Effective as of: September 1st, 2022.
At TwoYay, the privacy and security of your information is a top priority. We want you to understand how we handle your data. We also want you to know your rights and choices.
- our related social media pages
- our affiliated websites, newsletters, mobile/OTT apps (if any)
- anywhere else we gather information about you and refer to this Policy
For simplicity, we refer to all these services as the "Platform" in this Policy.
How we handle your information depends on which Platform services you use, and how you use them. This Policy explains the types of information we collect when you use the Platform, how we use information, how information is shared with other parties, and your rights and controls over information about you. We encourage you to read this Policy carefully.
The Platform operates from the United States, but can be accessed worldwide. Parts of the Policy apply only to residents of specific areas. California residents should consult theRights Of California Users section. Residents of the European Economic Area ("EEA"), the United Kingdom or Switzerland should consult the sections of this policy relating to the Rights of EEA Residents and International Data Transfers sections.
Barstool Sports, Inc. operates the Platform and is referred to in this Policy as "TwoYay", "we", "our" or "us". By using or accessing the Platform, you signify that you have read, understand and agree to be bound by this Policy. This Policy is effective as of the date listed above.
Information We Collect
Information you give us
You may use many of our websites and apps and interact with their content without providing any information about yourself. However, to use some aspects of the Platform, we will need information about you, such as if you:
- Establish an account
- Make a proposal or enter into a transaction for a campaign
- Contact us or otherwise communicate with us in any way
- Subscribe or opt-in to our newsletters, alerts, or other communications
- Submit content
- Participate in a contest or promotion and/or redeem any prize you may win
When you submit information through the Platform, whether provided to enable a service or disclosed through comments, you are consenting to its collection, use and disclosure in accordance with this Policy.
Please note that if you make a purchase through our Platform, your payment information, like your credit card details, is only collected and processed our payment processing partner(s).
Information collected when you use the Platform
As you use the Platform, we generate technical data about which features you've used, how you've used them and the devices you use to access our services, including:
- (1) "Device Information" relating to the computer or device you use to interact with our Platform, such as your IP address, your advertising IDs (which are randomly generated numbers that you can reset by going into your device's settings, including Apple IDFA or an Android Advertising ID), your browser and operating system, your internet service provider, and your device and browser settings.
- (2) "Usage Data" related to your use of the Platform, such as the pages you visit, the sites you use before or after visiting ours, your actions within the Platform, the content or advertisements you interact with, general location information, time stamps and performance logs and reports.
Information We Receive From Others
From Our Affiliates
We may also help operate certain third-party domains in cooperation with affiliates (such businesses, together with Penn National Gaming, Inc., our "Affiliates"). We may use anonymous, internal identifiers to unify information about your interactions with the Platform and Affiliates' services. We may also receive information about you from our partners where TwoYay ads are published on a partner's service (in which case they may pass along details on a campaign's performance).
From Social Networks
From Cookies And Similar Data Technology
- (1) If you sign up for our text messaging program(s), cookies may be used to personalize your experience (e.g., send you personalized text messages such as shopping cart reminders).
- (2) Finally, although some browsers offer a "do not track" ("DNT") option, no common industry standard for DNT exists. Therefore, we have not configured the Platform to respond to browsers' DNT signals.
How We Use Information
The main reason we use your information is to deliver and improve our content and services. Additionally, we use your info to communicate with you, and to provide you with advertising that may be of interest to you. Here is detailed explanation of the various reasons for which we use your information, together with practical examples:
(1) To provide our content and services to you, including via your account
- Create and manage your account
- Provide you with customer support and respond to your requests
- Complete your campaign proposals and transactions
- Communicate with you about our services
(2) To manage your account or fulfill transactions
- Register you on the services to allow you to purchase goods or services
- Administer your account on new features and apps
(3) To improve our services and develop new ones
- Administer focus groups, market studies and surveys
- Review interactions with customer teams to improve our quality of service
- Develop new content and services
(4) To operate advertising and marketing campaigns
- Administer sweepstakes, contests, discounts or other offers
- Text you, after you have given your consent and only until you withdraw it, about offers, including on a personalized basis.
- Customize advertising to you based on technical data and information about you in deidentified or hashed, non-human readable form
- Perform and measure the effectiveness of advertising campaigns on our services and marketing campaigns off of the Platform
- Communicate with you about products or services that we believe may interest you
(5) To prevent, detect and fight fraud and other illegal or unauthorized activities
(6) To ensure legal compliance
- Comply with legal requirements
- Assist law enforcement
To process your information as described in this Policy, we rely on the following legal bases:
- (1) Provide our services to you: The reason we process your information for purposes 1, 2 and 3 above is to perform the contract that you have with us. For instance, if you order products from us, we use your information to complete the purchase and ship your good. Further, as you discover content on the Platform, we may tailor the content to your interests.
- (2) Legitimate interests: We process your information for purposes 3, 4 and 5 above, based on our legitimate interest. For instance, we analyze users" behavior on our services to continuously improve our offerings, we suggest offers we think might interest you and promote our own services, we process information to help keep our members safe and we process data where necessary to enforce our rights, assist law enforcement and enable us to defend ourselves in the event of a legal action.
- (3) Comply with applicable laws and regulations: We process your information for purpose 6 above where it is necessary for us to comply with applicable laws and regulations and evidence our compliance with applicable laws and regulations. For example, we retain traffic data and data about transactions in line with our accounting, tax and other statutory data retention obligations and to be able to respond to valid access requests from law enforcement.
- (4) Consent: If you choose to provide us with other personal information, including any that may be considered "special" or "sensitive" under applicable law, you"re consenting to our processing of that information in accordance with this Policy. From time to time, we may ask for your consent to collect specific information such as your precise geolocation or use your information for certain specific reasons. In some cases, you may withdraw your consent by adapting your settings (for instance, cookie settings). In any case, you may withdraw your consent at any time by contacting us at the address provided at the end of this Policy.
How Long We Retain Your Information
We retain your information only as long as we need it for our legitimate business purposes (as described under How We Use Information) and as permitted by applicable law.
We want you to be in control of your information, so we want to remind you of the following options and tools available to you:
- (1) Opting Out of Communications
As described above, we may use the information we collect from you to send you newsletters, push notifications, general communications and promotional e-mails, including promotional communications about our Platform and our or our partners' products or services. If you do not want to receive such communications, you can opt out (as applicable) by using the unsubscribe link at the bottom of our communications, unchecking the applicable box to opt out when prompted, or by simply not opting in when prompted. You may also at any time opt out of receiving communications from us by sending an e-mail to firstname.lastname@example.org with the subject line "Opt Out".
- (2) Disallowing Cookies and Location Data Collection
When you access certain services, like some of our apps, through a mobile device, you may be asked to share your precise (GPS level) geo-location information with us so we can customize your experience and the content you receive. You may change location sharing settings for each app at the device level at any time.
- (3) Opting Out of Targeted Advertising
You have a choice about participating in interest-based advertising. If you wish to opt out, you have a few options:
- On your mobile device, you can visit https://youradchoices.com/appchoices to learn about and download the Digital Advertising Alliance's opt-out app, which allows you to opt your mobile device out of interest-based advertising from participating companies.
- Your mobile device settings may allow you to limit the use of information from your device in interest-based advertising through a "Limit Ad Tracking" setting (in an iOS device) or an "Opt Out of Interest-Based Ads" setting (on an Android device).
- You can learn more about advertising networks and interest-based advertising, and your ability to opt out, by visiting the Digital Advertising Alliance at www.aboutads.info/choices or the Network Advertising Initiative at www.networkadvertising.org/choices.
In providing you with transparency and access to choice regarding interest-based advertising, we are acting in accordance with our commitment to the Digital Advertising Alliance's Self-Regulatory Principles. You can learn more about these Principles here.
Rights of EEA Residents
We process the "personal information" (as defined by GDPR) of EEA Residents in accordance with the General Data Protection Regulation (2016/679) of the European Parliament and of the Council of 27 April 2016 ("GDPR"). For the purposes of GDPR in the EEA, the United Kingdom and Switzerland, the data controller is Barstool Sports, Inc., 333 7th Avenue, Floors 2-3, New York, NY 10001.
The purpose and the legal bases for collecting and processing personal information of EEA Residents is described under How We Use Information and Legal Bases. EEA Residents may exercise rights under GDPR as described under Your Right to Access, Review, and Delete Information about You. If you do not provide personal information to us or withdraw consent for processing personal information, we may not be able to provide you with certain aspects of the Platform.
International Data Transfers
If you are resident outside the United States, including in the EEA, we transfer information about you for processing in the United States. Under the GDPR framework, we are considered a "controller" and a "co-processor" of personal data of EEA Residents. By providing information about you to enable Platform services, you consent to the processing of such data in the United States. The transfer of this information to the United States is necessary for the performance of a contract between you and us for your use of the Platform.
When we transfer EEA resident information outside of TwoYay, we use standard contract clauses (standard contractual clauses are commitments between companies transferring personal data, binding them to protect the privacy and security of your data) or another appropriate transfer mechanism. We are currently in the process of reviewing transfers to our vendors and the associated legal bases in response to the recent Court of Justice for the European Union's ruling on transfers of personal data to the United States, as well as the forthcoming Trans-Atlantic Data Privacy Framework.
Please note that the United States does not have data protection laws equivalent to those in the EEA and other jurisdictions.
Rights Of California Consumers
This section describes your rights as an individual or household in California ("California consumers").
- Rights under the California Consumer Privacy Act ("CCPA")
CCPA provides California consumers with additional rights regarding their "personal information" (as defined in CCPA). The categories of information we collect are generally described above, and depend on how you use the Platform.
Under CCPA, California consumers have the following rights:
- (1) Right to Know and Right to Delete.
A California consumer has the right to request that we disclose what personal information we collect, use, disclose and sell. A California consumer also has the right to submit requests to delete personal information.
When we receive a valid request to know or delete from a California consumer, we will confirm receipt of the request within 10 days and provide information about how we will process the request, including our verification process. We will respond to such requests within 45 days.
- (2) Right for Disclosure of Information.
A California consumer may also submit requests that we disclose specific types or categories of "personal information" that we collect.
Under certain circumstances, we will not provide such "personal information," including where the disclosure creates a substantial, articulable and unreasonable risk to the security of that information , customers' account with us, or the security of our systems or networks. We do not disclose California consumers' account passwords and security questions and answers.
- (3) Submitting Requests
If you are a California consumer and would like to make any requests under the CCPA, please contact us as described under Your Right to Access, Review, and Delete Information About You. Your request must provide sufficient information to identify yourself as a California consumer, such as name, e-mail address, home or work address, or other information that is on record with us. Do not provide social security numbers, driver's license numbers, account numbers, credit or debit card numbers, medical information or health information with requests.
- (4) Verifying Requests
We verify requests by first confirming the source of the request and then by matching the information submitted to the information we maintain. If requests are unclear or submitted through means other than outline above, we will provide the requestor with direction on how to remedy the deficiencies. We will use other appropriate measures to verify requests received by mail or telephone.
If we cannot verify the identity of the requestor, we may deny the request.
- Do Not Sell My Info.
If you are a California consumer and would like to opt out of the sale of your Personal Information (as defined under CCPA), please go to this link: Do Not Sell My Info or emailing email@example.com with the subject line "CCPA - Do Not Sell My Info".
- Civil Code Section 1798.83
Because we do only give your information to third parties for direct marketing with your consent, and always give you the right to opt out after opting in, we believe we are not currently required to comply with California Civil Code Section 1798.83.
- California Do Not Track Disclosures
Although some browsers offer a "do not track" ("DNT") option, no common industry standard for DNT exists. Therefore, we have not configured the Platform to respond to browsers' DNT signals.
Your Right to Access, Review, and Delete Information about You
Under certain laws, including as described above with respect to the GDPR and CCPA, you may have the right to: obtain confirmation that we hold information about you, request access to and receive that information, update and correct inaccuracies in that information, object to the continued processing of information about you, and have the information blocked, anonymized or deleted, as appropriate. The right to access may be limited in some circumstances by local law, including as described above under California law. If you qualify, in order to exercise these rights, please contact us as described under How to Contact Us.
We may ask you to provide additional information for identity verification purposes, or to verify that you are in possession of an applicable email account.
Please understand, however, that we reserve the right to retain an archive of any information about you for a commercially reasonable time to ensure that its deletion does not affect the integrity of our data; and we further reserve the right to retain any deidentified data derived from such information.
We may need to change this Policy at any time. The current version of the Policy will remain posted on this area of our Platform with the date such modifications were made. We will inform you of any material changes to this Policy, but please review this Policy from time to time, in case you miss our notification, and so that you are aware when non-material changes are made. If you have any questions about changes to this Policy, please contact us at firstname.lastname@example.org and include "Information Regarding Updated Policy" in the subject line.
Your continued use of the Platform after such change constitutes your acceptance of the then-current Policy, and if you do not accept it, you may choose not to use the Platform.
Children Under 13
The Platform is intended for and targeted to adults. We do not knowingly collect or solicit information directly from anyone under the age of 13. If you are under 13, please do not send any information about yourself to us, including your name, address, telephone number, or email address. In the event that we learn that we have collected information from a child under age 13, we will delete that information as quickly as possible. If you are a parent or guardian of a child under 13 years of age and you believe your child has provided us with information, please contact us at email@example.com.
How to Contact Us
If you have questions or comments about this Policy, please contact us at firstname.lastname@example.org with "Privacy" in the subject line, or write to us at:
- TwoYay c/o Barstool Sports, Inc.
- 333 7th Avenue, Floors 2-3
- New York, NY 10001
- Attn: Legal Department