SMASH INDOOR SPORTS

PRIVACY POLICY

Version 1.1 | Effective August 11, 2026

This Privacy Policy explains how SMASH Indoor Sports ("SMASH," "we," "us," or "our") collects, uses, shares,

retains, and protects personal information when you use our facilities, website, booking or membership systems,

communications, programs, and related services. It is intended to be read separately from, and together with,

the SMASH Indoor Sports Terms of Service.

1. SCOPE

This Privacy Policy applies to personal information SMASH collects from members, renters, participants,

parents and legal guardians, coaches, instructors, teams, organizations, spectators, guests, website visitors,

and other users of SMASH services. When a parent or legal guardian provides information concerning a minor,

the parent or guardian represents that they are authorized to provide that information and to act on the minor’s

behalf where permitted by law.

2. PERSONAL INFORMATION WE COLLECT

Depending on how you interact with SMASH, we may collect the following categories of personal information:

 Identifiers and contact information, such as name, email address, telephone number, mailing address,

account identifiers, and emergency-contact information.

 Account, membership, and participant information, including membership type, household or family

membership information, athlete or participant name, age or date of birth when provided, team or

organization affiliation, and parent or guardian information.

 Reservation and activity information, including bookings, cancellations, credits, attendance, no-shows,

facility locations, reserved spaces, lesson or program registrations, and membership usage.

 Transaction and payment-related information, including transaction amounts, billing history, recurring-

payment status, refunds or credits, chargebacks, and limited payment-method information made available

by payment processors.

 Communications and customer-service information, including emails, texts, support requests, feedback,

complaints, and other communications with SMASH.

 Facility access and security information, including electronic access credentials, access logs, timestamps,

reservation-linked entry information, and security or incident records.

 Video surveillance information, including video images and recordings captured in and around SMASH

facilities as described in the Terms of Service.

 Device, website, and online-service information where applicable, such as IP address, browser or device

information, usage data, cookies, and similar technical information.

 Sensitive data only when reasonably necessary and lawfully collected, which may include information

concerning a known child or other information treated as sensitive under applicable law.

SMASH INDOOR SPORTS | PRIVACY POLICY

SMASH Indoor Sports | Version 1.1 | October 17, 2026 | Page 2

3. HOW WE COLLECT INFORMATION

We may collect information directly from you when you create an account, purchase a membership, make or

manage a reservation, register for a lesson, camp, clinic, event, or program, sign a waiver, communicate with

us, enter a facility, or otherwise use SMASH services. We may also receive information automatically through

booking systems, websites, access-control systems, security systems, cookies or similar technologies where

used, and from service providers that process information on our behalf.

4. HOW WE USE PERSONAL INFORMATION

We use personal information for legitimate business and operational purposes, including to:

 Create and administer customer, member, family, and participant accounts.

 Process memberships, reservations, rentals, registrations, credits, recurring payments, and other

transactions.

 Provide facility access and administer electronic access credentials.

 Communicate confirmations, access information, scheduling changes, account notices, customer-service

responses, and operational information.

 Administer waivers, Terms of Service, facility rules, membership policies, and other agreements.

 Maintain facility safety and security, review incidents, prevent loss, and investigate unauthorized use or

policy violations.

 Verify membership eligibility, reservation usage, participant limits, and compliance with facility rules.

 Maintain accounting, tax, insurance, legal, and business records.

 Prevent fraud, enforce payment obligations, respond to chargebacks, and protect SMASH’s legal rights.

 Improve SMASH facilities, services, customer experience, systems, and operations.

 Send marketing or promotional communications where permitted by law and consistent with your

communication choices.

 Comply with legal obligations and respond to lawful requests from courts, regulators, law enforcement,

insurers, or other authorized parties.

5. PAYMENT INFORMATION

SMASH may use third-party payment processors to process credit card, debit card, ACH, or other payment

transactions. SMASH may receive transaction details, payment status, limited payment identifiers, and

information necessary to administer payments, recurring memberships, refunds or credits, chargebacks,

damages, unauthorized-use charges, and other amounts authorized under the Terms of Service. Payment card

information may be collected and stored by the applicable payment processor rather than directly by SMASH.

The processor’s handling of payment information is also subject to its own privacy and security practices.

6. VIDEO SURVEILLANCE AND FACILITY ACCESS INFORMATION

As described in the Terms of Service, SMASH uses video surveillance and may use electronic access systems

at its facilities. These systems may collect video images, timestamps, entry and access activity, reservation-

linked access information, and related security or operational records. SMASH may use this information for

safety, security, loss prevention, incident review, operational oversight, enforcement of facility and membership

rules, investigation of unauthorized use, billing disputes, chargebacks, legal claims, and protection of SMASH,

its customers, and its property.

7. HOW WE SHARE PERSONAL INFORMATION

SMASH may disclose personal information when reasonably necessary to operate its business or provide

requested services. Categories of recipients may include:

 Booking, membership, scheduling, and customer-account service providers.

 Payment processors, financial institutions, and billing or collection providers.

 Website hosting, communications, email, text-messaging, analytics, and technology providers.

SMASH INDOOR SPORTS | PRIVACY POLICY

SMASH Indoor Sports | Version 1.1 | October 17, 2026 | Page 3

 Electronic access-control, security, surveillance, and facility-management providers.

 Professional advisers, including attorneys, accountants, insurers, and auditors.

 Teams, organizations, program partners, coaches, or instructors when reasonably necessary to administer

a registration, membership, reservation, or program requested by the customer.

 Government agencies, law enforcement, courts, or other parties when disclosure is required or permitted by

law or reasonably necessary to protect rights, safety, property, or legal interests.

8. SALE OF PERSONAL DATA AND TARGETED ADVERTISING

SMASH does not intend to sell personal data for monetary consideration. If SMASH begins selling personal data

or processing personal data for targeted advertising in a manner that triggers an applicable opt-out right,

SMASH will provide the disclosures and opt-out method required by applicable law. SMASH may use service

providers to support ordinary advertising, communications, analytics, or marketing activities. Disclosure to a

processor acting on SMASH’s behalf is not treated as a sale when excluded from the definition of sale under

applicable law.

9. DATA RETENTION

SMASH retains personal information for as long as reasonably necessary for the purposes described in this

Privacy Policy, including providing services, maintaining business and accounting records, administering

memberships and reservations, resolving disputes, enforcing agreements, maintaining safety and security

records, and satisfying legal, tax, insurance, or regulatory requirements. Retention periods may vary depending

on the type of information, the reason it was collected, contractual obligations, operational needs, and applicable

law.

10. DATA SECURITY

SMASH maintains reasonable administrative, technical, and physical safeguards designed to protect the

confidentiality, integrity, and accessibility of personal information appropriate to the nature and volume of the

information processed. No method of transmission or storage is completely secure, and SMASH cannot

guarantee absolute security.

11. CHILDREN AND MINORS

SMASH is a youth-oriented sports facility and may receive information about minors from parents, legal

guardians, teams, coaches, or organizations in connection with reservations, memberships, waivers, programs,

and facility use. SMASH does not intend its online services to solicit personal information directly from children

in a manner that would require parental consent without obtaining the consent required by applicable law.

Parents and legal guardians may exercise applicable privacy rights on behalf of a known child as provided by

law.

12. YOUR PRIVACY RIGHTS

Depending on applicable law and subject to statutory exceptions, Nebraska consumers may have rights

concerning personal data, including rights to confirm whether SMASH is processing personal data, access

personal data, correct inaccuracies, delete personal data, obtain a portable copy of certain personal data, and

opt out of certain sales, targeted advertising, or profiling where applicable. SMASH will not unlawfully

discriminate against a consumer for exercising an applicable privacy right.

13. HOW TO SUBMIT A PRIVACY REQUEST

You may submit a privacy request using either of the following methods:

 Email: [email protected]

 Online: through the privacy/contact request mechanism made available on the SMASH Indoor Sports

website.

SMASH INDOOR SPORTS | PRIVACY POLICY

SMASH Indoor Sports | Version 1.1 | October 17, 2026 | Page 4

SMASH may take reasonable steps to authenticate your identity before completing a request. You are not

required to create a new account solely to submit a privacy request, although SMASH may use an existing

account to help authenticate the request. SMASH will respond to authenticated requests within the period

required by applicable law. If SMASH denies a request, you may appeal by replying to the denial or sending an

appeal to [email protected] with the subject line "Privacy Appeal."

14. THIRD-PARTY SERVICES AND LINKS

SMASH may use third-party platforms and service providers for booking, memberships, payment processing,

communications, website hosting, access control, analytics, security, and other business functions. Those third

parties may process information on SMASH’s behalf or, in some circumstances, under their own privacy

policies. SMASH is not responsible for the privacy practices of third-party websites or services that operate

independently from SMASH.

15. LEGAL AND SAFETY DISCLOSURES

SMASH may use or disclose personal information when reasonably necessary to comply with law, legal

process, court orders, law-enforcement requests, insurance requirements, or regulatory obligations; to

investigate fraud, security incidents, injuries, property damage, unauthorized facility use, or violations of SMASH

policies; to establish, exercise, or defend legal claims; or to protect the rights, safety, property, and interests of

SMASH, its customers, participants, employees, and others.

16. BUSINESS TRANSFERS

Personal information may be transferred or disclosed as part of a merger, acquisition, financing, reorganization,

sale of assets, or similar business transaction, subject to applicable law.

17. CHANGES TO THIS PRIVACY POLICY

SMASH may update this Privacy Policy from time to time. The current version will identify its effective date.

Material changes will be communicated or made available as required by applicable law.

18. CONTACT US

Questions regarding this Privacy Policy or SMASH privacy practices may be directed to:

SMASH Indoor Sports

Email: [email protected]

Website: www.smashindoorsports.com

19. AI-ASSISTED COMMUNICATIONS, CALL RECORDING AND TRANSCRIPTS

SMASH Indoor Sports uses or may use artificial intelligence (AI) and automated communications services,

including tools made available through GoHighLevel and supporting providers, for customer service, telephone

calls, voice assistants, chat, text messaging, appointment or reservation assistance, and related business

communications.

Depending on the channel and enabled features, personal information processed may include your name,

telephone number, email address, messages, questions, call audio, transcripts, AI-generated summaries,

timestamps, contact preferences, reservation or membership details, and records of interactions. SMASH uses

this information to respond to inquiries, provide services, maintain accurate records, improve service quality,

troubleshoot systems, resolve disputes, prevent misuse, and support business operations.

Calls and AI-assisted interactions may be recorded, transcribed, summarized, or reviewed when those functions

are enabled. SMASH will provide legally required notices and obtain any consent required by applicable law.

Not all interactions are necessarily recorded. If you do not wish to communicate through an AI system, you may

request human assistance through [email protected] or 402-235-6050, subject to available staffing.

SMASH INDOOR SPORTS | PRIVACY POLICY

SMASH Indoor Sports | Version 1.1 | October 17, 2026 | Page 5

Information may be processed by GoHighLevel and other vendors providing telecommunications, AI processing,

transcription, hosting, messaging, customer relationship management, security, and technical support. Their

processing and retention may be governed by contracts, product settings, and applicable law. SMASH does not

promise that recordings or transcripts are never used by a provider for model improvement unless that

restriction has been verified in the relevant provider settings and agreements.

AI-generated responses and summaries may be incorrect or incomplete. SMASH may review and correct

information when appropriate. Do not submit unnecessary sensitive personal information through chat or voice

channels; use designated secure payment methods for payment-card information.

SMASH retains recordings, transcripts, and related records only as reasonably needed for the purposes

described in this Policy, applicable retention settings, legal obligations, dispute resolution, or legitimate business

needs, and will take reasonable steps to protect them against unauthorized access. Access may be restricted to

authorized personnel and service providers. You may submit applicable privacy requests using the methods

described in Section 13.

Where AI communications involve minors, SMASH generally expects a parent or guardian to provide account

and contact information and to oversee communications on behalf of the minor. This section supplements, and

does not replace, the rest of this Privacy Policy.

Version 1.1 | Effective Date: October 17, 2026 | Supersedes Version 1.0