Privacy Policy.

1. Acknowledgement

We are committed to protecting the privacy of everyone who uses our Website, Platform and/or our Services, for them to understand what personal data we collect and store, and why we do so, how we receive and/or obtain that information, the rights an individual has with respect to their personal data in our possession, and with complying with laws and regulations including the General Data Protection Regulation (EU) 2016.679 (EU GDPR), UK General Data Protection Regulation (“UK GDPR”), Privacy Act 1988 (Cth) (“Act") and the Australian Privacy Principles set out in the Act (collectively, “AU Privacy Act”), and any other national laws and regulations applicable to you and/or your customers (collectively, the “Applicable Privacy Laws”).

Any reference to “personal data” in this Privacy Policy is also a reference to “Personal Information” (as defined under the AU Privacy Act), and any other equivalent terms under other Applicable Privacy Laws, and it includes Information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. WHO WE ARE

We are the data controller in relation to the personal data that we collect, use or hold about you and we are responsible for protecting it in line with data protection laws. If you have any questions about this Privacy Policy or our privacy practices, please contact us by email at privacy@sailias.com.

3. HOW AND WHEN WE COLLECT PERSONAL DATA ABOUT YOU

We collect and process personal data about you from a variety of sources, including:

• from you directly when you pre-register for first access via our Website, create an account with us, upload or submit data to the Platform, subscribe to our services, or communicate with us by email, via the Platform's messaging or Connect feature, or via social media;
• from information we generate about you during our relationship with you, such as data collected on our Website and Platforms via cookies and other similar technologies which are described in our Cookies Policy at /cookies; and
• from information we collect about you from other sources, such as:
• trusted third-party data providers (including Nielsen, YouGov and Kantar)
• data submitted to the Platform by other Users (such as Brands, Talent and Rightsholders)
• public databases and commercially available sources such as Companies’ House, Google and social media platforms.

4. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU

We collect the following information from you directly:

• personal details and contact information e.g. name, date of birth, business/talent telephone number, business/talent email address, business billing address;

• account details e.g. your user type (Brand, Talent, or Rightsholder), your subscription tier and contract history, and your marketing preferences per channel;

• profile information that you choose to submit to the Platform, which will vary depending on your user type — for example:

• if you are a Brand: your organisation's name, industry, sponsorship objectives, and details of your sponsorship portfolio and contracted deals;

• if you are Talent: your name, profile details, NIL rights, ambassador rights, endorsement rights and other information you choose to make available on the Platform; and

• if you are a Rightsholder: details of the sponsorship opportunities you make available through the Platform;

• communications data sent via the Platform such as messages or other communications sent via the Platform's Connect or messaging feature, and any feedback or correspondence you send to us; and

• payment and subscription information, such as your payment method and subscription fee details

• other personal data about you that you decide to provide e.g. in relation to your feedback on our services.

When you are using our Website or Platform, we collect, generate and process other types of information about you, such as:

• user account credentials - your usernames, account numbers, security codes or passwords when you access our Website, Platform and/or Services;

• contact information - this includes an individual’s email address, telephone and fax number, geo-location, your mobile number, residential, business and postal address and other information that allows us to contact the individual;

• financial information - information such as any bank or credit card details used to transact with us and other information that allows us to transact with the individual and/or provide them with our Services;

• technical information collected from your computer or mobile device when browsing our Website e.g. your IP address, your location (by country, state and city), device type, browser type, operating system; and

• information generated about you through your activity on the Website or Platform, such as how you search and discover sponsorship opportunities, how you compare and analyse proposals, how you track and measure contracted deals, the pages you visit, how frequently you use the Platform, and your saved items and preferences — all of which help us understand how you use the Platform and improve your experience.

We collect information about you from other sources, such as:

• trusted third-party data providers, including YouGov, from whom we receive validated sponsorship-related data in order to provide the Platform's analytics and ROI Confidence features; and

• publicly available information and commercially available sources, including public databases, Google and social media platforms, for example to verify identity or to supplement profile and sponsorship data available on the Platform.

• other users on the Platform, who provide information about you on the Platform.

If you disclose to us (or our service providers) any personal data relating to other individuals, you acknowledge that you have the authority, and where required, have obtained the necessary consent required under the Applicable Privacy Laws before such disclosure.

5. SENSITIVE INFORMATION AND SPECIAL CATEGORIES OF PERSONAL DATA

Sensitive information or special categories of personal data is information about you that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional or trade association, membership of a trade union, details of health, disability, sexual orientation or criminal record.

It is unlikely we need to process such sensitive or special categories of personal data for the purposes of our Website, Platform or Services and it is our policy to only collect your sensitive information or special categories of information where we have a lawful basis such as where it is reasonably necessary for our functions or activities and either you have consented or we are required or authorised under law to do so.

6. HOW WE USE YOUR PERSONAL DATA AND THE LEGAL BASIS ON WHICH WE USE IT

Your personal data may be used by us for the following purposes and lawful bases.

Please note if you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as providing you with a service or products), or we may be prevented from complying with our legal obligations (such as to ensure safety).

If the UK GDPR or EU GDPR applies to you, your personal data may be used by us for the following purposes and lawful bases:

7. USE OF AUTOMATED DECISION-MAKING AND PROFILING

As part of our Platform, we may use artificial intelligence and large language models, to assist brands, rightsholders, and talent in evaluating sponsorship opportunities and making evidence-based decisions. Automated decision-making within the Platform is powered by algorithms designed to process data inputs provided by users and trusted third parties (such as Nielsen, YouGov, and other verified sources). These processes are intended to standardise sponsorship decision-making and provide explainable confidence scores, ensuring that decisions are traceable and defensible.

The logic behind our automation involves applying deterministic rules and formulas to assess and express confidence in sponsorship value creation. For example, our platform may evaluate the compatibility of sponsorship proposals with brand objectives, calculate Value Creation Confidence, or analyse the delivery of sponsorship rights against agreed contractual terms. This enables brands to make informed choices about sponsorship investments while reducing risk and uncertainty.

The use of automation within the Platform is designed to enhance the transparency, fairness, and consistency of sponsorship decisions. The outcomes of these processes may influence a brand’s decision to enter into, renew, or decline sponsorship agreements. For rightsholders and talent, profiling may impact their visibility or attractiveness to potential brand partners based on the evidence and metrics they provide or that are available in the Platform.

UK and EEA

For the purposes of Articles 22B and 22C of the UK GDPR:

• A decision is considered to be based solely on automated processing if there is no meaningful human involvement in the taking of the decision.

• A decision is deemed to be a significant decision in relation to a data subject if it produces a legal effect or has a similarly significant effect on the data subject.

When determining whether there is meaningful human involvement, factors such as the extent to which the decision relies on profiling are taken into account. While automated decision-making is central to the functionality of the Platform, significant decisions are not taken solely on the basis of automated processing without appropriate safeguards in place.

In accordance with Article 22B, we ensure that significant decisions based entirely or partly on the processing of personal data are not taken solely on automated processing unless one of the following conditions is met:

• The data subject has given explicit consent to the processing.

• The processing is necessary for entering into or performing a contract between the data subject and the controller, or is required or authorised by law.

• Where processing involves special categories of personal data (such as data revealing racial or ethnic origin, political opinions, or health data), additional safeguards are in place to ensure compliance with Article 9 of the UK GDPR.

In line with Article 22C, we have implemented robust safeguards to protect the rights, freedoms, and legitimate interests of data subjects when significant decisions are made based solely on automated processing. These safeguards include:

• Providing data subjects with clear and accessible information about automated decisions taken in relation to them.

• Allowing data subjects to make representations regarding such decisions.

• Enabling data subjects to request human intervention in the decision-making process.

• Giving data subjects the ability to contest automated decisions that significantly affect them.

Australia

For the purpose of the AU Privacy Act, the table below summarises information on our automated decision-making programs:

The kinds of personal data used in the automated decision-making program on our Platform: The Sailias platform does not use personal information in its automated scoring processes. The platform uses business information provided by customers, such as sponsorship investment data, partnership objectives, and performance metrics, to measure and attribute sponsorship value.

The kinds of decisions made solely by the automated decision-making program on our Platform: No decisions are made solely by automated programs on the Sailias platform. The platform produces automated scores and assessments that inform human decision-making by our customers. No personal information is used in this process.

The kinds of decisions where an important and direct part of making the decision is carried out by the automated decision-making program on our Platform: The platform uses automated scoring to evaluate sponsorship proposals and investments against attribution and value creation criteria. These scores inform but do not replace human decision-making by our customers. Only business information provided by customers is used in this process — no personal information is collected or used by the automated program to produce these outputs.

We ensure that automated processes are explainable and traceable. Every confidence score or decision within the Platform is linked to the underlying data, the logic applied, and the evidence used, ensuring transparency and accountability.

Automated decision-making and profiling within Alias may impact the visibility of Rightsholders, Talent or Brands, as well as a Brand’s ability to assess the value of sponsorship opportunities. However, the Platform does not make final decisions on behalf of users, as significant decisions remain subject to meaningful human involvement.

If you believe you have been affected by an automated decision or wish to exercise your rights, please contact us at privacy@sailias.com.

8. SAFETY AND SECURITY

Security Measures

We use industry standard security measures to safeguard and protect your personal data from misuse, loss, and unauthorised access, modification and disclosure. Some examples of these measures include:

• adhering to information security compliance programs standards;

• use of multifactor authentication systems to secure services with encryption of all data at rest and in transit;

• restricted access privileges to monitor and control access to our IT systems;

• imposing restrictions on physical access to paper files or secure areas;

• requiring any third parties we engage to provide appropriate assurances to handle personal data in a manner consistent with the Applicable Privacy Laws; and

• taking reasonable steps to securely destroy or de-identify personal data after it is no longer required.

If the AU Privacy Act applies, while we take reasonable steps to maintain the security of our internet connections, for reasons outside our control, information transmitted to us over the internet may not be absolutely secure. You acknowledge that:

• you provide your personal data to us at your own risk, and we assume no responsibility for the disclosure of data due to errors in transmission. Except for our sub-processors, we are not liable for any loss, damage or claim arising out of another person’s use of the personal data where we were authorised to provide that person with the personal data.

Data Breach

If you suspect any misuse or loss of, or unauthorised access, modification or disclosure to, your personal data, you should let us know immediately by contacting us on the contact details set out in Section 2.

If the AU Privacy Act applies to you, where we become aware of any breach to our security systems that breaches or is likely to result in a breach of your rights or freedoms with respect to your personal data, we will notify you and the Office of Australian Information Commissioner (OAIC) of such breach, as required. We will also include recommendations about the steps you should take in response to the breach in our notice to you.

If the UK or EU GDPR applies to you, where we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and we will notify the relevant data protection supervisory authority as required.

9. INTERNATIONAL DATA TRANSFERS

UK and EEA

For individuals in the UK or EEA, the personal data that we collect may be transferred to, and stored at, a destination outside the EEA or the UK, including countries, which offer less protection when compared to those in the EEA or the UK.

As such, if we transfer personal data outside the UK or EEA, we will implement appropriate and suitable safeguards to ensure that such personal data will be protected as required by applicable data protection law.

In these cases, we rely on approved data transfer mechanisms, including legal exceptions, adequacy decisions, recognised frameworks (e.g. the EU-US Data Privacy Framework), and standard contractual clauses. If you are located in the UK or the EEA, you may contact us for a copy of the safeguards and for further information as to the safeguards we implement

Australia

For individuals in Australia, we may share your personal data with our service providers for the purposes set out in Section 6 of this Privacy Policy. This will involve transferring your data outside of Australia.

Whenever we transfer your personal data out of Australia, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or

• where transfers to the EEA or the UK take place, we may (if required by law) use specific contractual clauses approved for use in the UK and EEA which give personal data the same protection it has in the UK and EEA.

We require all third parties to respect the security of your personal data and to treat it in accordance with the Applicable Privacy Law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

10. HOW AND WHEN WE SHARE YOUR PERSONAL DATA

In certain circumstances, we share your personal data with third parties. These third parties belong to the following categories and we only share your personal data certain purposes:

• Other users on the Platform such as:
• A Brand: your organisation's name, industry, sponsorship objectives, and details of your sponsorship portfolio and contracted deals;
• Talent: your name, profile details, NIL rights, ambassador rights, endorsement rights and other information you choose to make available on the Platform; and
• Rightsholder: details of the sponsorship opportunities you make available through the Platform;
• Our service providers such as partners, affiliates, suppliers, sub-processors and sub-contractors for legitimate business interests such as for the performance of any contract we enter into with them (for example: payment services provider)
• Our professional advisers: including accountants, lawyers and other professional advisers that assist us in carrying out our business activities and help us protect our business which is in our legitimate interests.
• Group companies we work closely with: for security, improving our products and services, and internal reporting, based on our legitimate business interests.
• In the context of a transaction: we may share your personal data with potential partners and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business. This is on the basis of our legitimate interests for our business operations and the legitimate interests of third parties such as those in connection with the transaction.
• Government authorities, law enforcement, fraud prevention agencies and relevant third parties: this is on the basis of our legitimate interests for the establishment, exercise or defence of legal claims to protect our business and recognised legitimate interests in detecting, investigating or preventing crime.
• In compliance with applicable legal and regulatory obligations: we may share your personal data with law enforcement agencies, courts, government authorities or other third parties where we believe it is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of a third party.

11. HOW WE KEEP YOUR PERSONAL DATA

We take steps to ensure that the personal data that you provide is retained for only as long as it is necessary in line with our retention criteria taking into consideration: legal obligations, best industry practice, limitation periods, our business needs, and for the establishment, exercise or defence of a legal claim.

Where we have collected the personal data based on your consent and we have no other lawful basis to continue with that processing, you have the right to withdraw your consent.

If the AU Privacy Act applies to you, we will take reasonable steps to destroy personal data or ensure it is de-identified if we no longer need the information for any purpose for which it may be used or disclosed.

12. DEIDENTIFIED DATA

If the AU Privacy Act applies, we may use your personal data in de-identified form (de-identification being a process by which a collection of data or information is altered to remove or obscure personal identifiers and personal data) to assist us in running our business. We may also provide de-identified information in aggregated form, to third parties.

When your personal data is included as de-identified, aggregated data, it is not possible to identify you or anything about you from that data.

13. DIRECT MARKETING

In accordance with the AU Privacy Act and Spam Act 2003 (Cth), if the AU Privacy Act applies to you, we will seek your express consent before sending you any direct marketing materials and commercial electronic messages, which may include information about the Website, Platform and/or Services or other products and services offered by us and/or our carefully selected third party business providers, via telephone, email, SMS, or regular mail.

If you have indicated a preference for a method of communication, we will endeavour to use that method wherever practical to do so.

You may opt out of receiving marketing communications at any time by responding via the channel in which you received the marketing communication, or by contacting us on the contact details set out in Section 2. You can unsubscribe from emails by clicking the unsubscribe link on the footer of the email communication you have received. We may continue to send you non-promotional communications, such as service-related emails, billing information, and certain product updates via email.

However, please note that where you unsubscribe from our marketing communications, we will keep a record of your contact details to ensure we do not send you marketing communications in future.

14. COOKIES

We may use temporary (session) cookies or permanent cookies when you access our Website, Platform and/or Services in accordance with our Cookie Policy accessible here: /cookies. This allows us to recognise your browser and track the web pages you have visited. Some of these cookies also help improve your user experience on our websites, assist with navigation and your ability to provide feedback and assist with our promotional and marketing efforts. You can switch off cookies which are not strictly necessary at any time by adjusting the settings on your web browser or through our cookie settings on our Website, Platform and/or Services.

15. YOUR RIGHTS

You have certain rights in relation to your personal data. These include: the right to object to the processing of your information for certain purposes, the right to access your personal data, and the ability to erase, restrict or receive a machine-readable copy of your personal data.

Where you have provided your consent to any use of your personal data, you can withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights please contact us using the contact details below.

We encourage you to raise your concerns directly with us. To do so, please contact us if you have any questions or concerns regarding your personal data, by e-mail to privacy@sailias.com. If you remain dissatisfied after this process, you may escalate the matter via our complaints procedure by contacting us. During this process we will acknowledge your complaint within 30 days, make enquiries into the complaint without undue delay and make an appropriate level of enquiries.

If after the complaints process, you remain dissatisfied, you may also have the right to complain to a data protection authority if you think we have processed your personal data in a manner which is unlawful or breaches your rights. In the UK the data protection authority is the Information Commissioner’s Office (www.ico.org.uk) and a list of the EU data protection authorities can be found here. In Australia, the data protection authority is the OAIC (www.oaic.gov.au).

If you have such concerns we request that you initially contact us so that we can investigate, and hopefully resolve, your concerns.

Our Website may, from time to time, contain links to and from third party websites and services such as our business partners and advertisers. If you follow a link to any of these websites and/or services, please note that they have their own privacy policies and we do not accept any responsibility or liability for them. Please check any such third party privacy policies before you submit any personal data to these websites or services.

ANONYMITY AND PSEUDONYMITY

Where it is lawful and practicable to do so, you may interact with our Website and/or Platform (and use our Services) anonymously or by using a pseudonym.

If the AU Privacy Act applies, notwithstanding the above, you agree and acknowledge that, we may not be able to provide some Services to you if you do not provide your personal data to us. These products and/services include:

• creating a user account on our Website and/or Platform;
• lodging applications for sponsorships;
• publishing or advertising talent profiles where a person is identifiable; and
• sending sponsorship requests to other users via our Website and/or Platform.

ACCESSING AND UPDATING INFORMATION

If you would like us to update or amend your personal data, please contact us on the contact details set out in Section 2 and we will make the requested amendments.

We may ask you to verify your identity to ensure that personal data we hold is not improperly accessed.

It is important that the personal data we hold about you is accurate and current. We may take reasonable steps to ensure that the personal data we collect, and hold is accurate, up to date and complete. Please keep us informed if your personal data changes during your relationship with us.

CHANGES TO THIS PRIVACY POLICY

We may change this privacy policy at any time. The new privacy policy will be displayed on our Website. The date this privacy policy was last updated appears at the bottom.

This Privacy Policy was last updated on 10 July 2026.