CHILDREN'S PRIVACY POLICY (COPPA)

How HZ360 collects, uses, shares, retains, and protects children's personal information

1. WHO WE ARE

This Children's Privacy Policy explains how HOTZONE NCAA SPORTS RECRUITING LLC, a Delaware limited liability company doing business as HZ360 (“HZ360,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information collected online from children under 13. HZ360 also applies age-appropriate protections to athletes ages 13–17 as described in this Policy, the HZ360 General Privacy Policy, and applicable law.

Clubs, teams, academies, coaches, trainers, training facilities, schools, wearable providers, and other organizations may separately collect personal information under their own privacy notices. Their role and responsibilities are established by contract before they receive children's personal information through HZ360.

2. SERVICES AND AGE GROUPS

This Policy applies to HZ360 services available through hz360.ai and its subdomains, including:

HOTZONE GAME PLAN™ — a mixed-audience recruiting-intelligence service for youth athletes and their parents or legal guardians;

HZ360 TrainingOS™ — training and athlete-development software available through participating facilities, trainers, parents, and legal guardians, including services associated with HZ360 Certified Evaluation Center™ facilities; and

Coach's Corner™ — athlete-development, recruiting-intelligence, and human-review services provided through authorized HZ360 personnel.

The Services are available to athletes of any age. HZ360 recommends the Services for athletes U12 and older, but does not impose an age restriction. Because users may include children under 13, HZ360 treats its Services as mixed-audience and applies an age-neutral age-assurance process before collecting personal information beyond what is permitted to determine age or obtain parental consent. A child identified as under 13 is routed to the parent-controlled consent process; an age screen is never used to exclude a child from the Services.

The HZ360 General Privacy Policy governs adult users, parents, guardians, coaches, trainers, facility personnel, business contacts, job applicants, cookies and analytics outside the child experience, US state privacy rights, and international privacy rights. If this Policy provides greater protection for a child, this Policy controls.

3. CHILD ACCOUNTS AND PARENT CONTROL

A profile concerning a child under 13 cannot be activated until the child's parent or legal guardian has received the HZ360 Direct Notice to Parent and provided verifiable parental consent. The account structure is:

• Children under 13 — a parent or legal guardian creates or authorizes the child's profile and controls consent, optional features, external visibility, disclosures, and privacy requests. After verifiable parental consent, the child may receive limited, age-appropriate access under the parent-controlled account.
• Athletes ages 13–17 — an athlete may have an individual login, subject to age-appropriate safeguards, parental involvement where required, program requirements, and applicable US, EU, UK, or other law.
• Athletes age 18 or older — the athlete controls the account and privacy choices, subject to any organization-sponsored program terms.

4. INFORMATION HZ360 MAY COLLECT

After receiving any required consent, HZ360 may collect the following categories of information relating to a child:

Wearable readings, athletic measurements, photographs, video, and audio are not automatically biometric information. Before deploying a technology, HZ360 evaluates whether it creates or uses a fingerprint, voiceprint, face or hand geometry scan, biometric template, or another identifier regulated by applicable law. HZ360 does not collect government-issued identification documents from children and does not use wearable data to recognize or identify a child unless the technology has undergone separate legal review and all required notices and consents have been implemented.

5. SOURCES OF INFORMATION

HZ360 may receive information from parents and legal guardians; children after required parental consent; athletes ages 13–17 under the applicable account rules; authorized facilities, trainers, clubs, teams, academies, coaches, and schools; Coach's Corner™ personnel; approved wearable, video, authentication, communications, hosting, and technical-service providers; approved recruiting and sports-data sources; communications sent to HZ360; and ordinary use of the Services. An organization providing information to HZ360 must have authority to do so and may not provide information about a child under 13 beyond the limited pre-consent information permitted by Section 8.

6. HOW HZ360 USES CHILDREN'S INFORMATION

HZ360 uses children's personal information to: create and maintain the parent-approved athlete profile; provide training, evaluation, athlete-development, recruiting-intelligence, reporting, and support features requested by the parent; generate TacticalDNA™, performance, development, and college-fit indicators; communicate with the parent about the account, consent choices, safety, privacy, and Services; authenticate users and maintain account preferences; secure, troubleshoot, maintain, and improve the Services; prevent fraud, misuse, and unauthorized access; fulfill authorized profile-visibility and sharing choices; and comply with law, enforce agreements, protect users, and maintain required consent and compliance records.

HZ360 does not: sell children's personal information; use children's personal information for targeted or behavioral advertising; permit providers to use children's personal information for their own independent purposes; condition participation on disclosure of more information than is reasonably necessary for the requested activity; place identifiable minor information in investor-facing systems; or use children's information to train an externally hosted artificial-intelligence model.

7. ARTIFICIAL INTELLIGENCE AND AUTOMATED ANALYSIS

HZ360 may use automated analysis to create performance insights, reports, TacticalDNA™ indicators, fit indicators, recommendations, or derived scores. These outputs are decision-support tools. They may be incomplete or inaccurate and do not replace qualified coaching, medical, educational, legal, or recruiting judgment.

HZ360 does not transmit identifiable information about a minor to an externally hosted AI model. There is no parental opt-in exception to this restriction. Before information reaches an external AI provider, it passes through HZ360's implemented de-identification control: direct identifiers and information reasonably capable of identifying the athlete are removed; small-cohort and distinctive-athlete reidentification risks are assessed; and the external provider is contractually prohibited from reidentification, secondary use, and model training. The data flow is technically tested and documented.

HZ360 does not use solely automated processing to make a decision about a child that produces legal or similarly significant effects. A parent or eligible athlete may challenge or request correction of a material automated output. HZ360 investigates the underlying information and provides human review under its documented review procedure or where required by applicable law.

8. LIMITED PRE-CONSENT COLLECTION

Before parental consent, HZ360 may collect only: the child's name; information reasonably necessary to determine age; the parent or legal guardian's name; the parent or legal guardian's online contact information; and a non-child-specific invitation code used to route the consent request. HZ360 does not collect the child's team affiliation or activate an athlete profile before consent.

Information collected solely to determine age or request parental consent is used only for that purpose, security, fraud prevention, and legal compliance. If consent is not received within 30 days of the invitation, HZ360 deletes the invitation information according to the Section 14 schedule.

9. AGE AND PARENTAL-AUTHORITY VERIFICATION

HZ360 uses a proportionate process to determine the athlete's age and make reasonable efforts to confirm that the person providing consent is the child's parent or legal guardian. HZ360 collects only information reasonably necessary for verification, and uses it only for age and parental-authority verification, security and fraud prevention, consent administration, and compliance and dispute resolution. Temporary verification evidence is deleted promptly under the Section 14 schedule; HZ360 retains only the verification result, method, date, related consent record, and limited audit information necessary for compliance, fraud prevention, or dispute resolution.

HZ360 does not collect government-issued identification from children and does not ordinarily require a parent to provide government identification. If an approved provider uses a parent's identification document for escalated verification, HZ360 does not receive or retain the document, and the provider may use it only for verification, must protect it under written safeguards, must prohibit secondary use and model training, and must delete it promptly after verification.

A parent may challenge or correct an age, account attribute, parental-authority determination, or verification result. HZ360 does not rely exclusively on automation for a final decision that rejects parental authority, changes a child's age classification, prevents consent, or suspends a minor's account for suspected identity fraud. Disputed or inconclusive results are reviewed by a trained person under HZ360's documented human-review procedure.

10. VERIFIABLE PARENTAL CONSENT

Before collecting information beyond Section 8, HZ360 provides the parent with the HZ360 Direct Notice to Parent, access to this Children's Privacy Policy and the HZ360 General Privacy Policy, and the HZ360 Parent Consent Instrument, and obtains verifiable parental consent through the method identified in the Direct Notice.

Base Consent

Base consent authorizes creation and maintenance of the child's account and profile; collection and use of core information selected by the parent; the integral hosting, authentication, security, storage, communications, and support providers; and the core athlete-development, training, reporting, and recruiting functions requested by the parent. If base consent is refused, HZ360 does not activate the child's profile or collect additional personal information.

Separate Optional Consent

Each of the following requires a separate, unselected parental choice: collection of wearable or motion data that HZ360 receives from the approved provider through a parent-authorized API connection (HZ360 does not send the child’s personal information to the wearable provider); photograph, video, and associated audio upload and analysis; profile visibility to approved facilities, trainers, clubs, coaches, or college programs; parent-authorized share links; collection or use of regulated biometric information, if applicable; and any materially different future collection, use, or disclosure. A parent may use the core Service without accepting an optional activity, except that the related optional feature cannot operate without the information it requires.

HZ360 records the verification method and result; the Direct Notice, Children's Privacy Policy, General Privacy Policy, and Consent Instrument versions presented; the consent date; every consent grant or refusal; every later withdrawal; and the date each change becomes effective.

11. COOKIES AND PERSISTENT IDENTIFIERS

HZ360 uses cookies, IP addresses, and browser, device, and session identifiers in a child experience only for permitted internal operations: authentication and login sessions, security and fraud prevention, account preferences, service functionality, network diagnostics, debugging, and compliance and access records. HZ360 does not use persistent identifiers to track children across unrelated services, create advertising profiles, or deliver targeted advertising. Nonessential analytics, session-replay, or advertising technology does not operate in a child experience unless it has undergone privacy review and any required notice and consent have been implemented.

12. DISCLOSURE AND SERVICE PROVIDERS

HZ360 discloses children's personal information only to approved providers processing information on HZ360's documented instructions under written safeguards; to recipients separately authorized by the parent; when required by law; or when reasonably necessary to protect a child, another person, HZ360, or the security of the Services. Provider agreements address confidentiality, purpose limitation, security, access restrictions, subprocessors, incident notification, retention and deletion, prohibition on sale and targeted advertising, prohibition on unauthorized secondary use, and prohibition on unauthorized model training. A provider that processes children’s personal information on HZ360’s behalf may not transmit it to an externally hosted AI model or use it for model training, and must impose the same restriction on its own subprocessors. Where another operator independently collects or maintains children’s personal information through the Services, HZ360 maintains a current list of those operators, with contact information, at https://hz360.ai/privacy/operators.

Stripe processes parent billing information only and does not receive children's personal information; it is noted for transparency. An age or parental-verification provider must agree in writing to use information only for verification, maintain appropriate security, prohibit secondary use and model training, restrict subprocessors, notify HZ360 of incidents, and promptly delete temporary evidence.

Business Transfers

Children's personal information may transfer as part of a merger, acquisition, financing, reorganization, bankruptcy, or asset transfer only under confidentiality protections and the existing consent choices. A successor proposing a materially different use or disclosure must provide direct notice and obtain new consent before applying the changed practice to a child's information when required by law.

13. PROFILE VISIBILITY AND SHARE LINKS

Athlete profiles are not publicly indexed or searchable. A parent may authorize limited visibility to approved facilities, trainers, clubs, coaches, college programs, or other recipients, and selects the information categories and recipient or recipient category. Parent-authorized share links are limited to the selected information, access-controlled, time-limited, revocable, logged, protected from public indexing, and restricted against onward disclosure and unrelated use. Recipients may use information only for the authorized purpose and may not publish, sell, redistribute, advertise with, or use it for unrelated profiling. HZ360 may suspend or revoke access for unauthorized use.

14. RETENTION AND DELETION

HZ360 retains children's personal information only as long as reasonably necessary for the disclosed purpose, an active account or authorized program, security, dispute resolution, or a legal obligation, and does not retain children's information indefinitely. The retention schedule for children's data is:

Deletion removes information from active systems within the applicable period. Protected backup copies are isolated from ordinary use and expire through the backup cycle. If information scheduled for deletion is restored, HZ360 takes reasonable steps to identify and delete it before using it for a new purpose. HZ360 instructs applicable providers to delete the information as well. Any change to these periods is reflected in an updated Policy.

15. SECURITY

HZ360 maintains reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of children's information, including a designated security owner, access controls and least-privilege permissions, encryption in transit and at rest, credential and secret management, security and access logging, vendor assessment, written provider safeguards, incident response, periodic risk assessment, and secure deletion procedures. Identifiable minor information is held in HZ360's most restricted internal data classification. No security system is perfect; parents should protect account credentials and promptly notify HZ360 of suspected unauthorized access.

16. PARENTS' RIGHTS

A parent or legal guardian may: review the child's personal information; request correction; request deletion; refuse further collection, use, or maintenance; withdraw base consent; withdraw an optional consent without withdrawing the others; challenge an age, authority, account, or material automated result; and request information about authorized recipients and providers. Withdrawal of an optional consent disables only the related feature. Withdrawal of base consent prevents HZ360 from continuing to maintain the child's profile and initiates deletion under Section 14, subject to limited information HZ360 must retain for legal, security, or compliance purposes.

To make a request, use the privacy request form at https://hz360.ai/privacy/request, email legal@hz360.ai, call 888-434-9360, or write to 1500 John F. Kennedy Blvd, Suite 450, PMB 101, Philadelphia, PA 19102. HZ360 verifies the requester's identity and parental authority using a method that is reasonable, proportionate, and not unduly burdensome.

17. US STATE PRIVACY RIGHTS

Residents of certain US states may have additional rights under applicable state privacy laws, including rights to access, correct, or delete personal data, obtain a portable copy, withdraw consent, opt out of certain sales, targeted advertising, or profiling, and appeal a denied request. HZ360 does not sell children's personal information or use it for targeted advertising. Where applicable law treats children's information, precise geolocation, biometric information, health information, or another category as sensitive data, HZ360 obtains any required consent and provides any required withdrawal mechanism. These rights apply subject to statutory thresholds, exemptions, and exceptions; additional state rights and appeal procedures are described in the HZ360 General Privacy Policy.

Illinois Biometric Information

Wearable and athletic-performance information is not automatically biometric information under Illinois law. Before using a technology that may collect a fingerprint, voiceprint, retina or iris scan, face or hand geometry scan, biometric template, or related biometric information, HZ360 determines whether the Illinois Biometric Information Privacy Act or another biometric law applies. If applicable, HZ360 provides the required written notice, obtains the required written release, publishes the required retention and destruction schedule, restricts disclosure and profit, and implements required safeguards before collection.

18. EU AND UK PRIVACY RIGHTS

If an athlete, parent, or other user is located in the European Economic Area or United Kingdom, HZ360 processes personal data in accordance with the EU GDPR, UK GDPR, UK Data Protection Act 2018, and other applicable local law. COPPA protections continue to apply to children under 13 where COPPA has jurisdiction.

HZ360 is a controller when it determines why and how personal data is processed for its Services; a club, academy, team, school, facility, or other organization may be a separate controller, joint controller, or processor depending on the program, with roles defined by contract. Depending on the activity, HZ360 relies on performance of a contract, compliance with a legal obligation, legitimate interests not overridden by the individual's rights and interests, or consent, giving particular weight to a child's best interests, age, capacity, and reasonable expectations. HZ360 does not use contract or legitimate interests merely to avoid a legal consent requirement.

When consent is the lawful basis for an online service offered directly to a child, the applicable age varies by EEA country from 13 to 16 and is 13 in the UK; below that age, HZ360 obtains authorization from the holder of parental responsibility and takes reasonable steps to verify it. Subject to applicable exceptions, an individual may request access, correction, deletion, restriction, portability, withdrawal of consent, objection to processing, and human review of applicable automated decisions, and may complain to the data protection authority where the individual lives or works (UK individuals: the Information Commissioner's Office). A parent or guardian may exercise these rights when authorized by the individual or permitted by law, taking account of the child's age and capacity.

HZ360 is based in the United States. For transfers from the EEA or UK to a country not recognized as adequate, HZ360 uses a valid transfer mechanism, such as the European Commission Standard Contractual Clauses, the applicable UK Addendum, or the UK International Data Transfer Agreement, with required transfer assessments and supplementary safeguards. Before offering the Services in the EEA or UK, HZ360 completes a child-focused Data Protection Impact Assessment, lawful-basis matrix, controller and processor role allocation, country-specific digital-consent analysis, representative and Data Protection Officer analysis, transfer documentation, child-friendly layered notices, high-privacy default settings, automated-analysis and profiling assessment, and special-category-data assessment.

19. THIRD-PARTY SERVICES

HZ360 may link to websites or services operated by others; their privacy practices are governed by their own notices, and parents should review those notices before allowing a child to use a linked service. A link does not authorize the third party to receive HZ360 child data. Any disclosure by HZ360 remains subject to this Policy, the Direct Notice, applicable law, and the parent's consent choices.

20. COORDINATED DOCUMENTS, CHANGES, AND CONTACT

This Policy operates together with the HZ360 General Privacy Policy, the HZ360 Direct Notice to Parent, the HZ360 Parent Consent Instrument, and any required biometric or program-specific notice. HZ360 records the version of each document presented when consent is obtained and does not knowingly publish or use versions containing materially inconsistent descriptions of information collection, AI use, account structure, disclosure, retention, or parental rights.

HZ360 posts the current Policy with its last-updated date. If a material change affects previously authorized collection, use, or disclosure, HZ360 provides direct notice and obtains new verifiable parental consent before applying the change when required. Parents who need this Policy or the privacy-request process in an accessible format, and anyone with questions, requests, or complaints, may contact HZ360 at legal@hz360.ai, 888-434-9360, or 1500 John F. Kennedy Blvd, Suite 450, PMB 101, Philadelphia, PA 19102.

HOTZONE NCAA SPORTS RECRUITING LLC d/b/a HZ360 · 1500 John F. Kennedy Blvd, Suite 450, PMB 101, Philadelphia, PA 19102 · 888-434-9360 · legal@hz360.ai · Where Great Futures Begin