacy section below for more information, including rules for children under the age of 13.

• Surveys. When you provide feedback through email or on our Sites (available on select Sites), at times you will provide your first and last name, email address, telephone number, and possibly other Personal Information.

• Tournament Registration. When you register on our Sites for one of our tournaments, for example, the “Troon Cup” or “Troon Challenge,” you will provide your first and last name, email address, and telephone number and may provide a credit or debit card number or other payment data.

• Online Lessons. When you register on our Sites for a golf lesson (available on select Sites), you will provide your first and last name, email address, telephone number, possibly address and may provide a credit or debit card number or other payment data. We use third-party Payment Processors to process your purchase. We also maintain this information and a record of your purchase.

• Owner Account Login. If you are an owner of properties that we manage, or to which we provide services, when you login to your account, you will provide your email address and password.

• Buzz (Live Chat or Chat Bots). When you use the live chat feature (available on select Sites), we will collect any Personal Information that you choose to provide.

• Comment on Blog Posts. When you leave a comment on any of our blogs, you will provide your first and last name, email address, and any content in the comment.

• Additional Information. When you submit information through our Sites, send an email from our Sites, respond to a survey or communication, interact with us through social media channels (such as our Facebook or Instagram accounts), or participate in another function or feature of our Sites, you may provide us with other Personal Information.

Personal Information We Collect as You Navigate Our Site

We automatically collect certain Personal Information through your use of the Sites and Services, such as the following:

• Usage Information. We collect information such as which of the pages on the Sites you access, the frequency of access, and what you click on while on the Sites.

• Device Information. We collect information about the device you are using, such as hardware model, operating system, application version number, and browser.

• Mobile Device Information. In addition to the device information listed above, when you access our Sites via a browser on your mobile device, we collect and aggregate information about whether you are accessing the Sites via a mobile device or tablet, device type, and carrier.

• Mobile App Information. We collect certain data when you download and use an App, such as App usage data, the date and time the App on your device accesses our servers and what data and files have been downloaded to the App based on your device number.

• Location Information. We collect location information from visitors to the Sites on a city-regional basis. We may also collect more specific location information from users of the Troon App, such as to check in at a specific course.

Third-Party Information

In some cases, we may receive certain Personal Information from you about a third party. For example, as part of booking a tee time or registering for a tournament, you may provide the name of other golfers in your party. If you submit any Personal Information about another individual to us, you are responsible for making sure that you have the authority to do so and to allow us to use their Personal Information in accordance with this Privacy Policy.

Non-Personal Information

We also collect or receive non-Personal Information relating to the Sites and Services, that is, information that does not personally identify an individual (“Non-Personal Information”). The Non-Personal Information we collect includes unique identifiers that are not connected and cannot reasonably be connected with your identity as well as anonymized and/or aggregated Personal Information.

We will not use Non-Personal Information to try to identify you, and if we associate any Non-Personal Information with information that personally identifies you, then we will treat it as Personal Information.

Information collected by the Sites and Services may be collected by us or one of our Service Providers (as defined in the How We Share Your Personal Information section below), Online Tool Providers or Payment Processors.

How We Use Your Personal Information

We use the Personal Information we collect to provide the Services and Sites to you, to improve our Services and Site, and to protect our legal rights. In addition, we may use the Personal Information we collect to:

• Process your account registration;

• Process transactions and fulfil orders;

• Process accumulation and use of Access points and redemptions;

• Offer and manage your participation in our loyalty programs, such as Troon Rewards and Access, including Access Premium and Access Premium Plus.

• Populate Troon Rewards and Access with a digital membership card for use with your Apple Wallet or Google Wallet

• Customize your experience according to your personal preferences;

• Process tee times and reservations and provide you with information about the property you are visiting;

• Contact you regarding our products and services that we feel may be of interest to you;

• Allow you to participate in sweepstakes, contests, and other promotions and to administer these activities;

• Communicate with you, such as to provide you with information about our Sites, Services, loyalty programs or our other products or services, to inform you of any changes to our Sites or Services, or in connection with a transaction or your account;

• Provide support and customer service;

• Maintain, manage, improve and protect our Sites and Services;

• Perform research and analysis aimed at improving our products and services and developing new products or services;

• Defend our legal rights and the rights of others;

• Efficiently operate and maintain our business; and

• Comply with applicable law.

Who We Share Your Personal Information With

We disclose Personal Information as described below: We may disclose Personal Information to provide the Sites and Services, or when you authorize or instruct us to do so, such as when you ask us to link your Troon account to an online store account.

We may share Personal Information with the owners or managers of properties that we manage or to which we provide services for their own business purposes.

We may also disclose Personal Information to certain third parties that sell goods and services under our Troon brand, such as Troon Golf Vacations so you can purchase Troon-themed vacations. We may further disclose Personal Information to marketing partners who market products and services on their behalf or on behalf of their business partners.

Additionally, we may disclose Personal Information to third parties that allow you to enroll in their services or participate in their promotions (for example, certain companies allow you to use your loyalty program number or account login to receive or register for their services). These companies include resorts, as well as sponsors of sweepstakes and contests. If you do not want us to share your Personal Information in this way, do not provide your loyalty program number to third parties, do not use your account login to register for third-party promotions and do not connect your account with accounts on third-party services. Personal Information shared in this way will be governed by the third party’s privacy policy and not this Privacy Policy.

We share information with Service Providers. By “Service Providers” we mean companies, agents, contractors, service providers, or others engaged to perform functions on our behalf. When we use a Service Provider, we require that the Service Provider use and disclose the Personal Information and Non-Personal Information received from us only to provide their services to us or as required by applicable law.

We may also disclose Personal Information and Non-Personal Information to Online Tool Providers. By “Online Tool Provider” we mean a licensor of software that we include in, or use with, the Services, including an API or SDK, that provides a specialized function or service to us and that requires the transmission of Personal Information and/or Non-Personal Information to the Online Tool Provider. Online Tool Providers may have the right to use Personal Information and Non-Personal Information about you for their own business purposes. Use and disclosure of Personal Information and Non-Personal Information by an Online Tool Provider is described in its privacy policy. For example, we use EZLinks, Google Analytics and G1 software to book tee times are certain courses. You can learn more about G1 software here. You can learn more about Google Analytics in the Google Analytics section below.

Additionally, we may disclose Personal Information and Non-Personal Information to our Payment Processors. A “Payment Processor” is a third party payment gateway provider or provider of other payment services. Payment Processors may be regulated as financial services companies and/or subject the rules of the payment card networks. Therefore, Personal Information and Non-Personal Information received by a Payment Processor may be used for its own purposes, including compliance with legal and audit obligations. You can learn more by reviewing their privacy policies: Shopify and Stripe.

We may also disclose Personal Information to third parties when we believe, in good faith and in our sole discretion, that such disclosure is reasonably necessary to (a) enforce or apply the terms and conditions of the Services, including investigation of potential violations thereof, (b) comply with legal or regulatory requirements or an enforceable governmental request, (c) protect the rights, property or safety of us, our users or other third parties, (d) prevent a crime or protect national security, or (e) detect, prevent or otherwise address fraud, security or technical issues.

We reserve the right to transfer information (including your Personal Information) to a third party in the event of a sale, merger, or transfer of all or substantially all of the assets of our company relating to the Services, or in the unlikely event of a bankruptcy, liquidation, or receivership of our business. We will use commercially reasonable efforts to notify you of such transfer, for example via email or by posting notice on our website.

Lastly, we may also disclose Non-Personal Information, aggregated with information about our other users, to our clients, business partners, merchants, advertisers, investors, potential buyers and other third parties if we deem such disclosure, in our sole discretion, to have sound business reasons or justifications.

COOKIES AND OTHER TRACKING TECHNOLOGIES

Every time you use the Sites or Services (e.g., access a Service webpage or navigate to a specific location within an App), we collect Personal Information and Non-Personal Information (as discussed above) regarding that use. For example, to improve our Sites or Services, we collect how, when, and which parts of the Sites or Services or its features you use. Also, we may use your device’s unique identifier (UDID) or other unique identifiers to assist us in collecting and analyzing this data.

To assist us in collecting and storing this Non-Personal Information, we may employ a variety of technologies, including “Cookies,” local browser storage, and “web beacons,” “pixels,” or “tags.” A “Cookie” is a small amount of data a website operator, or a third party whose content is embedded in that website, may store in your web browser and that the website operator or, as applicable, the third party, can access when you visit the website. A web beacon, pixel or tag (each a, “Tag”) is a small, usually-transparent image or script placed on a web page that allows the operator of that image or script, which may be the operator of the website you visit or a third party, to read or write a Cookie.

Your operating system and web browser may allow you to erase information stored in Cookies and local browser storage. But if you do so, you may be forced to login to the Sites or Services again and you may lose some preferences or settings. You may also be able to set your browser to refuse all website storage or to indicate when it is permitted, but some features of our Sites or Services may not function properly without it. We may use Cookies to keep you logged in, save your preferences for the Sites or Serviced, and to collect information about how you use our Sites or Services.

We use Cookies and/or Tags to:

• Estimate audience size and usage patterns;

• Understand and save your preferences for future visits, allowing us to customize the Sites and Services to your individual needs;

• Advertise our content and services that relate to your interests;

• Keep track of our advertisements and search engine results;

• Compile aggregate data about traffic to the Sites, and Sites or Services interactions to resolve issues and offer better user experiences and tools in the future; and

• Recognize when you return to the Sites.

We set some Cookies ourselves and others are set by Service Providers. We use Cookies set by Service Providers to provide us with useful information to help us improve our Sites and Services, to conduct advertising, and to analyze the effectiveness of advertising.

Cookies can be blocked by changing your Internet browser settings to refuse all or some Cookies. If you choose to block all Cookies (including essential Cookies) you may not be able to access all or parts of the Site.

You can find out more about Cookies and how to manage them by visiting www.AboutCookies.org.

You can understand which third parties have currently enabled Cookies for your browser or mobile device and how to opt-out of some of those Cookies by accessing the Network Advertising Initiative’s website or the Digital Advertising Alliance’s website. For more information on mobile specific opt-out choices, visit the Network Advertising Initiative’s Mobile Choices website.

GOOGLE ANALYTICS

We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses Cookies or other tracking technologies to help us analyze how users interact with the Sites and Services, compile reports on their activity, and provide other services related to their activity and usage. The technologies used by Google may collect Personal Information and Non-Personal Information, such as your IP address, time of visit, whether you are a returning visitor, and any referring website. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt-out of tracking of analytics by Google, click here.

"DO NOT TRACK" SIGNALS

We honor the Global Privacy Control (“GPC”), which is a browser extension that automatically indicates a consumer’s opt-out preferences. Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, the Sites do not currently interpret, respond to or alter their practices when they receive “Do Not Track” signals.

CHOICES ABOUT YOUR PERSONAL INFORMATION

Review and Request Changes to Your Personal Information

You may use your account to access, correct, or view certain Personal Information we have collected and which is associated with your account on the Sites or Services. However, we (and you) are not able to control information that you have already shared with other users or made available to third parties through the Sites or Services.

To review or request changes to any of your Personal Information, please contact us at privacy@troon.com or in accordance with the “Contacting Us” section below. We will try to locate and provide you with your Personal Information and give you the opportunity to correct this data, if it is inaccurate, or to delete it, at your request. But, in either case, we may need to retain it for legal reasons or for legitimate business purposes. Removal of your posted content may not ensure complete or comprehensive removal from our computer systems.

We ask individual users to identify themselves and the information requested to be accessed, corrected, or removed before processing such requests, and we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others, would be extremely impractical (for instance, requests concerning information residing on backups), or relate to information that is not associated with your Personal Information. In any case, where we provide information access and correction, we perform this service free of charge, except if doing so would require a disproportionate effort.

Please be aware thatif you ask us to delete your Personal Information, you may not be able to continue to use the Sites or Services. Also, even if you request that we delete your Personal Information, we may need to retain certain information for a limited period of time to satisfy our legal, audit and/or dispute resolution requirements.

Marketing Communications

To unsubscribe from emails from us, please login to your account and edit your marketing preferences, click the unsubscribe link or manage preference link included in the footer of our emails. You also may submit a request to us at privacy@troon.com or by calling 1-888-TROON US. We will try to comply with your request as soon as reasonably practicable. If you unsubscribe from our marketing emails, we may still send you important administrative messages from which you cannot opt-out.

SECURITY

We maintain commercially reasonable security measures to protect the Personal Information we collect and store from loss, misuse, destruction, or unauthorized access. For example, we utilize Secure Socket Layer (SSL), Transport Layer Security (TLS), or similar encryption technology when sensitive data is transmitted over the Internet, and we use firewalls to help prevent external access into our network. However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us in accordance with the “Contacting Us” section below.

We restrict access to Personal Information in our possession to our employees, Service Providers, and Online Tool Providers who need to know that information in order to operate, develop, improve or support our Services. If we share Personal Information with Service Providers or Online Tool Providers, we require that they also use reasonable information security measures to safeguard your Personal Information.

THIRD-PARTY LINKS

The Sites and Services may contain links that will let you leave the Sites and Services and access another website. Some linked websites are not under our control. This Privacy Policy applies solely to Personal Information that is received by Troon, such as through the Sites and Services. We accept no responsibility or liability for third party websites.

CHILDREN'S PRIVACY

The Sites and Services are not intended for children under 18 years of age. We do not knowingly collect, use, or disclose personal information from children under 18 without parental consent. If you are the parent or guardian and have learned or suspect that your child under the age of 18 has provided us with Personal Information without your consent, please contact as set forth in the Contact Us section below and provide us with the name and email address that was used and we will promptly delete such information.

NOTICE TO NEVADA RESIDENTS

Nevada law allows Nevada residents to opt-out of the sale of certain types of personal information. Subject to a number of exceptions, Nevada law defines “sale” to mean the exchange of certain types of personal information for monetary consideration to a person for the person to license or sell the information to additional persons. We do not currently sell personal information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt-out of sales and we will record your instructions and incorporate them in the future if our policy changes. Opt-out requests may be sent to privacy@troon.com.

NOTICE TO RESIDENTS OF CANADA

If you have an objection to the use of your Personal Information as described in this Privacy Policy, you may file a complaint by sending an email to privacy@troon.com. We will attempt to accommodate your objection or complaint, but you understand that, to the extent you object to our processing of Personal Information that is necessary for us to provide the Sites or Services to you, certain features and functionalities of the Services may no longer be available to you. Nothing in this Privacy Policy prejudices your rights to file a complaint with the Office of the Privacy Commissioner of Canada, and/or with any other applicable data protection authorities.

ACCESSIBILITY

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you wish to access this Privacy Policy in an alternative format, please contact us as described below.

Changes to this Policy

We may modify or update this Privacy Policy periodically with or without prior notice by posting the updated policy on this page. You can always check the “Effective Date” at the top of this document to see when the Privacy Policy was last changed. If we make any material changes to this Privacy Policy, we will notify you by reasonable means, which may be by e-mail or posting a notice of the changes on Sites and Services to the changes becoming effective. We encourage you to check this Privacy Policy from time to time. If you do not agree to changes to this Privacy Policy, you must stop using the services after the Effective Date of such changes (which is the Effective Date shown above).

HOW TO CONTACT US

If you have questions or concerns about our privacy policies or practices, please contact us at:

Troon Golf, LLC
15044 North Scottsdale Road
Suite 300
Scottsdale, Arizona 85254
Phone: 480.606.1000
Fax: 480.606.1010
Email: privacy@troon.com

Notice To California Residents

The California Consumer Privacy Act/California Privacy Rights Act (CCPA) requires that we provide California residents with a privacy notice that contains a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of California residents regarding their personal information.

The CCPA defines “personal information” to mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. For purposes of this “Notice to California Residents” section “Personal Information” means personal information covered by the CCPA.

Right to Know About Personal Information Collected, Disclosed, or Sold

Your “Right to Know”

If you are a California resident, you have the right to request that we disclose what Personal Information we have collected about you in the 12-month period preceding your request. This Right to Know includes the right to request any or all of the following:

Specific pieces of Personal Information that we have collected about you;

Categories of Personal Information we have collected about you;

Categories of sources from which the Personal Information was collected;

Categories of Personal Information that we sold (if applicable) or disclosed for a business purpose about you;

Categories of third parties to whom the Personal Information was sold (if applicable), shared (if applicable), or disclosed for a business purpose; and

The business or commercial purpose for collecting or, if applicable, selling Personal Information.

The CCPA defines “sell” to mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a California resident’s Personal Information to another business or a third party for monetary or other valuable consideration.

The CCPA defines “share” to mean sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. CCPA defines “cross-context behavioral advertising” to mean the targeting of advertising to a consumer based on that consumer’s Personal Information obtained from activity across businesses or distinctly-branded websites, applications, or services, other than the business or distinctly-branded website, application, or service with which the consumer intentionally interacts. (In other words, if we send you an ad based solely on your interaction with us or our Site and Services, this is not cross-context behavioral advertising.)

How to Submit a Right to Know Request

You may submit a request to know through our website, by emailing us at privacy@troon.com or by calling us at 1-866-778-624.

Our Process for Verifying a Right to Know Request

We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. Our verification process may differ depending on whether you maintain a password-protected account with us.

We will verify your identity as follows:

Right to Know Categories of Personal Information: We will verify your identity to a “reasonable degree of certainty” by verifying at least two pieces of Personal Information that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

Right to Know Specific Pieces of Personal Information: We will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual, or the authorized representative of the individual, whose Personal Information is being requested.

Response Timing

We will respond to a verifiable consumer request to know within forty‑five (45) days of receipt. Where reasonably necessary, we may take an additional forty‑five (45) days to respond, for a total of ninety (90) days, provided that we notify you of the extension within the initial 45‑day period and explain the reason for the extension.

Collection and Disclosure of Personal Information

The following table presents the categories of Personal Information that we have collected, the categories of sources from which that information was collected, and the categories of third parties with whom we shared that Personal Information for the 12 months preceding the Effective Date of this Privacy Policy.

The CCPA defines “business purposes” to mean use of Personal Information for the business’ operational purposes, specifically:

(1) Auditing related to a current interaction with the consumer and concurrent transaction, including, but not limited to, counting ad impressions to unique visitors;

(2) Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;

(3) Debugging to identify and repair errors that impair existing intended functionality;

(4) Short-term, transient use, provided that the Personal Information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;

(5) Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services;

(6) Undertaking internal research for technological development and demonstration; and

(7) Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device.

The CCPA defines “commercial purposes” to mean “to advance a person’s commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.”

For purposes of the below chart, we will refer to the business purposes by their above numbers and use the number (8) to reference the definition of commercial purposes.

We disclose Personal Information, as further specified in the chart below, with the following categories of third parties:

“Marketing Partners” means our business partners, including those we partner with to market products and services, partners whose services you choose to use, or partners whose promotions or loyalty programs you choose to participate in.

“Online Tool Providers” means third parties who offer a specialized service in connection with Personal Information.

“Others” means law enforcement, third parties we are required by law to disclose Personal Information to, or other third parties to whom we otherwise disclose Personal Information to protect the legal rights, property, or safety of Troon or others.

“Service Providers” means third parties that assist us with providing our products and services, including IT, storage, business operations, and marketing services.

“Social Networks” means social networks where Troon maintains an account.

“Troon Affiliates” means other entities controlling, controlled by, or under common control with Troon.

“Troon-Branded Partners” means third parties authorized to offer goods or services under the Troon name.

“Troon-Managed Properties” means third party owners or managers of applicable properties.

CATEGORIES

Additionally, in the past twelve (12) months, we have collected the following categories of Sensitive Personal Information from California residents:

Sharing or Sale of Personal Information

The following is a list of categories of Personal Information that we have sold and/or shared to third parties in the 12 months preceding the Effective Date of this Privacy Policy:

We do not knowingly sell the Personal Information of minors under 16 years of age.

Right to Request Deletion of Personal Information

Your Right

If you are a California resident, you have the right to request that we delete the Personal Information about you that we have collected or maintain. However, a business is not required to comply with a request to delete if it is necessary for the business to maintain the Personal Information in order to, for example, complete a transaction, detect security incidents, comply with a legal obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.

How to Submit a Request to Delete

You may submit a request to delete by submitting a request here, by emailing us at privacy@troon.com or by calling us at 1- 866-778-6245.

Our Process for Verifying a Request

We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. Our verification process may differ depending on whether you maintain a password-protected account with us.

We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized deletion.

We will verify your identity to a “reasonable degree of certainty” by verifying at least two pieces of Personal Information that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

We will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

Response Timing

We will respond to a verifiable request to delete personal information within forty‑five (45) days of receipt. Where reasonably necessary, we may extend this period by an additional forty‑five (45) days, provided that we notify you within the initial 45‑day period of the extension and the reason for it.

Right to Request Correction of Personal Information

Your Right

If you are a California resident, you have the right to request that we correct the Personal Information about you that we maintain. We will correct any inaccurate Personal Information pursuant to your request to the extent possible using commercially reasonable efforts. We may deny your correction request if the Personal Information is accurate. We may also delete your Personal Information instead of correcting it to the extent such deletion would not negatively impact you.

How to Submit a Request to Delete

You may submit a request to delete by submitting a request here, by emailing us at privacy@troon.com or by calling us at 1- 866-778-6245.

Our Process for Verifying a Request

We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. Our verification process may differ depending on whether you maintain a password-protected account with us.

We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized correction or deletion.

We will verify your identity to a “reasonable degree of certainty” by verifying at least two pieces of Personal Information that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

We will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

Response Timing

We will respond to a verifiable request to correct inaccurate personal information within forty‑five (45) days of receipt. Where reasonably necessary, we may extend this period by an additional forty‑five (45) days, provided that we notify you within the initial 45‑day period and explain the reason for the delay.

Right to Opt-Out of Sale or Sharing of Personal Information

Your Right

If you are a California resident, you have the right to direct a business that sells or shares your Personal Information to stop selling or sharing your Personal Information and to refrain from doing so in the future.

We sell and share Personal Information as such terms are defined under the CCPA.

How to Submit a Request to Opt-Out

To opt out of the Sale or Sharing of your Personal Information, click on “Cookie Settings” or “Do Not Sell or Share My Personal Information” in the footer, select “Do Not Sell or Share My Personal Information”, and click the “Save My Preferences” button. You may submit a request to opt-out of sales or sharing of Personal Information by clicking on this link and filling out a form: “Do Not Sell or Share My Personal Information.” You also may submit a request by emailing us at privacy@troon.com or by calling us at 1-866-778-6245.

How We Process a Request to Opt-Out

We will act upon your request to opt-out of sales or sharing of Personal Information within 15 business days from the date that you submit the request. The CCPA does not require that we verify the identity of individuals who submit requests to opt-out of sales or sharing. However, we may deny the request if we have a good-faith, reasonable, and documented belief that the request is fraudulent. If we deny the request on this basis, we will notify the requesting party and provide an explanation why we believe the request is fraudulent.

Right to Limit the Use of Sensitive Personal Information

Your Right

If you are a California resident, you have the right to direct a business that collects your sensitive Personal Information to limit the use and disclosure of your sensitive personal information. If you submit such a request, we may continue to use or disclose your sensitive Personal Information to:

• Complete the transaction for which we collected your Personal Information, provide goods or services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

• Use in a short-term and transient manner, including, but not limited to, to facilitate non-personalized advertising shown as part of your current interaction with the Services, but not including disclosure to third parties or use outside your current interaction with the Services;

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us; or

• Make any other uses of that information that are permitted by the CCPA and its implementing regulations.

How to Submit a Request to Limit the Use of Sensitive Personal Information

You may submit a request to limit the use of your sensitive personal information by clicking on this link and filling out a form: “Limit the Use of my Sensitive Personal Information.” You also may submit a request by emailing us at privacy@troon.com or by calling us at 1-866-778-6245.

How We Process a Request to Limit the Use of Sensitive Personal Information

We will act upon your request to limit the use of your sensitive Personal Information within 15 business days from the date that you submit the request. The CCPA does not require that we verify the identity of individuals who submit requests to limit the use of their sensitive Personal Information. However, we may deny the request if we have a good-faith, reasonable, and documented belief that the request is fraudulent. If we deny the request on this basis, we will notify the requesting party and provide an explanation why we believe the request is fraudulent.

Right to Non-Discrimination for the Exercise of a California Resident’s Privacy Rights

We will not discriminate against California residents if they exercise any of the rights provided in the CCPA as described in this “Notice to California Residents” section. As such, we will not deny goods or services to that California resident; charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to the California resident; or suggest that the California resident will receive a different price or rate for goods or services or a different level or quality of goods or services. However, in limited circumstances, such as if you continue to participate in our loyalty programs after exercising certain rights under the CCPA, we are permitted to charge a California resident a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by the individual’s Personal Information.

Notice of Financial Incentive

We offer certain programs, benefits, or other offerings (such as loyalty or rewards programs) that may constitute a financial incentive under California law and are related to the collection, retention, or use of personal information.

Material Terms. The material terms of the financial incentive include the ability for participating members to receive benefits such as rewards, discounts, promotional offers, or other program-related benefits. Participation is optional, and consumers may enroll or withdraw from the program at any time as described below.

Value of Personal Information. The value of a consumer’s personal information to us is reasonably related to the value of the benefits provided to the consumer under the program. We have estimated the value of personal information in good faith based on factors such as the expenses related to the offering, provision, or imposition of the benefit; the revenue generated by the program; and the value of the data derived from consumer engagement with the program.

How the Value Is Calculated. We calculate the value of personal information by using a reasonable and good‑faith method that considers, among other things, the expected revenue generated from the use of personal information collected through the program and the costs associated with providing program benefits.

How to Opt In or Withdraw. California residents may opt in to a financial incentive by enrolling in the applicable program. You may withdraw from the financial incentive at any time by discontinuing participation in the program or by contacting us using the methods described in the “Contact Information” section of this Notice.

Retention of Personal Information

We retain each category of your Personal Information for no longer than is reasonably necessary for one or more Business Purposes, subject to your right to request we delete your Personal Information. Due to the nature of the services, it is not possible to predict the length of time that we intend to retain your Personal Information. Instead, we use the following criteria to determine whether it remains reasonably necessary to retain your Personal Information for one or more disclosed Business Purpose(s):

• There is a retention period required by statute or regulation;

• The pendency of any actual or threatened litigation for which we are required to preserve the information;

• The pendency of applicable statutes of limitations for potential legal claims; and/or

• The generally accepted best practices in our industry.

When we determine that it is no longer reasonably necessary to retain your Personal Information for one or more disclosed Business Purpose(s) based on the above criteria, we will delete your Personal Information.

Automated Decision-Making and Profiling

We do not use your personal information, including sensitive personal information, to engage in profiling or automated decision-making that produces legal or similarly significant effects concerning you, such as decisions related to access to essential goods or services.

Authorized Agents

California residents may use an authorized agent to submit a request to know, delete, or opt-out of sales on your behalf.

If you use an authorized agent to submit a Right to Know or request to delete, we may require that (1) the authorized agent provide proof of your written permission, (2) you verify your identity directly with us, and (3) you directly confirm with us that you provided the authorized agent permission to submit the request. These requirements do not apply if you have provided the authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4465.

If you use an authorized agent to submit a request to opt-out of sales, you will need to provide that authorized agent with written and signed permission.

Shine the Light Law

If you are a California resident, California Civil Code § 1798.83 permits you to request, once per calendar year, information regarding the disclosure of your personal information by us to third parties for the third-parties’ direct marketing purposes (as those terms are defined in that statute). To make such a request, please send an email to privacy@troon.com or notify us in accordance with the “Contacting Us” section below.

Privacy Notice for Covered Consumers

This Privacy Notice for Covered Residents (the “Notice”) supplements the information contained in our Privacy Policy and applies only if you reside in the Commonwealth of Virginia or the States of Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Utah (collectively, the “Covered States”) (a resident of any Covered States, a “Covered Consumer”). The Notice applies equally to Covered Consumers unless noted otherwise.

For purposes of this Notice “Sell,” “Selling,” “Sale,” or “Sold,” means the exchange of Personal Information for monetary or other valuable consideration by Troon to a third party. “Sell,” “Selling,” “Sale,” or “Sold,” does not include the following:

• Disclosure of Personal Information to a third party that processes data on behalf of Troon;

• Disclosure of Personal Information to a third party for purposes of providing a product or service requested by you;

• Disclosure or transfer of Personal Information to an affiliate of Troon;

• Disclosure or transfer of Personal Information to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of Troon’s assets; and

• Disclosure of Personal Information that is intentionally made available by you to the general public via a channel of mass media without restricting the Personal Information to a specific audience.

“Sensitive Personal Information” means any of the following: (1) Personal Information revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status; (2) genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; (3) Personal Information from a person known to be under 13 years of age.; (4) precise geolocation data, (5) if you are a Covered Consumer from Connecticut or Oregon your status as the victim of a crime; or (6) if you are a Delaware, Oregon, New Jersey, or Maryland Covered Consumer, status as transgender or nonbinary. If you are a Colorado Covered Consumer, the definition also includes any inferences made by us based on your personal data that are used to indicate your racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status. If you are a New Jersey Covered Consumer, Sensitive Personal Information also includes financial information, which includes your account numbers, account log-in, financial accounts, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to those accounts.

“Verifiable Request” means the identifying information provided by a consumer in connection with a request matches the Personal Information of the consumer already maintained by us. Identifying information includes at least two pieces of Personal Information that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

“Targeted Advertising” means displaying to a consumer an advertisement that is selected based on Personal Information obtained or inferred over time from the consumer’s activities across nonaffiliated websites, applications, or online services to predict consumer preferences or interests. “Targeted Advertising” does not include the following:

• Advertising to a consumer in response to a consumer request;

• Advertisements based on activities within our own websites or online applications;

• Advertisements based on the context of a consumer’s current search query, visit to a website, or online application; or

• Processing Personal Information solely for measuring or reporting advertising performance, reach, or frequency.

“Profiling” means any form of automated processing of Personal Information to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

“Relevant Data Privacy Law” means the specific data privacy law of the state of which a consumer is a resident: the Virginia Consumer Data Protection Act (“VCDPA”) for a Covered Consumer from Virginia, the Colorado Privacy Act (“CPA”) for a Covered Consumer from Colorado, the Utah Consumer Privacy Act (UCPA) for a Covered Consumer from Utah, the Connecticut Data Privacy Act (CTDPA) for a Covered Consumer from Connecticut, the Iowa Consumer Data Protection Act (IACDPA) for a Covered Consumer from Iowa, the Texas Data Privacy and Security Act (TDPSA) for a Covered Consumer from Texas, the Oregon Consumer Privacy Act (OCPA) for a Covered Consumer from Oregon, the Delaware Personal Privacy Act (DPDPA) for the a Covered Consumer from Delaware, the Nebraska Data Privacy Act (NEDPA) for a Covered Consumer from Nebraska, the New Hampshire Data Privacy Act (NHDPA) for a Covered Consumer from New Hampshire, the New Jersey Data Privacy Act (NJDPA) for a Covered Consumer from New Jersey, and the Maryland Online Data Privacy Act (MODPA) for a Covered Consumer from Maryland.

1. Information We Collect or Process

Troon has collected or processed the following categories of Personal Information from Covered Consumers:

• Names;

• Personal or business addresses;

• Email addresses;

• Phone numbers;

• Date of Birth;

• Gender;

• Home club membership number;

• Troon Rewards card number;

• Access account number;

• Precise geolocation data;

• Credit card information (which you submit for payment purposes and which is collected by our Payment Processors); and;

• Information contained in any image, photograph or profile you submit to us.

• Troon obtains this Personal Information from the following types of sources:

• Directly from you. For example, from forms you complete or products and services that you purchase.

• Indirectly from you. For example, from information automatically sent by your web browser or from analyzing data about your actions on our website.

• Business partners and affiliated companies.

• Consumer data resellers.

The above-listed categories of Personal Information collected from Covered Consumers may include Sensitive Personal Information. By accessing or using the Site or Services, you consent to the collection and processing of Sensitive Personal Information in the categories listed above. If you do not consent to the collection and processing of Sensitive Personal Information within these categories, please do not access or use the Site or Services. If you are a Covered Consumer who is a Maryland resident, we will only use your Sensitive Personal Information as is strictly necessary to provide or maintain the specific product or service you requested.

2. Use of Personal Information

Troon may use, Sell, or disclose the Personal Information we collect for one or more of the following “Business Purpose(s):”

• Fulfill or meet the reason you provided the information

• Provide our website, online services, or mobile app

• Set up, maintain, and protect accounts to use the Site or Services;

• Improve our online operations;

• Process transactions;

• Provide customer service;

• Communicate with you, such as provide you with account- or transaction-related communications, or other newsletters, RSS feeds, and/or other communications relating to the Site or Services;

• Send or display offers and other content that is customized to your interests or preferences;

• Targeted Advertising;

• Prevent fraud and other misuse;

• Perform research and analysis aimed at improving our products and services and developing new products or services;

• Manage and maintain the systems that provide the Site or Services;

• Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

• Respond to your requests under the Relevant Data Privacy Law;

• For any other purpose described to you when we collect your Personal Information; and

• For any other acceptable purposes as set forth in the Relevant Data Privacy Law.

Unless we notify you otherwise, we will not collect additional categories of Personal Information, nor use the Personal Information we collect or collect for any purpose that is not reasonably necessary to nor compatible with the purposes disclosed in this Privacy Policy.

3. Disclosures of Personal Information

Troon has disclosed your Personal Information as described in this Notice, including the following categories of Personal Information:

• Names;

• Personal or business addresses;

• Email addresses;

• Phone numbers;

• Date of Birth;

• Gender;

• Home club membership number;

• Troon Rewards card number;

• Access account number;

• Precise geolocation data; and;

• Information contained in any image, photograph, communication, or profile you submit to us.

Troon discloses Personal Information to third parties for a Business Purpose that is reasonably necessary or compatible with the purposes disclosed in this Privacy Policy. When we disclose Personal Information for a Business Purpose, we enter into an agreement with the receiving party that describes the purpose for sharing the Personal Information, and that requires the receiving party to keep that Personal Information confidential.

We may disclose your Personal Information with the following categories of third parties: Service Providers, marketing partners, social networks, Troon branded-partners, Troon-managed properties, and data aggregators.

In the past twelve (12) months, Troon has not processed Personal Information about its Covered Consumers for Profiling.

We Sell Personal Information, subject to your right to opt-out of those Sales. Please note that we do not knowingly Sell Personal Information of Covered Consumers who are under the age of 16, or the Personal Information of Covered Consumers who are Maryland residents under the age of 18.

We also process Personal Information for Targeted Advertising, subject to your right to opt-out of such processing. Please note that we do not process Personal Information of Covered Consumers who are Maryland residents under the age of 18 for Targeted Advertising

4. Your Rights and Choices

If you are a Covered Consumer, you may request information about our collection and processing of your Personal Information, whether or not it was collected electronically. If you submit a Verifiable Request, we will disclose whether we have collected or processed your Personal Information and allow you to access the Personal Information we have collected, to the extent we continue to retain the Personal Information. To the extent technically feasible, we will disclose this information to you in a readily usable format that allows you to transmit the data to another entity without hindrance. In the case of individuals located in Colorado, Connecticut, Utah, Oregon, New Hampshire, New Jersey, Delaware, or Maryland, in the event that you make more than (1) request in any twelve (12) month period, we reserve the right to charge a fee prior to processing any such request(s). In the case of individuals located in Virginia, Iowa, Nebraska, or Texas, in the event that you make more than (2) requests in any twelve (12) month period, we reserve the right to charge a fee prior to processing any such request(s).

You also have the right to request that we delete any of your Personal Information that we collect or maintain by submitting a Verifiable Request. We may deny your deletion request if retaining your Personal Information is necessary for us or our Service Providers to:

• Complete the transaction for which we collected your Personal Information, provide goods or services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;

• Prevent or detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or investigate, report, or prosecute those responsible for such activity;

• Debug products to identify and repair errors that impair existing intended functionality;

• Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the achievement of such research, if you previously provided informed consent;

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

• Cooperate with law enforcement agencies concerning conduct or activities that we reasonably and in good faith believe may violate the law;

• Comply with a legal obligation; or

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

If you are a Covered Consumer, you further have the right to request that we correct any of your Personal Information that is inaccurate by submitting a Verifiable Request. We will correct any inaccurate Personal Information pursuant to your request, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information. We may deny your correction request if the Personal Information is accurate.

If you choose to exercise a privacy right under the Relevant Data Privacy Law, you have the right not to receive unlawful discriminatory treatment.

You may submit a Verifiable Request for the information listed above, or exercise any of your rights enumerated under this Notice, by calling us at 1- 866-778-6245, or by completing a form on our website, or by email to privacy@troon.com. You may also submit a Verifiable Request on behalf of your minor child who is under 13 years of age.

After we receive your Verifiable Request, we will provide to you, in writing, the requested information. You can choose to have this information delivered to you by postal mail or electronically. We will try to respond to your verified request within forty-five (45) days of receipt, but if we require more time (up to another forty-five (45) days) we will inform you of the reason and extension period in writing. If we decline to act on your request for any reason permitted under the Relevant Data Privacy Law, we will notify you of our decision within forty-five (45) day of receiving your request. If applicable, our response will explain the reasons why we cannot comply with your request.

If we deny your request or fail to act on it within the required time period, unless you are a Covered Consumer from Utah, you may have the right to appeal this decision by submitting a new Verifiable Request in which you conspicuously note that you are appealing a previous decision. If you are a Virginia, Connecticut, Texas, Delaware, Iowa, Nebraska, New Hampshire, or Maryland Covered Consumer, we will respond to your Verifiable Request to appeal within sixty (60) days of receipt. If you are an Oregon or New Jersey Covered Consumer, we will respond to your Verifiable Request to appeal within forty-five (45) days. If you are a Colorado Covered Consumer, we will try to respond to your verified request to appeal within forty-five (45) days of receipt, but if we require more time (up to another sixty (60) days) we will inform you of the reason and extension period in writing. If applicable, our response will explain the reasons why we are denying your appeal, and any further steps that may be available to you.

You have the right, at any time, to direct us to stop processing your Personal Information for Targeted Advertising and/or Sale to third parties. You may opt out by clicking on “Cookie Settings” or “Do Not Sell or Share My Personal Information” in the footer, selecting “Do Not Sell or Share My Personal Information”, and clicking the “Save My Preferences” button. However, if you change your mind, you may opt-in to the processing of your Personal Information for Targeted Advertising, Profiling, and/or Sale to third parties at any time by emailing us at privacy@troon.com. Consumers who opt-in to processing of their Personal Information for Targeted Advertising and/or Sale to third parties may opt-out at any time. If you are a New Hampshire between 13 and 16 years of age, or a New Jersey resident between 13 and 17 years of age, we will not process your Personal Information for Targeted Advertising and/or Sale to third parties unless you opt-in here. Covered Consumers who opt-in to Personal Information Sales or Sharing may opt-out of future Sales or Targeted Advertising at any time.

Troon does not and will not, without first obtaining your consent, process your Personal Information for Profiling.

Should you choose to exercise any of the rights enumerated under this Notice we will not:

• Deny you goods or services;

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

• Provide you a different level or quality of goods or services; or

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, please be aware that it may be a functional necessity for our Site or Services to have Personal Information about you in order to operate, and we may not be able to provide some or all of our Site or Services to you if you direct us to delete your Personal Information.

Additionally, we offer the Troon Rewards and Access programs to consumers for the collection, use, and/or Sale of their Personal Information. If you voluntarily participate in the Troon Rewards or Access programs, you may opt-out at any time by following the instructions below.

For more information on the financial incentives and discounts offered by the Troon Rewards or Access programs, as well as the material terms, please read the Access Program Terms and Conditions.

As part of the Troon Rewards and Access programs, we collect your first and last name, email address, zip code, and country.

You may sign up for the Troon Rewards or Access programs on the Troon Rewards and Access websites. You may cancel your membership at any time by submitting a ticket here.

Please be aware that we may revoke this program, or you may opt-out, at any time.

PRIVACY NOTICE FOR EUROPEAN RESIDENTS

If you reside in a country in the European Economic Area, the United Kingdom, or Switzerland (a “European Resident”), then information we collect from you may be subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or the applicable equivalent laws of the United Kingdom or Switzerland (collectively, the “GDPR”)), and the following additional information is provided for your benefit. For purposes of this Privacy Notice to European Residents section , “Personal Information” means “personal data” as defined by the GDPR.

The controller of the Personal Information collected through the Services is:

Troon Golf, LLC 15044 North Scottsdale Road Suite 300 Scottsdale, Arizona 85254 Phone: 480.606.1000 Fax: 480.606.1010 Email: privacy@troon.com

If you use the Sites or Services, you acknowledge that your Personal Information is being processed pursuant to the lawful bases described below, and you specifically consent to your Personal Information gathered through the Sites or Services being transferred, used, and stored in the United States.

(1) Your Rights

You have the following rights under the GDPR:

• You have the right to know why we collect your Personal Information, how and why it is processed by us, and what our legal bases for such processing are.

• Right of access: You have the right to access your Personal Information.

• Right to rectification and deletion: you have the right to supplement or correct the Personal Information we’ve collected about you, or to direct us to delete your Personal Information.

• If you give us your consent to process your Personal Information, you have the right to revoke that consent.

• Right to data portability: you have the right to request that we transfer all your Personal Information to another controller in a reasonably understandable format.

• Right to object: you may object to our processing of your Personal Information. We will make commercially reasonable efforts to comply with your objection, unless there are legally permissible reasons why we can or must continue to process your Personal Information.

Please note that all rights described above do not necessarily apply to each processing activity depending on the nature of the lawful basis for each processing activity, as described below.

(2) Lawful Bases for Processing

Under European law, companies must have a legal basis to process Personal Information. You have particular rights available to you depending on which legal basis we use, and, as explained above, certain rights may and may not be applicable depending on the nature of the lawful basis for each processing activity. You always have the right to request access to, rectification of, and erasure of your Personal Information under the GDPR. To exercise your rights, please email us at privacy@troon.com.

A. For all people who have legal capacity to enter into an enforceable contract, we process Personal Information as necessary to perform our contracts with you. We describe the contractual services for which this Personal Information processing is necessary throughout this Privacy Policy and in our Terms of Service or in another applicable agreement between you and Troon (collectively, the “Terms”). Examples of the uses of your Personal Information necessary to provide our contractual services are:

• To provide, improve, customize, and support our Sites and Services;

• To promote safety and security;

• To transfer to, transmit to, store in, or process in the United States and other countries; and

• To communicate with you, for example, on Sites- or Services-related issues.

We will use the Personal Information we have to provide the Sites and Services; if you choose not to provide certain Personal Information, the quality of your experience using the Sites and Services may be negatively impacted.

When we process Personal Information you provide to us as necessary to perform our contracts with you, you have the right under the GDPR to require us to transfer your Personal Information to another controller. To exercise your rights, please email us at privacy@troon.com.

The other legal bases we rely on in certain instances when processing your data are:

B. Your Consent:

• For processing to provide the Sites and Services that you request.

• For processing information that you allow us to receive through the device-based settings (such as location services on a mobile device) when you enable them, so we can provide the features and services described when you enable the settings (all where and as applicable).

• For disclosures of information to certain third-parties, including third-party advertising partners, as described above in the “Who We Share Your Personal Information With” section in our Privacy Policy.

When we process Personal Information you provide to us based on your consent, you have the right under the GDPR to withdraw your consent at any time and to require that we transfer the Personal Information you provide to another controller. To exercise your rights, please email us at privacy@troon.com.

C. Our legitimate interests or the legitimate interests of a third party, where not outweighed by your interests or fundamental rights and freedoms ("legitimate interests"):

• For processing to provide marketing and other communications from the Troon family of companies to you. The legitimate interests we rely on for this processing are:

  • To promote the Sites and Services and conduct marketing and other communications activities.

• For processing to share information with others including law enforcement and to respond to legal requests. The legitimate interests we rely on for this processing are:

  • To prevent and address fraud, unauthorized use of the Sites and Services, violations of our terms and policies, or other harmful or illegal activity; to protect ourselves (including our rights, Sites, Services, property or products), our users or others, including as part of investigations or regulatory inquiries; or to prevent death or imminent bodily or other harm.

• For processing to share information with business partners and prospective business partners, and as otherwise described in the Privacy Policy. The legitimate interests we rely on for this processing are:

  • Troon’s operation of its day-to-day business, and ability to plan and execute strategic corporate transactions, including mergers or bankruptcy

You have the right to object to, and seek restriction of, such processing; to exercise your rights, please email us at privacy@troon.com.

We will consider several factors when assessing an objection to our processing in furtherance of Troon’s legitimate interests, including: our users' reasonable expectations; the benefits and risks to you, us, other users, or third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportional effort. Your objection will be upheld, and we will cease processing your information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.

Compliance with a legal obligation:

• We need to process your Personal Information when applicable law requires it, including, for example, if there is a valid legal request for certain data.

(3) Disclosures of Your Information

We may disclose your Personal Information, (as well as non-Personal Information, without the same restrictions that apply to your Personal Information) to our Service Providers whom we engage to perform certain functions on our behalf (such as processing of payments, provision of data storage, hosting of our Sites, marketing of our products and services, conducting audits, and performing web analytics) and Online Tool Providers. We also disclose your Personal Information to third party owners or managers of applicable properties for their own business purposes.

Service Providers and Online Tool Providers:

• Amazon Web Services

  • https://aws.amazon.com/privacy/

• Azure

  • https://azure.microsoft.com/en-us/explore/trusted-cloud/privacy

• EZLinks

  • https://www.ezlinks.com/PrivacyStatement.asp

• G1 Software

  • https://www.nbcuniversal.com/privacy?intake=Golf

• GOOGLE

  • Google Analytics: tracks user activity on our Sites (page views, clicks, etc.) that allows Troon to understand traffic, identify unique users and measure the performance of the Services. See https://policies.google.com/privacy.

• Iterable

  • https://iterable.com/legal/privacy-policy/

• Mapbox

  • https://www.mapbox.com/legal/privacy

• Microsoft

  • https://www.microsoft.com/en-us/privacy/privacystatement

• Quick 18 (Sagacity Golf)

  • https://www.sagacitygolf.com

• Render

  • https://render.com/privacy

• Shopify

  • https://www.shopify.com/legal/privacy/consumers

Advertising Partners:

• GOOGLE

  • Google AdSense: fills the Services’ ad inventory. See https://policies.google.com/technologies/ads?hl=en-US.

We also share and exchange your Personal Information and non-Personal Information within our family of Troon companies.

We may also disclose your Personal Information to third parties when we believe, in good faith and in our sole discretion, that such disclosure is reasonably necessary to (a) enforce or apply the terms and conditions of the Services, including investigation of potential violations thereof, (b) comply with legal or regulatory requirements or an enforceable governmental request, (c) protect the rights, property or safety of us, our users or other third parties, (d) prevent a crime or protect national security, or (e) detect, prevent or otherwise address fraud, security or technical issues.

Finally, we reserve the right to transfer information (including your Personal Information) to a third party in the event of a sale, merger, or transfer of all or substantially all of the assets of our company relating to the Services, or in the unlikely event of a bankruptcy, liquidation, or receivership of our business. We will use commercially reasonable efforts to notify you of such transfer, for example via email or by posting notice on our website.

(4) Questions and Complaints

If you have any questions or complaints regarding our use of your Personal Information, please contact us at privacy@troon.com. You also have the right to submit a complaint to your applicable Data Protection Authority.