CALIFORNIA CONSUMER PRIVACY ACT PERSONAL INFORMATION POLICY

Effective: January 1, 2020

1. Purpose and Scope

This CCPA Personal Information Policy (“Policy”) provides guidance to Club Champion LLC (“Club Champion,” “our,” “we” or “us”); its subsidiaries, and all of their respective staff members, employees, consultants, contractors, distributors, temporary workers, suppliers, agents, representatives, partners, and all personnel affiliated with such third parties (“Covered Persons”) on the management of Personal Information (as defined below) Processed (as defined below) by or on behalf of Club Champion, in accordance with the California Consumer Privacy Act (the “CCPA”). This Policy describes how Personal Information must be collected, handled, and stored to meet Club Champion’s data protection standards, and to comply with the CCPA. The purpose of this Policy is to ensure fair and transparent Processing of Personal Information.

Club Champion’s policy is to respect and protect Personal Information collected or maintained by or on behalf of Club Champion. All Personal Information must be Processed in a lawful, fair, and transparent manner and it is Club Champion’s duty to ensure the security and confidentiality of such Personal Information at all times. This Policy covers all Personal Information obtained from Club Champion’s customers and other California Residents (defined below) for which Club Champion collects Personal Information.

Covered Persons can contact the Club Champion Marketing Department at This email address is being protected from spambots. You need JavaScript enabled to view it. or (888) 340-7820 with questions about this Policy. Verifiable Personal Information Requests (defined below) and requests for further information should be directed to the Club Champion Marketing Team.

2. DEFINITIONS

Capitalized terms used but not defined in this Section 2 have the meanings given elsewhere in this Policy. In this Policy, unless stated otherwise:

“California Consumer Privacy Act” or “CCPA” means the California Consumer Privacy Act of 2018.

“California Resident” means a natural person who is a California resident, as defined in section 1798.140(g) of the CCPA.

“Verifiable Personal Information Request” means a California Resident request that a business disclose or delete Personal Information that it has about the California Resident pursuant to CCPA sections
1798.100, 1798.105, 1798.110, or 1798.115.

“Data Incident” means a breach of Club Champion’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information on systems managed
by or otherwise controlled by Club Champion. “Data Incidents” does not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful log-in
attempts, pings, port scans, denial‐of‐service attacks, and other network attacks on firewalls or networked systems.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California
Resident or household. (See Appendix A for examples of Personal Information.)

“Information Security Policy” means Club Champion’s internal information security policy.

“Process” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means.

“Service Provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its
shareholders or other owners, that Processes information on behalf of a business and to which the business discloses a California Resident’s Personal Information for a business purpose pursuant to a written
contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the Personal Information for any purpose other than for the specific purpose of performing the
services specified in the contract for the business, or as otherwise permitted by the CCPA, including retaining, using, or disclosing the Personal Information for a commercial purpose other than providing the
services specified in the contract with the business.

3. RESPONSIBILITIES

(a) Club Champion Marketing Team Responsibilities

1. The Club Champion Marketing Team is responsible for approving any data protection statements attached to documentation and communications provided to employees as well as documentation and communications sent to customers of Club Champion, such as emails and letters or information notices displayed on Club Champion’s websites.
2. The Club Champion Marketing Team is responsible for addressing any data protection queries from California Residents, journalists, or media outlets like newspapers.
3. The Club Champion Marketing Team will ensure that all Covered Persons are trained about their data protection responsibilities as part of the induction Process and at regular intervals thereafter.
   Covered Persons whose roles require regular access to Personal Information, or who are responsible for implementing this Policy or responding to Verifiable Personal Information Requests under this
   Policy, will receive additional training to help them understand their duties and how to comply with them.
4. Each business unit and their respective departments are responsible for working with the Club Champion Marketing Team, and Operations Department to implement appropriate compliance controls
   specific to their operations (including but not limited to business practices, other guidance, and training of Covered Persons), in particular the vetting of any potential or current Service Provider to which
   Personal Information may be transferred or disclosed, as part of their business relationship with Club Champion. Covered Persons are required to follow the applicable business practices and other
   guidance, and to take the training required by their business units and/or departments.

(b) Covered Person Responsibilities

Covered Persons may have access to the Personal Information of other Covered Persons and of our customers in the course of their employment, contract, volunteer period, internship or apprenticeship. Where
this is the case, Club Champion relies on Covered Persons to help meet its data protection obligations.

Covered Persons who have access to Personal Information are required:

1. to access only Personal Information that they have authority to access and only for authorized purposes;
2. not to disclose Personal Information except to Covered Persons (whether inside or outside Club Champion) who have appropriate authorization;
3. to keep Personal Information secure (for example, by complying with rules on access to premises, computer and mobile access, password protection, and secure file storage and destruction);
4. not to remove Personal Information, or devices that can be used to access Personal Information, from Club Champion’s premises without implementing appropriate security measures
   (such as encryption, password protection, and lockable cases) to secure the data and the device;
5. where documents are password protected, passwords must be transmitted separately and not via email;
6. to ensure any documents (including emails) which contain Personal Information are:
   (A) kept in an orderly fashion;
   (B) filed on registered electronic or paper files as soon as practicable if they are to be retained;
   (C) erased or securely destroyed (e.g., shredded) when they are no longer required (in accordance with Club Champion’s data retention policy);
7. not to keep random collections of odd papers or old emails. If they need to be retained, they should be properly filed, as mentioned above;
8. to observe Club Champion’s clear desk policy;
9. to ensure that if required, they could retrieve Personal Information for which they are responsible to answer an inquiry from an California Resident; and
10. notify the Club Champion Marketing Team immediately, in the event of a data breach.

Failing to observe these requirements may amount to a disciplinary offense, which will be dealt with under Club Champion’s disciplinary procedure. Significant or deliberate breaches of this Policy, such as accessing employee or customer data without authorization or a legitimate reason to do so, may constitute gross misconduct and could lead to dismissal without notice.

(c) Operations Department Responsibilities

The Operations Department is responsible for:

1. ensuring all systems, services, and equipment used for storing Personal Information meet acceptable security standards and comply with Club Champion’s Information Security Policy;
2. performing regular checks and scans to ensure security hardware and software is functioning properly; and
3. evaluating any potential Service Provider Club Champion is considering using to store or Process data (for instance, cloud computing services).

4. NOTICE OF PRIVACY PRACTICES

All Personal Information should be Processed by lawful and fair means, in a transparent fashion. It is important to ensure that at or before Club Champion collects Personal Information, Club Champion provides California Residents with an appropriate notice (“Privacy Notice”) and information as to the categories, use and disclosure of the Personal Information Club Champion collects and Processes. Club Champion should only collect categories of Personal Information that have been appropriately disclosed to California Residents in a Privacy Notice. Covered Persons should limit Personal Information Processing to the minimum amount necessary to accomplish the purpose for which such Personal Information is collected, pursuant to Club Champion’s policies and procedures. Under no circumstances should Club Champion or Covered Persons sell Personal Information.

5. CALIFORNIA RESIDENT RIGHTS AND REQUESTS

(a) California Resident Rights. California Residents have a number of rights in relation to their Personal Information. California Residents can;

1. request that Club Champion disclose to the California Resident the categories and specific pieces of Personal Information Club Champion has collected about them (“Request to Know”);
2. request that Club Champion delete any Personal Information about the California Resident that Club Champion has collected about them (“Request to Delete”); and
3. request to receive a copy of their Personal Information in a readily usable format that allows the California Resident to transmit the Personal Information from one entity to another without hindrance.

(b) Verifiable Personal Information Requests. Verifiable Personal Information Requests may be made in writing or via phone. If you receive a Verifiable Personal Information Request, please notify the Club Champion Marketing Team immediately. It is Club Champion’s duty to confirm receipt of a request by a California Resident within 10 days and provide information about how Club Champion will Process the request.

The Club Champion Marketing Team will be responsible for sending the California Resident the appropriate Verifiable Personal Information Request form to verify the identity of the California Resident. (See Appendix B for sample email responses to common Verifiable Personal Information Requests and Appendix C for common Verifiable Personal Information Request forms.) Club Champion must receive the completed Consumer Right Request form prior to addressing the California Resident’s request.

Club Champion has a duty to respond to verified Requests to Know and Requests to Delete within 45 days from the date the request was received.

California Residents may exercise their rights by contacting the Club Champion Marketing Team at This email address is being protected from spambots. You need JavaScript enabled to view it., by calling (888) 340-7820 the “Contact Information”). The Contact Information will be included in all agreements between Club Champion and California Residents that address the collection of Personal Information.

6. REQUIREMENTS FOR SERVICE PROVIDER ENGAGEMENT

(a) Verifiable Personal Information Requests.

If a Service Provider Processes Personal Information on behalf of Club Champion, Club Champion must have in place a written contract:

1. prohibiting the Service Provider from (a) selling the Personal Information, (b) retaining, using or disclosing the Personal Information for any purpose other than to the extent required to perform the
   obligations subcontracted to it, and (c) retaining, using or disclosing the Personal Information outside of its relationship with Club Champion.
2. that includes a written certification from the Service Provider that it understands and will comply with the above restrictions.

(b) All business units and departments shall work with Operations Department and the Club Champion Marketing Team to:

1. require Service Providers to inform the California Resident to submit Verifiable Personal Information Requests regarding Personal Information that such Service Provider collects or maintains on
   Club Champion’s behalf directly to Club Champion and provide the California Resident with information about Club Champion’s submission methods;
2. require Service Providers to explain the basis for any denial of a Verifiable Personal Information Request by the Service Provider regarding a Request to Know or delete from a California Resident regarding Personal Information that the Service Provider collects or maintains on Club Champion’s behalf;
3. take reasonable steps to select and retain approved suppliers that can maintain appropriate security measures to protect Personal Information in a manner consistent with this Policy and any applicable laws;
4. require Service Providers by contract to implement and maintain appropriate technical and organizational security measures for Personal Information and to protect Personal Information from unauthorized access, destruction, use, modification, or disclosure;
5. require Service Providers to report information security incidents and breaches to Club Champion without delay following discovery of such breach (ideally between 24 / 48 hours) and provide
   evidence relating to such breach context and extent; and
6. monitor suppliers for compliance with their data protection obligations and, in case of any doubt, mandate an audit of such supplier data protection practices, in compliance with the agreement entered with Club Champion.

7. CHANGES TO THIS POLICY

Club Champion may amend this Policy consistent with the requirements of the CCPA, including notice about any amendment.

8. EFFECTIVE DATE

This Policy is effective as of January 1, 2020.

PRIVACY POLICY

Your privacy is important to Club Champion. So we’ve developed this Privacy Policy to explain what Personal Data we may collect from you, how we may use it, the choices you have regarding our use of it, and whether we disclose it to anyone when you access our websites at clubchampion.com, clubchampiongolf.co.uk, clubchampion.ca and clubchampion.com.au (the “Sites”), including all content, information, and functionality available through the Sites, and when you otherwise interact with us regarding our products, services or offerings (collectively referred to as the “Services”). By using our Services, including the Site, you acknowledge the terms of this Privacy Policy as they may be amended from time to time.

PERSONAL DATA WE COLLECT

We treat any data that identifies you, or reasonably can be linked to you, as “Personal Data.” Data that has been de-identified or aggregated so that it cannot reasonably be linked to you is not Personal Data, and we may use that data for any purpose. Personal Data also does not include publicly available information, such as information that is lawfully made available through federal, state, or local government records. We may use de-identified, aggregated, or publicly available data, for any purpose. We do not attempt to re-identify de-identified data unless you have given us consent to maintain and use the data in identifiable form.

We may provide the following information when you visit our Sites, purchase our Services, or otherwise interact with us. The Personal Data we collect includes:

• Identifying Information - such as name, mailing address, phone numbers, and email addresses.
  Internet or Similar Network Activity - such as your activity related to your interaction on our Site, as well as your interaction with our advertising and other communications, which may include your IP address and browsing activity.
• Commercial Information - such as information relating to your purchases and services, including your purchasing or consuming histories or tendencies.
• Financial Information - such as your bank account number, credit card number or other financial information when you purchase Services from us.
• Demographic Information – such as age, gender and marital status.

HOW WE OBTAIN YOUR PERSONAL DATA

• From You: We obtain the Personal Data that we collect about you from you when you interact with our Site and Services, including when you: (1) contact and communicate with us, including our sales, support or field service teams; or (2) purchase and use our Services or Sites.

OUR USE OF PERSONAL DATA

We may use your Personal Data as follows:

• Provide Our Services: We use Personal Data to furnish our Services, including to: (1) process and fulfill your purchases; or (2) provide information about the status of your products or services.
• Communicate with You: We use Personal Data to respond to communications, contact you about your transactions, promote products or services, provide other relevant information, and request information or feedback.
• Personalize Your Experience: We utilize Personal Data regarding your use of our Sites and Service to personalize and enhance your experiences.
  Internal Research: We use Personal Data to conduct internal research to develop, improve or repair our products, services, or technology.
• Security or Fraud Prevention: We use Personal Data to: (1) prevent, detect, protect against, or respond to security incidents, fraud or malicious or deceptive practices, or other illegal activity, (2) preserve the integrity or security of systems, and (3) investigate, prepare for, establish or defend legal claims.
• Legal Compliance: We may use Personal Data to comply with applicable law or to comply with a lawful governmental request.

We will retain your Personal Data only for as long as necessary to fulfill the business and commercial purpose(s) for which we obtained the information or as otherwise required by law. Also, please see below regarding consumer rights that may be applicable in your jurisdiction.

We do not use or disclose sensitive personal information, as defined by the California Consumer Privacy Act (“CCPA”), for purposes that would require a consumer to exercise a right to limit under the CCPA.

OUR SHARING OF PERSONAL DATA

We may share Personal Data with service providers who act on our behalf, our partners, or others operating at your direction or where legally necessary or appropriate.

• Service Providers: We engage third parties to act as our service providers and perform certain tasks on our behalf in connection with delivering you our products and services. The tasks performed by service providers include: (1) processing and storing Personal Data; (2) assisting with marketing communications, advertising, and strategic initiatives to enhance the Services; (3) processing credit card or other financial charges; and (4) providing technology services. We may provide service providers with all categories of Personal Data described above so they may act on our behalf. We take reasonable steps to ensure that our service providers are contractually obligated to keep Personal Data confidential and only utilize the Personal Data as permitted.
• Affiliates: We may share Personal Data with our affiliated entities.
• Other Legal Purposes: We also may share Personal Data: (1) with your consent; (2) to respond to subpoenas, court orders, or other legal process or otherwise as required or allowed by law or the competent governmental or judicial authorities; (3) to cooperate with law enforcement, government or regulatory entities, and safety or investigation authorities; (4) when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud or other illegal activities or to establish or preserve a legal claim or defense; (5) to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity, or preserve the integrity or security of systems; (6) to investigate, establish, exercise, prepare for, or defend legal claims; or (7) as part of a corporate restructuring, sale of assets, merger or divestiture.

Use of Cookies
Like most commercial websites, we analyze how visitors use our website and portals with "cookie" technology. A cookie is a small text file that is placed on your computer when you access our website and allows us to recognize you each time you visit the website. We may use cookies and similar technologies such as pixels to: (1) enhance or personalize your website usage and experience; (2) monitor website usage; and (3) improve the website and our services, including providing you with interest-based ads. We may work with service providers or third parties that help us track, collect and analyze this information. We may combine the information we collect through cookies with other information we have collected from you or information from other sources. We partner with third-party advertising companies that use tracking technologies to serve our advertisements across the Internet. These advertising companies may collect information about your visits to ours and other websites. These advertising companies serve ads on behalf of us and others on nonaffiliated sites, and some of those ads may be personalized, meaning that they are intended to be relevant to you based on information collected about your visits to our Sites and elsewhere over time.

If you choose, you can set your browser to reject cookies or you can manually delete individual cookies or all of the cookies on your computer by following your browser’s help file directions. However, if your browser is set to reject cookies or you manually delete cookies, you may have some trouble accessing and using some of the pages and features on our website. Please note that browser-management tools for cookies are outside of our control, and we cannot guarantee their effectiveness. For additional information on rights to opt-out of targeted advertising, please visit the “Your Rights and Choices” section below.

SECURITY OF YOUR PERSONAL DATA

We use commercially reasonable administrative, technical and physical safeguards to protect Personal Data, considering the nature of the Personal Data and the threats posed. However, there is security risk inherent in all internet and information technologies, and we cannot guarantee the security of your Personal Data.

THIRD PARTY WEBSITES AND APPLICATIONS

Our Site may contain links to websites or applications hosted by third parties. This Privacy Policy only applies to websites and applications within our control and does not apply to any third-party sources. Any data collected through third party websites or applications is subject to the privacy practices of the third party, and you should review the privacy policies of these third parties prior to sharing any data.

RIGHTS AND CHOICES OF CUSTOMERS

We provide our customers with certain rights regarding their Personal Data. This section describes the legal rights and explains how you can exercise those rights. We will not discriminate against you for exercising any of your rights by: (1) denying you goods or services; (2) charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (3) providing you a different level or quality of goods or services; or (4) suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Right to Know About Personal Data Collected, Used, or Disclosed

You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Data. Once we receive your request and verify your identity, we will disclose to you: (1) the categories of Personal Data we collected about you; (2) the categories of sources for the Personal Data; (3) our business or commercial purpose for collecting or disclosing that Personal Data; (4) the categories of third parties with whom we shared that Personal Data; and (5) the specific pieces of Personal Data we collected about you in the preceding 12 months.

Right to Delete Personal Data

You have the right to request that we delete any of your Personal Data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your request and verify your identity, we will permanently delete (and direct our service providers to delete) your Personal Data from our records, unless a legal exception to deletion applies.

Right to Correction of Personal Data

You have the right to request that we correct inaccurate Personal Data that we maintain about you.

Right to Opt-Out of the Sharing of Your Personal Data for Targeted Advertising

You have the right to opt out of the sharing of your Personal Data for targeted advertising. As noted above, we engage in personalized or targeted advertising using third-party cookies or pixels. In connection with such advertising, we may share the following categories of Personal Data with marketing partners: (a) device information and identifiers, such as unique advertising identifiers and cookies, and IP address; (b) usage information, such as browsing history; (c) location information, such as city; and (d) inference data. We do not otherwise sell your Personal Data, and we have no actual knowledge of selling or sharing personal information of minors under 16 years of age to non-affiliated third parties without affirmative consent.

Additionally, if you enable a browser-based opt-out preference signal, such as Global Privacy Control, in certain jurisdictions, upon receipt or detection, we will make reasonable efforts to treat the signal as a valid request to opt out of the sharing of Personal Data for targeted advertising pursuant to applicable law.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1-888-340-7820 and,
• Sending us an email at This email address is being protected from spambots. You need JavaScript enabled to view it..

Authorizing an Agent

You may designate an authorized agent to submit your consumer request on your behalf, so long as the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.

Verifying Your Request

We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to you.  Making a verifiable consumer request does not require you to create an account with us.  We will only use Personal Data provided in a verifiable consumer request to verify your identity or authority to make the request.

To verify your identity, we ask that you provide us with the following information when you submit your request: (1) first name, (2) last name, and (3) phone number or email. We will use the above information to verify your identity. Depending on your type of request or the information requested by you, we may require additional information to verify your identity and fulfill your request.

If we decline to take action regarding your request, you may have the right to appeal. Please contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. if you would like to submit such an appeal.

RIGHTS AND CHOICES OF EU AND UK DATA SUBJECTS

The EU’s General Data Protection Regulation and the UK Data Protection Act and UK General Data Protection Regulation provide EU and UK data subjects with additional rights described below. We generally act as a data controller of EU and UK data subject’s Personal Data submitted to us. We rely on that Personal Data for the legitimate commercial purposes of providing our Services. Where we need to collect Personal Data by law or under the terms of a contract we have with you, and you fail to provide that Personal Data when requested, we may not be able to provide you with our Services. We consider and balance any potential impact on you and your rights before we process your Personal Data. We do not use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law. In certain circumstances, we act as a data processor, and, in those circumstances, we process your Personal Data for the purposes set out in this Policy consistent with the data processing terms of those partners. If we are relying on your consent to process your Personal Data, you have the right to withdraw your consent at any time by contacting us at the information below. We will only use your Personal Data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If you are located in the EU or UK and would like to: (1) access your Personal Data; (2) transfer your Personal Data; (3) request the erasure of your Personal Data; (4) object to the processing of your Personal Data; or (5) change your privacy preferences, please email us at This email address is being protected from spambots. You need JavaScript enabled to view it.. Please note that there are certain exceptions and restrictions of these rights under the European data privacy laws that enable personal data to be retained, process or withheld from access, and we will inform you of these exemptions and restrictions, if applicable. If you are in the EU or UK and have any complaints regarding our privacy practices as a data controller, you have the right to make a complaint at any time to your local Supervisory Authority. However, we would appreciate the chance to address your concerns before you approach your Supervisory Authority, so please contact us first at the information below.

CROSS-BORDER DATA TRANSFERS

We process Personal Data both inside and outside the United States. When appropriate, we execute EU and UK Model Clauses, also known as Standard Contractual Clauses, to meet the adequacy and security requirements for our customers that operate in the EU and the UK and make transfers of personal data from those jurisdictions to the United States and other countries that lack adequacy determinations. Please contact us as detailed in the “Contact Us” section below for more information. In addition, we may transfer your Personal Data if one of the legal exceptions for such transfer can be invoked, such as with your consent or in execution of an agreement you have with us.

PERSONAL INFORMATION CONCERNING CHILDREN

We do not knowingly collect Personal Data from individuals under the age of 16, unless the Personal Data is submitted with verifiable parental consent. Our Site is not intended for anyone under the age of 16, and no one under the age of 16 may provide information on the Site.

Updates to the Privacy Policy

We may update this Privacy Policy periodically as we offer new products and services, and as our business, technology, and laws change. You can determine when this Privacy Policy was last revised by referring to the “Last updated” reference above. Any changes will become effective upon posting of the revised Privacy Policy. If we make material changes to the policy, we will provide notice to you of the changes as required by applicable law.

CONTACT US

United States and Canada
825 75th St.
Willowbrook, IL 60527
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Policy Last Updated: 6-14-2026