Privacy & Data Sharing Policy

About This Policy

This Data Sharing & Privacy Policy forms part of XENOM's Terms and Conditions. It explains how XENOM collects, uses, stores, and shares your personal data — and the rights you have over it. By registering for any XENOM competition, event, training programme, or platform, you confirm that you have read and understood this Policy.

1. Who We Are

XENOM Inc. is a Delaware corporation and the operator of The Decathlon of Fitness™ — a standardised global fitness competition series. References to "XENOM", "we", "us", or "our" in this Policy include XENOM Inc. and all XENOM-operated competition and training platforms worldwide. Data Controller: XENOM Inc., 809 Broadway – 3rd Floor, New York, NY 10003, United States. Privacy Contact: privacy@xenom.global

2. Data We Collect

We collect the following categories of personal data in connection with your use of XENOM's services: • Identity data: full name, date of birth, gender, nationality • Contact data: email address, telephone number, postal address • Athlete performance data: competition scores, rankings, Elite Performance Index™ (EPI) results, workout times • Registration and transaction data: event registrations, payment records, competition history • Health and fitness data (where voluntarily provided): training preferences, injury disclosures, accessibility requirements • Marketing preferences: opt-in/opt-out records for XENOM and partner communications • Technical data: IP address, device identifiers, browser type, and usage data collected via our website and platforms • Communications data: records of correspondence with XENOM

3. Why We Collect It — Lawful Bases

We only process your personal data where we have a lawful basis to do so: • Administering your competition registration and participation — Performance of a contract (processing entry, scoring, ranking, communicating event logistics) • Operating and improving XENOM's platform and events — Legitimate interests (analytics, safety, fraud prevention, product development) • Sending XENOM marketing communications — Consent / opt-in (newsletters, event announcements, sponsor offers from XENOM) • Sharing your data with Official XENOM Partners for their own marketing — Consent / opt-in (single opt-in at registration covering all current Official Partners) • Publishing competition results and athlete profiles — Legitimate interests / consent (public leaderboards, EPI rankings, media content) • Complying with legal obligations — Legal obligation (tax, regulatory, and anti-fraud requirements)

4. Who We Share Your Data With

We may share your personal data with the following categories of recipients. We only share data that is necessary for the stated purpose, and we require all partners and service providers to protect your data to a standard consistent with this Policy.

4.1 Official XENOM Partners

XENOM enters into official partnership arrangements with third-party organisations across categories including (but not limited to): equipment suppliers, training platforms, nutrition brands, apparel companies, mobility and recovery brands, and media organisations (each, an "Official Partner"). Where you have given your explicit consent at registration, XENOM may share the following data with Official Partners for their own marketing and commercial purposes: • Full name and email address • Competition history and EPI performance data (where relevant to the partner's programme) • General location (city/country) and event attendance history Your consent is always required. XENOM will never share your personal data with Official Partners for their own marketing without your prior consent. At registration, you will be presented with a single, clear opt-in to share your data with Official XENOM Partners as a category. You may withdraw consent at any time by contacting privacy@xenom.global or updating your preferences in your XENOM account. Withdrawal does not affect any sharing that took place before you withdrew consent.

4.2 Event Co-Organisers and Venue Operators

Where XENOM events are co-organised with third parties or hosted at third-party venues, we may share data necessary for event administration (e.g., name, registration status, emergency contact) with those co-organisers and venue operators. These parties act as data processors under contract with XENOM and may not use your data for their own purposes.

4.3 Technology and Platform Vendors

We use third-party software and service providers to operate our registration platform, payment processing, email delivery, analytics, and other functions. These vendors process personal data on our behalf as data processors and are bound by data processing agreements requiring them to maintain appropriate security and only process data on our instructions.

4.4 Sports Governing Bodies and Authorised Series Operators

XENOM is an authorised Partner Event Series. Where required by our agreements with relevant sports governing bodies (including CrossFit, LLC), we may share athlete registration and participation data with those bodies. Where such sharing is for the body's own purposes (not solely XENOM's), we will obtain your consent at registration and will identify the specific body in the consent notice.

4.5 Media, Broadcast, and Content Partners

Competition results, EPI rankings, and athlete performance data may be shared with media partners, broadcasters, and content creators for the purposes of promoting and covering XENOM competitions. Where content featuring identifiable individuals (e.g., video footage, athlete profiles) is shared beyond results and rankings, we will obtain your separate consent.

4.6 Legal and Regulatory Disclosure

We may disclose personal data to courts, regulators, law enforcement agencies, or other public authorities where required by applicable law or where necessary to protect XENOM's legal rights or the safety of any individual.

4.7 Business Transfers

In the event of a merger, acquisition, or sale of all or part of XENOM's business, personal data held by XENOM may be transferred to the acquirer or successor entity. We will notify you of any such transfer where required by applicable law.

5. International Data Transfers

XENOM operates globally. Your personal data may be transferred to, and processed in, countries outside your country of residence, including the United States, the United Kingdom, and EU/EEA member states. Transfers from the UK or EU to the United States or other non-adequate countries are made using Standard Contractual Clauses (SCCs) approved by the relevant authority, supplemented where required by a Transfer Impact Assessment (TIA). We apply appropriate technical and organisational safeguards (including encryption in transit and at rest) to all international transfers. Where a partner or vendor is based outside the UK or EU and processes data on our behalf, we ensure appropriate transfer mechanisms are in place before sharing data.

6. Your Rights

Depending on your location, you have the following rights over your personal data. To exercise any right, contact us at privacy@xenom.global. We will respond within 30 days (or 45 days where permitted by applicable law for complex requests). • Access — Request a copy of the personal data we hold about you. • Correction — Ask us to correct inaccurate or incomplete data. • Deletion (Right to be Forgotten) — Ask us to delete your personal data where we no longer have a lawful basis to hold it. Note: we may retain certain data where required by law or for legitimate business purposes. • Restriction — Ask us to restrict processing of your data in certain circumstances. • Portability — Request your data in a structured, machine-readable format (applies to data processed by consent or contract). • Objection — Object to processing based on legitimate interests. We will stop unless we have compelling grounds that override your interests. • Withdraw Consent — Withdraw any consent you have given at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. • Opt-Out of Sale / Sharing (CCPA) — California residents have the right to opt out of the "sale" or "sharing" of their personal data as broadly defined under the CCPA. Submit requests via privacy@xenom.global. • Complaint — Lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your EU data protection authority).

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law: • Athlete registration and competition data: 7 years from the date of last competition participation • Marketing preference records and consent logs: 3 years from the date of last interaction, or until consent is withdrawn (whichever is earlier) • Financial and transaction records: 7 years (or as required by applicable tax law in the relevant jurisdiction) • Technical and usage data (e.g., logs, analytics): 12 months • Correspondence and support records: 3 years Where data is no longer required, we will securely delete or anonymise it. Anonymised data may be retained indefinitely for statistical and research purposes.

8. Security

XENOM implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure: • Encryption of data in transit (TLS) and at rest • Role-based access controls and multi-factor authentication for systems holding personal data • Regular security assessments of XENOM's own systems and key third-party vendors • Staff training on data protection and information security • An incident response plan governing breach detection, containment, and notification No system is completely secure. If you have reason to believe that your interaction with XENOM has been compromised, please contact us immediately at privacy@xenom.global.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, XENOM will: • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by applicable law) • Notify affected individuals without undue delay where the breach is likely to result in a high risk to those individuals • Notify relevant Official Partners whose data sharing obligations are implicated by the breach within 72 hours of becoming aware • Maintain a record of all breaches, including those that do not require external notification

10. Children's Data

XENOM competitions are open to athletes aged 14 and over. We do not knowingly collect personal data from children under 13 (or under 16 in EU/UK jurisdictions where a higher age threshold applies) without verifiable parental or guardian consent. Where XENOM hosts junior or youth categories, we will: • Obtain verifiable parental or guardian consent before processing any personal data • Provide age-appropriate privacy notices to both the young athlete and their parent or guardian • Restrict profiling, behavioural advertising, and any non-essential processing in respect of data relating to individuals under 16

11. Cookies and Tracking Technologies

Our website and registration platform use cookies and similar tracking technologies. A separate Cookie Policy is available at xenom.global/cookies. You may manage your cookie preferences at any time via the cookie settings link on our website.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or our partner network. Where changes are material, we will notify you by email or via a prominent notice on our website at least 14 days before the change takes effect. Continued participation in XENOM events or use of our platform after the effective date of any change constitutes acceptance of the updated Policy.

13. Contact Us

For any questions, concerns, or requests relating to this Policy or your personal data, contact: Data Privacy Team XENOM Inc. 809 Broadway – 3rd Floor New York, NY 10003 United States Email: privacy@xenom.global Website: www.xenom.global If you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority.

Also see our Terms of Service and Cookie Policy.

privacy@xenom.global