3. Personal Information We Collect

The information we collect depends on how you interact with TopSpin and which services you use.

3.1 Account and profile information

When an individual registers for a TopSpin360 account, we may collect:

• First name;
• Middle initial;
• Last name;
• Email address;
• Password or authentication credentials;
• Date of birth;
• Gender;
• Account type;
• Organization, where provided;
• Region, including whether the user is located in Canada or the United States; and
• Account preferences and administrative information.

Passwords are used for account authentication. Users should not provide their password to TopSpin by email, through a website form or through a customer-support request.

3.2 TopSpin360 training information

When the TopSpin360 application is used with a TopSpin360 device, we may collect and store information associated with the account or player profile selected at the time of the training session.

This information may include:

• User or player name;
• Account identifier;
• Team or organization name;
• Session date and time;
• Session number;
• Set number;
• Direction of rotation;
• Number of revolutions;
• Revolutions per minute;
• Completion time;
• Rate of force development;
• Training load;
• Training progression;
• Notes;
• Device or program settings; and
• Other measurements generated through use of the TopSpin360 device and application.

TopSpin360 training information is performance and activity information.

The TopSpin360 application does not currently request detailed medical histories, diagnoses, medications, treatment histories or symptom records as part of ordinary account registration or TopSpin360 training.

3.3 Training-session attribution

Training sessions are associated with the account or player profile selected on the phone, tablet or other device when the session is recorded.

TopSpin cannot independently verify the identity of the individual who physically performed a particular training session. For example, a person may use a shared phone or team tablet, select the wrong player profile, or complete a session while another person’s account is active.

Accordingly:

• A recorded session identifies the account or profile to which the session was attributed;
• It does not establish that the named account holder necessarily performed the session;
• Users of shared devices are responsible for selecting the correct account or player profile; and
• Teams and other organizations are responsible for appropriately managing access to shared devices and player lists.

3.4 Website information

When you use a TopSpin website, we may collect information that you voluntarily provide through:

• Contact forms;
• Newsletter registrations;
• Product inquiries;
• Account or support requests;
• Ecommerce transactions;
• Event or course registrations;
• Account-deletion requests; and
• Other website forms.

Depending on the interaction, this may include your:

• Name;
• Email address;
• Telephone number;
• Organization;
• Shipping address;
• Billing information;
• Product interests;
• Order information; and
• Contents of your communication.

Payment information may be processed by a third-party payment provider. TopSpin may not receive or retain complete payment-card numbers.

3.5 Information collected automatically through the website

TopSpin websites may use cookies and similar technologies to operate the website, remember preferences, understand website use, measure advertising effectiveness and improve our services.

Information collected through these technologies may include:

• Internet Protocol address;
• Browser type;
• Device type;
• Operating system;
• Pages viewed;
• Referring website;
• Approximate location derived from an Internet Protocol address;
• Time and duration of website visits; and
• Interactions with website pages, forms or advertisements.

Where required, users may be provided with cookie choices through a cookie banner or similar consent tool.

The TopSpin360 mobile application does not currently use third-party behavioural advertising tools or advertising software development kits.

4. How We Collect Personal Information

We may collect personal information:

• Directly from an individual;
• Through the TopSpin360 application;
• Through a TopSpin360 device;
• Through a team-controlled or organization-controlled phone, tablet or other device;
• From a sports team, clinic, school, university, employer, military organization or other customer;
• Through a TopSpin website;
• Through customer-service communications;
• Through an authorized Team Dashboard administrator; and
• Through service providers acting on our behalf.

On a shared device, a coach, clinician, administrator or other individual with access to the device may add or edit player names or profile information.

TopSpin360 training measurements generally cannot be manually altered after they have been created. Training sessions stored locally on a device may be deleted where the application provides that functionality.

5. How We Use Personal Information

TopSpin may use personal information to:

• Create and administer user accounts;
• Authenticate users;
• Connect the TopSpin360 application with TopSpin360 devices;
• Record and display training sessions;
• Maintain training histories;
• Provide Team Dashboard services;
• Provide customer support and troubleshooting;
• Correct account or technical problems;
• Respond to inquiries and privacy requests;
• Provide requested products, services, courses or programs;
• Process transactions and arrange product delivery;
• Communicate service, security or account notices;
• Administer warranties and customer relationships;
• Analyze use and performance of the TopSpin360 system;
• Provide training guidance or account support to teams and users;
• Identify users or teams who may require additional support;
• Improve the TopSpin360 device, application, Team Dashboard and related services;
• Develop training progressions, benchmarks and reference values;
• Maintain the security and integrity of our systems;
• Investigate suspected misuse, fraud or security incidents;
• Comply with legal requirements;
• Establish, exercise or defend legal rights; and
• Carry out another purpose for which consent has been obtained or that is permitted by law.

TopSpin does not use TopSpin360 mobile-app registration information to send promotional emails or text messages unless the individual has separately requested or consented to those communications.

6. Teams, Organizations and the Team Dashboard

TopSpin360 may be used by sports teams, clinics, schools, universities, employers, military organizations and other organizations.

6.1 Shared team devices

An organization may register and control an iPad, tablet, phone or other shared device. Individuals using that device may select their name or player profile before completing a TopSpin360 training session.

The organization may determine:

• Who is permitted to use the shared device;
• Which names appear on the device;
• Who may add or edit player names;
• Who may access the Team Dashboard; and
• How the organization uses information available through its dashboard.

6.2 Organization-associated accounts

An individual may register a TopSpin360 account using an email address associated with a team or organization.

Where the individual has been appropriately notified and the sharing is authorized, TopSpin may identify training sessions associated with that organization or its email domain and make the relevant sessions available through the organization’s Team Dashboard.

This process may involve an authorized TopSpin representative downloading training information, selecting records associated with the relevant organization and uploading those records to the appropriate Team Dashboard.

6.3 Organization responsibilities

Organizations using TopSpin360 are responsible for:

• Having appropriate authority to provide participant information to TopSpin;
• Providing required privacy notices to participants;
• Obtaining any consent required by applicable law;
• Limiting device and dashboard access to authorized individuals;
• Removing access when an administrator, employee, coach or clinician leaves their role;
• Appropriately managing participant names and profiles;
• Protecting information accessed through their devices and dashboards; and
• Using TopSpin360 information only for lawful and appropriate purposes.

TopSpin may require an organization to confirm that it has provided appropriate notice or obtained appropriate authorization before TopSpin makes identifiable training information available through a Team Dashboard.

7. Disclosure of Personal Information

TopSpin does not sell identifiable personal information.

We may disclose personal information in the circumstances described below.

7.1 Service providers

TopSpin uses PrivIT as a service provider for hosting and administering TopSpin360 account and training information.

TopSpin and PrivIT may store or process information through systems located in Canada or the United States.

TopSpin may also use service providers for:

• Website hosting;
• Ecommerce and payment processing;
• Email delivery;
• Customer support;
• Data storage;
• Information security;
• Professional advice; and
• Other business operations.

Service providers are permitted to process information for the services they provide to TopSpin, subject to their contractual obligations and applicable law.

7.2 Teams and organizations

Where an individual uses an organization-managed device, participates in an organization-associated account arrangement or otherwise authorizes sharing, TopSpin may make relevant training information available to authorized representatives of the organization.

Those representatives may include:

• Coaches;
• Trainers;
• Strength and conditioning personnel;
• Clinicians;
• Team administrators;
• School or university personnel;
• Employers;
• Military personnel; or
• Other individuals designated by the organization.

7.3 Legal and safety disclosures

TopSpin may disclose personal information where we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, legal process, warrant, subpoena or court order;
• Respond to a lawful request from a court, regulator or government authority;
• Investigate fraud, misuse or a security incident;
• Respond to an emergency involving a risk of serious harm;
• Protect the rights, safety or property of TopSpin, a user or another person;
• Enforce an agreement; or
• Establish, exercise or defend a legal claim.

Where legally permitted and reasonably practicable, TopSpin may notify the affected individual before complying with a compelled disclosure.

7.4 Business transactions

TopSpin may disclose personal information as part of a proposed or completed financing, merger, acquisition, sale, reorganization or transfer of all or part of its business or assets.

Where required, TopSpin will use contractual or other safeguards to limit the use and disclosure of information during the transaction.

8. De-identified Information, Analytics and Research

TopSpin may create information that has been aggregated or de-identified so that it cannot reasonably be associated with an identifiable individual.

TopSpin may use properly de-identified or aggregated information for:

• Evaluating the performance and safety of the TopSpin360 device and services;
• Understanding training patterns and progression;
• Developing reference ranges and normative values;
• Product validation and improvement;
• Statistical and scientific analysis;
• Preparing presentations, reports and scholarly publications; and
• Conducting or supporting research approved through TopSpin’s applicable research-review process and, where required, an independent research ethics board.

Before information is treated as permanently de-identified information, TopSpin will take reasonable steps appropriate to the circumstances to reduce the risk that an individual could be identified from the information, either alone or in combination with other information reasonably available to the anticipated user of the data.

Depending on the purpose and nature of the dataset, those steps may include:

• Removing names, email addresses and direct account identifiers;
• Removing or generalizing dates of birth;
• Replacing exact ages with age ranges where appropriate;
• Removing or generalizing exact dates and times;
• Removing or replacing team and organization names;
• Removing or generalizing geographic information;
• Limiting the variables included to those reasonably necessary for the analysis;
• Combining or suppressing small groups or unusual records;
• Removing free-text information;
• Limiting access to authorized personnel or researchers;
• Prohibiting attempts to identify individuals;
• Using confidentiality, data-use or research agreements; and
• Reviewing reports and proposed publications to reduce the risk of identification.

TopSpin will not describe information as permanently de-identified where TopSpin or the intended recipient retains a reasonably available key or other practical means of linking the information to an identifiable person.

Where a research project requires identifiable or coded information, involves linking TopSpin data with other identifiable records, or otherwise falls outside the purposes described in this Privacy Policy, TopSpin will obtain any additional consent, research ethics approval or other legal authorization required before proceeding.

TopSpin may retain properly de-identified and aggregated research information indefinitely.

TopSpin will not attempt to re-identify permanently de-identified information.

TopSpin has not used identifiable information stored through PrivIT for research without separate authorization or an appropriate research arrangement.

9. Consent and User Choices

TopSpin obtains consent where required by applicable law.

The form of consent may vary depending on:

• The sensitivity of the information;
• The reasonable expectations of the individual;
• The context in which the information is collected;
• The purpose for which the information will be used; and
• The relationship between TopSpin, the individual and any relevant organization.

An individual may withdraw consent to an optional use or disclosure by contacting the Privacy Officer, subject to legal, contractual or operational restrictions and reasonable notice.

Withdrawal of consent may affect TopSpin’s ability to provide some or all of the requested services. For example, the TopSpin360 application cannot maintain an identifiable training history without storing information associated with an account or player profile.

Where TopSpin proposes a materially different use or disclosure of identifiable personal information, TopSpin will obtain additional consent where required by law.

10. Children and Young People

TopSpin360 may be used by young athletes, including through team-controlled or parent-controlled devices.

An individual under 13 years of age must not independently create or manage a TopSpin360 account without the consent and involvement of a parent or legal guardian.

A child under 13 may use TopSpin360:

• Through an account created or managed by a parent or legal guardian; or
• Through a shared device or program administered by a team, school, clinic or other organization that has appropriate authority and has obtained any required consent.

Parents and guardians should review this Privacy Policy and supervise the child’s use of TopSpin360.

If TopSpin learns that personal information was collected from a child under 13 without appropriate authorization, TopSpin may suspend or delete the account and associated information.

A parent or legal guardian may contact the Privacy Officer to request access to, correction of or deletion of information associated with their child, subject to appropriate verification of identity and authority.

Organizations that permit minors to use TopSpin360 are responsible for complying with applicable consent, notice and child-privacy requirements.

11. Retention of Personal Information

TopSpin retains personal information only for as long as reasonably necessary to:

• Provide the TopSpin360 services;
• Maintain an account and training history;
• Provide Team Dashboard services;
• Fulfill the purposes described in this Privacy Policy;
• Meet legal, contractual, security or regulatory obligations;
• Respond to privacy or security incidents;
• Resolve disputes; and
• Establish, exercise or defend legal rights.

Account information and identifiable training information may be retained while an account remains active or while the information is reasonably required to provide the services requested by the user or an associated organization.

TopSpin periodically reviews identifiable information and may delete or permanently de-identify information associated with accounts that have been inactive for an extended period.

Where reasonably practicable, TopSpin may provide notice to the account email address before deleting an inactive account.

Temporary CSV files and other identifiable data exports created for account administration, customer support or Team Dashboard preparation will be retained only for as long as reasonably necessary to complete and verify the relevant task.

TopSpin’s operational objective is to delete temporary identifiable exports within 30 days after the relevant task has been completed and verified, unless the file remains reasonably necessary for an active support, administrative or dashboard purpose.

TopSpin may retain limited records for longer where reasonably required for:

• Security investigations;
• Privacy requests;
• Product complaints;
• Warranty administration;
• Transaction records;
• Legal proceedings;
• Regulatory requirements; or
• Establishing, exercising or defending legal rights.

When identifiable personal information is no longer reasonably required, TopSpin will delete it, securely destroy it or permanently de-identify it.

12. Account and Data Deletion

Users may request deletion of their TopSpin360 account and associated personal information at any time.

A deletion request may be submitted by:

• Visiting www.topspin360.com/delete-account; or
• Emailing privacy@topspin360.com from the email address associated with the account.

Deleting the TopSpin360 application from a phone or tablet does not delete the user’s account or information previously uploaded to TopSpin’s systems.

12.1 Verification of deletion requests

To protect users from unauthorized deletion requests, TopSpin may verify a request by sending a confirmation link, message or verification code to the email address associated with the account.

If the requester no longer has access to that email address, TopSpin may request limited additional information reasonably necessary to verify the requester’s identity or authority.

Users should never send their password to TopSpin by email or through the account-deletion form.

12.2 Processing time

TopSpin will normally:

• Acknowledge a deletion request within 10 business days; and
• Complete a verified deletion request within 30 days.

Additional time may be required where:

• The request is unusually complex;
• Information is associated with a shared team device;
• Another organization controls part of the relevant record;
• The request requires coordination with a service provider; or
• Retention is required or permitted by law.

TopSpin will inform the requester if additional time is reasonably required.

12.3 Information deleted

Following verification, TopSpin will delete the user’s account and associated personal information and identifiable training information from TopSpin’s active systems, including the user account and associated data stored through PrivIT.

Where reasonably identifiable and within TopSpin’s control, TopSpin will also delete the user’s information from:

• Active TopSpin-controlled Team Dashboards;
• Temporary CSV exports;
• Working files; and
• Other active administrative copies.

Because TopSpin cannot independently verify who physically performed every session, deletion will apply to identifiable records associated with the verified account or player profile, whether or not TopSpin can confirm who physically performed each training session.

12.4 Limited retention following deletion

TopSpin may retain limited information following a deletion request where retention is reasonably required or permitted for:

• Compliance with law;
• Security or fraud investigations;
• Documenting and responding to the deletion request;
• Resolving disputes;
• Enforcing an agreement;
• Establishing, exercising or defending legal rights; or
• Another legitimate purpose permitted by applicable law.

TopSpin may retain permanently de-identified or aggregated information that cannot reasonably be linked back to the user.

12.5 Backup systems

Deleted information may remain temporarily in secured or access-restricted system backups until those backups are overwritten or expire through the applicable backup cycle.

Information retained solely in a backup will not be accessed or used for ordinary business purposes.

Where a backup is restored, TopSpin will take reasonable steps to ensure that previously completed deletion requests continue to be respected.

12.6 Information held by another organization

Where information was collected through or disclosed to a team, clinic, school, university, employer, military organization or other organization, that organization may retain its own independent copy.

TopSpin will delete information within TopSpin’s control.

TopSpin may coordinate the request with the relevant organization where necessary. The individual may also need to contact that organization directly regarding information independently controlled or retained by it.

13. Access and Correction

An individual may request:

• Confirmation of whether TopSpin holds personal information about them;
• Access to personal information under TopSpin’s control;
• An explanation of how that information has been used or disclosed; and
• Correction of inaccurate or incomplete personal information.

Requests should be directed to the Privacy Officer at privacy@topspin360.com.

TopSpin may require reasonable identity verification before responding.

TopSpin may decline or limit access where required or permitted by law, including where disclosure would:

• Reveal personal information about another individual;
• Reveal confidential commercial information;
• Interfere with a security investigation;
• Be disproportionately difficult or costly to retrieve in the circumstances;
• Reveal information protected by legal privilege; or
• Otherwise be prohibited or restricted by law.

Where TopSpin cannot make a requested correction, TopSpin may record the individual’s requested correction or statement of disagreement where appropriate.

14. Security Safeguards

TopSpin uses administrative, technical and physical safeguards intended to protect personal information against loss, theft and unauthorized access, collection, use, disclosure, copying, modification or destruction.

Depending on the nature and location of the information, safeguards may include:

• Use of PrivIT as the backend platform for TopSpin360 account and training information;
• Restricted administrative access;
• Password-protected accounts;
• Removal of access when an individual no longer requires it;
• Secure transmission and storage measures provided by applicable systems and service providers;
• Device and account security controls;
• Limited access to identifiable CSV exports;
• Confidentiality obligations and expectations for authorized personnel;
• Secure deletion or de-identification procedures; and
• Procedures for responding to suspected privacy or security incidents.

Only authorized TopSpin personnel who reasonably require access for support, troubleshooting, account administration, Team Dashboard administration, privacy compliance or related operational purposes are permitted to access identifiable TopSpin360 information.

At the effective date of this Privacy Policy, access to the PrivIT administrative system is limited to two authorized TopSpin representatives.

No method of electronic transmission or storage is completely secure. TopSpin cannot guarantee that a security incident will never occur, but we will use safeguards that are reasonable and appropriate to the sensitivity and circumstances of the information.

15. Privacy and Security Incidents

TopSpin maintains procedures for responding to suspected losses, unauthorized disclosures or other breaches of security safeguards.

Where an incident occurs, TopSpin may:

• Contain and investigate the incident;
• Secure affected accounts, devices or systems;
• Engage relevant service providers;
• Assess the nature and sensitivity of the information;
• Assess the risk of harm to affected individuals;
• Notify affected organizations or individuals where appropriate;
• Notify privacy regulators or other authorities where required;
• Maintain records required by law; and
• Take corrective steps intended to reduce the risk of recurrence.

16. Third-Party Websites and Services

TopSpin websites may contain links to websites or services operated by third parties.

TopSpin does not control and is not responsible for the privacy, security or content practices of independent third-party websites or services.

Users should review the privacy policy of each third-party website or service they use.

The inclusion of a link does not necessarily indicate that TopSpin endorses the third party or its privacy practices.

17. International and Cross-Border Processing

TopSpin and its service providers may store or process personal information in Canada and the United States.

Personal information processed outside an individual’s province, territory or country may be subject to the laws of the jurisdiction in which it is processed. Courts, law-enforcement authorities, regulators or national-security authorities in those jurisdictions may have lawful access to the information.

TopSpin remains responsible for personal information under its control and uses contractual, organizational or other measures intended to provide an appropriate level of protection when information is processed by service providers.

18. Sale and Commercial Use of Personal Information

TopSpin does not sell identifiable personal information.

TopSpin does not currently sell, license or commercially provide identifiable TopSpin360 account or training information to data brokers or advertisers.

TopSpin may use properly de-identified or aggregated information for the purposes described in this Privacy Policy. TopSpin will not represent information as permanently de-identified where it retains a reasonable and practical means of linking the information back to an identifiable person.

19. Changes to This Privacy Policy

TopSpin may update this Privacy Policy from time to time to reflect:

• Changes to our services;
• Changes to our information practices;
• Changes to our service providers;
• Legal or regulatory developments;
• Security requirements; or
• Business and operational changes.

The revised policy will identify its effective date and last-updated date.

If a change materially expands how TopSpin collects, uses or discloses identifiable personal information, TopSpin will provide notice appropriate to the nature and significance of the change and will obtain additional consent where required by law.

Continued use of a service after a policy update does not replace any express consent required by applicable law.

20. Questions and Complaints

Questions, concerns or complaints about this Privacy Policy or TopSpin’s personal-information practices may be directed to:

Privacy Officer
TopSpin Technologies Ltd.
1673 Richmond Street, Unit 11, PMB 321
London, Ontario N6G 2N3
Canada

Email: privacy@topspin360.com
Telephone: 1.855.578.7360

TopSpin will investigate privacy complaints and respond within a reasonable period.

If an individual is not satisfied with TopSpin’s response, they may have the right to contact the Office of the Privacy Commissioner of Canada or another applicable provincial, state, national or international privacy regulator.