March 14, 2023

DRAFTKINGS HORSE - OUR COMMITMENT TO PRIVACY

DraftKings strives to offer sports fans the most entertaining experiences found anywhere on the Internet. To ensure the trustworthiness of our services and the quality of your experiences, we collect and process information about our users. We are committed to handling your information with respect because your privacy is important to us. DK Horse LLC (“DK HORSE,” “DK,” “we,” “us,” or “our”) provides this privacy notice to explain how we collect and use information about users of the website located at www.DKHorse.com ("Website”), mobile applications ("Applications"), and wagering services provided by Churchill Downs Technology Initiatives Company (“CDTIC”) (collectively, "Services"), as well as services that DK may provide to you. This privacy notice does not apply to websites, applications, or services that do not display or link to this notice or that display or link to different privacy statements. This notice does not apply to other products or services offered by DraftKings or its affiliates, including, without limitation, DraftKings’ Daily Fantasy Sports, Sportsbook, Casino, and Marketplace websites, applications, and services. 


By using the Services, you consent to this notice. In the event you object to the collection, use, and disclosure practices described in this notice, you may not use the Services. In the event you are a California or Virginia resident, please see Sections 11 and 12 below for additional information regarding your privacy rights. 


TABLE OF CONTENTS
1. RELATIONSHIP WITH CDTIC
2. THE PERSONAL INFORMATION WE PROCESS
a. Information You Provide
b. Information Collected Via Technology
c. Information Collected From Other Sources
3. INTERACTION WITH THIRD-PARTY SITES AND SERVICES
4. ADDITIONAL USES OF PERSONAL INFORMATION
5. ADDITIONAL DISCLOSURES OF PERSONAL INFORMATION
6. SECURITY AND RETENTION OF PERSONAL INFORMATION
7. YOUR RIGHTS AND CHOICES REGARDING PERSONAL INFORMATION
8. RESPONSE TO DO NOT TRACK SIGNALS
9. CHILDREN
10. INTERNATIONAL USERS & PRIVACY RIGHTS
11. CALIFORNIA PRIVACY RIGHTS
12. VIRGINIA PRIVACY RIGHTS 
13. HOW TO CONTACT US
14. CHANGES AND UPDATES TO THIS PRIVACY NOTICE 

1. RELATIONSHIP WITH CDTIC 

DK HORSE has partnered with CDTIC to offer pari-mutuel wagering on horse races through the Services. The Services are operated by CDTIC with a license to use the “DraftKings,” “DK HORSE,” and/or “DraftKings Horse” brand. While DK may facilitate your access to the Services and provide you certain marketing, customer support, responsible gaming, VIP, and other services from time to time, by accepting this privacy notice you acknowledge and agree that the Services are performed by CDTIC. 


To provide you with the Services, CDTIC needs to collect and use your personal information. Personal information is information from which you can be directly or indirectly identified, such as your name, address, email address, phone number, payment card and financial account information, billing information, driver’s license number, Social Security number, and certain online identifiers. As part of the relationship between CDTIC and DK, we may collect and use personal information CDTIC processes about you in connection with CDTIC’s operation of the Services. CDTIC’s personal information collection, use, and disclosure practices are explained in its privacy policy available at https://www.churchilldownsincorporated.com/privacy-policy/ (“Privacy Policy”). 


By registering for and using the Services, you direct CDTIC to transfer your personal information to DK Horse for the purposes described in the Privacy Policy and this privacy notice. You acknowledge and agree that DK has no responsibility or liability for any collection, use, storage, retention, or disclosure by CDTIC of such personal information, including in the event CDTIC performs (or fails to perform) any act or omission involving your personal information related to CDTIC’s performance of the Services.


2.      THE PERSONAL INFORMATION WE PROCESS

a. Information You Provide

By using the Services, you may choose voluntarily to provide your personal information to CDTIC and DK, including the categories of information described in CDTIC’s Privacy Policy. As detailed in the Privacy Policy, this information may include your name, username, email address, mailing address, geolocation data, phone number, date of birth, Social Security number, other government-issued identification numbers and information, photograph, IP address, device and online identifiers, cookie/pixel data, payment card and financial account numbers and information, tax information, and other personal information. 


We may use your personal information to perform marketing, advertising, customer support, responsible gaming, and VIP services and for other reasons described below. 

b. Information Collected Via Technology

Information Collected by the Services. In order to improve, personalize, and optimize the Services and meet its legal obligations, DK and/or CDTIC may automatically track certain information about your visits to and usage of the Services, including your browser type, operating system, Internet protocol (IP) address, device identifier, domain name, clickstream data, referring/exist pages, geolocation data, and a date/time stamp for your visits. DK and/or CDTIC may also use this information to analyze trends, administer the Services, gather demographic information about our user base, deliver advertising, perform research, provide technical and customer support, inform our product development efforts, protect our legal rights, address disputes, and prevent the Services from being used to commit harmful or unlawful activities, including fraud. Some of this information may also be collected so that, when you use the Services again, DK and/or CDTIC will be able to recognize you and optimize your experience accordingly.


Device Information. DK and/or CDTIC may collect information about the devices you use to access the Services, including the hardware models, operating systems and versions, software, file names and versions, preferred languages, unique device identifiers, advertising identifiers, serial numbers, device motion information, and mobile network information. In the event you have downloaded the Application(s), DK and/or CDTIC may also collect certain information from your mobile device, including information about how you use the Application(s). This information is generally used to help deliver relevant information to you and to detect and prevent fraud and other unlawful activity. In the event the Application crashes on your mobile device, DK and/or CDTIC will also receive information about your mobile device model, software version, and device carrier, which allows us to identify and fix bugs, provide other technical support, and improve and optimize the performance of the Applications.


Cookies. Like many online services, DK and/or CDTIC may use “cookies” to collect technical information. Cookies are pieces of information that a website sends to your computer’s hard drive while you are viewing a website. DK and/or CDTIC may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience of the Services. DK and/or CDTIC may use cookies to collect information about your IP address, browser type, operating system, device type and identifiers, platform type, as well as your usage of and activity on the Website and Applications and the performance of the Services. These types of information are collected to make the Website and Applications more useful to you and to tailor your online experience to meet your interests and expectations. You can use the options in your web browser to notify you when you receive a cookie or you may change your cookie preferences in your internet browser or with third parties. You can control and/or delete cookies used by the Services at any time. You can delete all existing cookies on your computer and adjust settings for most browsers to prevent cookies from being received.


Pixel Tags. In addition, DK and/or CDTIC may use "pixel tags" (also referred to as clear gifs, web beacons, or web bugs). Pixel tags are tiny graphic images with a unique identifier, similar in function to cookies, that are used to track online movements of web users. In contrast to cookies, which are stored on a computer’s hard drive or web browser, pixel tags are embedded invisibly in web pages. Pixel tags are often used in combination with cookies, to trigger the placing of cookies, and/or to transmit information to us or our vendors. This enables two websites to share information. The resulting connection can include information such as a device’s IP address, the time a person viewed the pixel, an identifier associated with a browser or device, the type of browser being used, and the URL of the web page from which the pixel was viewed. Pixel tags also allow CDTIC and/or DK to send email messages in a format that users can read, indicate whether emails have been opened, and help to ensure CDTIC and/or DK send messages that may be of interest to users of the Services. CDTIC and/or DK may also use information collected through pixel tags to reduce or eliminate messages sent to a user.


Collection of Data in Connection with Marketing and Advertising. We may use certain vendors to serve ads on the Services, as well as on other websites, applications, and social media networks. In connection with the delivery of advertising, certain vendors, including, but not limited to, Facebook, FantasyPros, LiveRamp, Reddit, Snapchat, TikTok, The Trade Desk, TruSignal, and Twitter, may collect information about you and your visits to the Website and Applications and other websites and applications. That information may include your IP address, internet service provider, unique personal identifiers (e.g., email address), and the browser you use to visit the Website and Applications and other websites and applications. They may do this by using cookies, pixel tags, or other technologies. The information collected may be used, among other purposes, to deliver advertising targeted to your interests and to better understand your usage of, preferences on, and visitation of the Services as well as other sites, social media networks, and applications tracked by such vendors. This notice does not apply to, and we are not responsible for, cookies, pixel tags, and other technologies used in connection with other parties’ ads, and we encourage you to check the privacy policies of advertisers and ad services to learn about their use of such technologies. In the event you would like more information about these practices to understand your options for not having your information collected and used by such companies, please click http://www.aboutads.info/choices and https://www.networkadvertising.org/.  We may also display interest-based ads, sometimes referred to as personalized or targeted ads, using the information you make available to us when you interact with the Services.


Measurement Data and Third-Party Analytics. We use a number of vendors and service providers, such as, but not limited to, Google, Hulu, and Roku to help analyze and measure how people use the Services ("Analytics Companies"). Analytics Companies may use cookies, pixel tags, and other technologies to collect information pertaining to how people use the Services, what pages they visit, and what other sites they may have used prior to using the Services. We may use the information we get from Analytics Companies to improve and optimize the Services and to measure the effectiveness of our ads.


Referral Affiliates. We may enter into agreements with companies that refer users to the Services via hyperlinks available on the referring party’s website. CDTIC and/or DK may automatically collect certain information, such as your IP address, other identifiers, and the identity of the referring website via cookies, pixel tags, and other technologies that are provided to use in connection with your use of the referring party’s website.

c. Information Collected from Other Sources

We may supplement the information we have collected about you with information received from other sources including, but not limited to, from our pages on certain social networking sites, the social networking sites themselves, and from commercially available sources (e.g., data brokers and public databases). Your activity on other websites and applications may be associated with your personal information in order to improve and customize the Services and the ads delivered on the Website and Applications. The information we collect may include demographic data such as age, gender, and income level, your preferences, interests, associations, photos, commercial information (including, but not limited to, records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies), as well as information regarding your interaction with various websites and applications, including, but not limited to, the Services. This information is used to create and deliver advertising, improve and optimize our marketing efforts and perform VIP services.

 
3. INTERACTION WITH THIRD-PARTY SITES AND SERVICES

Certain products, services, or other materials displayed on the Website and Applications may integrate with, be integrated into, or be provided in connection with certain third-party services and content. Neither DK nor CDTIC controls those third-party services and content, and the terms of use for the Services, the Privacy Policy, and this privacy notice do not apply to those services and content. You should read the terms of use agreements and privacy policies that apply to such services and content. We are not responsible for the practices used by any third-party websites or services linked to or from the Website or Applications, including, but not limited to, the information or content contained within them. By using the Services, you acknowledge and agree that we are not responsible for and do not have control over any third-party services and content that you authorize to access the information you provide to them. In the event you are using a third-party website or service and allow it to access your personal information, you do so at your own risk.

4. ADDITIONAL USES OF PERSONAL INFORMATION

Creation of Aggregated, Anonymous or De-Identified Data. We may create aggregated, anonymized, or de-identified data (i.e., data that is not reasonably capable of being associated with or linked to you) from personal information we collect about you. We use such data to analyze request and usage patterns so that we may improve, optimize, or enhance our services and improve users’ experience with and ability to navigate the Website and Applications. We reserve the right to use aggregated, anonymized or de-identified data for any purpose and disclose it to third parties for any reason.


Responsible Play. As part of our commitment to responsible play, we may use the information collected about you to assess whether you are responsibly playing on the Website and Applications. In the event we identify potentially problematic information, we may reach out to you to provide resources to help ensure that you are playing responsibly. By using the Services, you consent to our use of your information for these purposes.     

5. ADDITIONAL DISCLOSURES OF PERSONAL INFORMATION

In addition to the disclosure practices discussed above, we may disclose your personal information as follows:


Service Providers. We may share your personal information with certain third-party vendors to: provide you with marketing, advertising, customer support, responsible gaming, VIP, and other services; conduct quality assurance testing; provide technical and customer support; personalize, customize, and improve your use and experience of the Services; send email and notifications; send you newsletters, surveys, messages, and promotional materials related the Services or on behalf of other companies; deliver you customized or personalized content, information, and advertising; understand when users have installed the Applications; request user feedback; send users links to download the Applications; manage search engine optimization; and improve and optimize the performance of our marketing, advertising, customer support, VIP, responsible gaming, and other services. 


Professional Financial and Legal Advisers. From time to time, we may also need to share your information with professional advisers, including lawyers, auditors, bankers, insurers, and consultants, in order to obtain advice or other professional services from them. Such advisers are bound by legal and/or contractual duties of confidentiality and other prohibitions against disclosure of personal information.


Co-Branded Companies. “Co-Branded Companies” are entities with whom we may jointly offer a service or feature. You can tell when you are accessing a service or feature offered by a Co-Branded Company because the Co-Branded Company’s name will be featured prominently. You may be asked to provide information about yourself to register for a service offered by a Co-Branded Company. In doing so, you may be providing your information to us and the Co-Branded Company, or we may share your information with the Co-Branded Company. Please note that the Co-Branded Company’s privacy policy may also apply to its use of your information. We are not responsible for the practices of Co-Branded Companies. In addition, by using the Services, you acknowledge and agree that we are not responsible for and do not have control over any Co-Branded Companies.


DK Promotions. When you participate in a wagering offer, transaction, or other promotion in your use of the Services, we may use your name, likeness, voice, opinions, and biographical information for publicity, advertising, trade, or promotional purposes without further payment, consideration, notice, or approval.



Corporate Affiliates. We may share some or all of your personal information with our corporate affiliates, including, but not limited to, our subsidiaries, joint ventures, and other companies under a common control ("Affiliates"), in which case we will require our Affiliates to respect this notice.


Corporate Restructuring. We may share some or all of your personal information in connection with or during negotiation of any merger, financing, acquisition, corporate divestiture, dissolution transaction, or other proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy, or receivership, your personal information may also be transferred as a business asset.


Other Disclosures. Regardless of the choices you make regarding your personal information (as described below), we may disclose personal information in the event we, in good faith, believe that such disclosure is necessary: (i) to comply with relevant laws or to respond to discovery requests, subpoenas, or warrants served on us; (ii) in connection with any legal investigation; (iii) to protect or defend the rights or property of DK and/or CDTIC or users of the Services; (iv) to investigate or assist in preventing any violation or potential violation of law; or (v) in the event we believe that an emergency involving the danger of death or serious injury to any person requires or justifies disclosure of information.

6. SECURITY AND RETENTION OF PERSONAL INFORMATION

The security of your information is important to us. We use reasonable administrative, technical, and physical procedures, practices, and safeguards designed to protect personal information we collect from unauthorized access, use, alteration, exfiltration, or destruction. We will keep your information for only as long as it is needed to achieve its purpose or meet our legal obligations, including, but not limited to, any legally required retention periods, after which we will make commercially reasonable efforts to dispose of it in accordance with our records retention policy and schedule. We make concerted, good faith efforts to maintain the security of your information. Although we work hard to ensure the integrity and security of our systems, it must be recognized that no information system is 100% secure and, therefore, we cannot guarantee the security of such information. Outages, attacks, human error, system failure, unauthorized use, or other factors may compromise the security of user information at any time.
You can also play a role in protecting your personal information. To protect your personal information while using the Services, we strongly suggest that you do not share your account information and that you adhere to the following password practices:
• Use a strong password that is at least ten (10) alphanumeric characters long, and contains upper and lower-case characters, numbers, punctuation marks, and special characters such as !@#$;
• Use a password that is not easily guessed and is not a word in any language, slang, or is based on personal information such as a family name;
• Treat your password as confidential and do not disclose it to anyone else;
• Do not write down your password;
• Do not store your password online in unencrypted form;
• Change your password every three (3) months; and
• Choose a password that is unique, not one that you use for any other website or application.

7. YOUR RIGHTS AND CHOICES REGARDING PERSONAL INFORMATION

Email Communication. We will periodically send you free newsletters and emails that contain information about the Services or other products and services we feel may be of interest to you. At any time you can easily indicate your preference to stop receiving such communications from us, and you may opt out of receiving further marketing from us by emailing us at DKHorsePrivacy@draftkings.com or by following the unsubscribe instructions provided in the email you receive. Despite your indicated email preferences, we may send you transactional and service-related communications, including but not limited to notification of updates to this privacy notice.


Advertising Alliances Opt-out. In addition to adjusting the appropriate settings in your browser, many advertising companies that may collect information for targeted advertising purposes are also members of the Digital Advertising Alliance or the Network Advertising Initiative. Both of these organizations provide directions on how you can opt-out of targeted advertising by their members. You can find more information on these capabilities at www.aboutads.info and www.networkadvertising.org. 


Accessing Your Personal Information. You may also request access to personal information that we have collected about you during the past twelve (12) months (or during a longer period in the event required by applicable law) by contacting us as specified below. Where technically feasible, you may request a portable copy of your personal information in a readily usable format.


Requests To Delete Your Personal Information. You may request deletion of certain personal information we maintain about you, and we will use commercially reasonable efforts to honor your request, but please note that we may be legally or otherwise required to retain such information and not delete it for a certain time, in which case we will make reasonable efforts to comply with your deletion request only after we have fulfilled such requirements. When we delete information, it will be deleted from the active database but may remain in our archives. We may also retain your information based on our legal rights or obligations.

 

Correcting Your Personal Information. We take reasonable steps to ensure that the information we maintain about an individual is complete, up-to-date, and accurate, consistent with the requirements of applicable privacy laws. However, you also have a responsibility to inform us in the event any of your personal information that we hold is incorrect, incomplete, outdated, or inaccurate.  In the event you at any time believe that personal information we hold about you is incorrect, incomplete, outdated, or inaccurate, you may request that we correct such personal information. 


How To Submit Requests to Access, Delete, or Correct Your Personal Information. You may submit a request to access, delete, or correct your personal information by emailing us at DKHorsePrivacy@draftkings.com. Please note that we may deny or fulfill a request only in part based on our legal rights and obligations. In the event we deny a request or part of a request, we will provide information about the reason for the denial. By registering for and using the Services, you consent to DK disclosing to CDTIC any privacy request you send to DK so that it may be separately actioned by CDTIC in accordance with its Privacy Policy. 

 

Verification. When we receive a privacy rights request, we will take reasonable steps to verify the identity of the requestor in accordance with applicable law. In the event the requestor has a password-protected account on the Services, we may verify their identity through our existing authentication practices and may require the requestor to re-authenticate before disclosing, correcting, or deleting their data. In the event a requestor does not have a password-protected account, we will take reasonable steps to verify their identity in accordance with applicable law prior to responding to a request. The verification steps may vary depending on the sensitivity of the personal information and the region where the requestor is located. In the event we cannot verify a requestor’s identity using these methods, we may use an appropriate third-party verification service. 


Opt-Out of Targeted Advertising and the Sale or Sharing of Personal Information.
As described above, we and certain other companies may place tracking technologies on the Website and Applications, which allow us and such companies to receive information about your activity on the Website and related Services associated with your browser or device. You may request to opt out of the disclosure of your personal information to third parties for non-required purposes by clicking the Do Not Sell or Share My Personal Information link in the footer of the Website and following the instructions on the page that appears. Please also keep in mind that your cookie and tracking tool preferences are specific to the device, website, and browser you are using to access the Website and may be deleted when you clear your browser’s cache. For purposes of this Section, “sell” means, subject to certain exceptions in applicable law, the sale, rental, release, disclosure, dissemination, availability, transfer, or other oral, written, or electronic communication of your personal information to an outside party for monetary or other valuable consideration; and “sharing” means, subject to certain exceptions in applicable law, disclosure of personal information to third parties for cross-context behavioral advertising (as defined in the California Consumer Privacy Act) or targeted advertising (as defined in the Virginia Consumer Data Protection Act). In the event you do not have an account or are not logged into your account when you make an opt-out selection, your request to opt out of sale or sharing will only be linked to your browser identifier and not linked to any account information because the connection between your browser and the account is unknown to us. Please note that after you opt out of the sale or sharing of your personal information, your use of the Services may still be tracked by CDTIC and/or DK.


Applications. You may stop all collection of information by the Applications by uninstalling the Applications. You may use the standard uninstall processes as may be available as part of your mobile device or via the mobile application marketplace or network. 

8. RESPONSE TO DO NOT TRACK SIGNALS

Various browsers, including, but not limited to, Firefox, Internet Explorer, and Safari, currently offer a “Do Not Track” or “DNT” option that relies on a technology known as a DNT header, which sends a signal to websites visited by the user about the user’s browser DNT preference setting. Please note that, at this time, we do not honor “DNT” signals or other mechanisms that may allow you to opt out of the collection of information across networks of websites and online services, as there is no standard for how online services should respond to such signals. As standards evolve, we may develop policies for responding to DNT signals that would be described in future versions of this notice. For more information on DNT options, please visit www.allaboutdnt.org.

9. CHILDREN

The Services are not directed toward individuals under the age of eighteen (18), and we require that such individuals under the age of 18 not provide us with personal information. We do not knowingly collect or maintain personal information from anyone under the age of 18 through the Services. In the event we become aware that a person under 18 has provided us with personal information through the Services, we will make commercially reasonable efforts to delete the information from our files, unless we are required to retain it under applicable law or legal process. In the event you are the parent or legal guardian of a person under 18 who you believe has provided personal information through the Services, please contact our privacy team at DKHorsePrivacy@draftkings.com.

10. INTERNATIONAL USERS 

The Website and Application(s) are hosted in the United States and are intended for and directed to users in United States jurisdictions in which the Services are legal and offered. If you are a user accessing the Services from the European Union, United Kingdom, Asia, or any other region with laws or regulations governing personal data collection, use, and disclosure that differ from United States laws, please be advised that through your continued use of the Services, which are governed by U.S. law, this notice and the terms of use, you are transferring your personal information to the United States and you consent to that transfer. The Website and Applications are not intended to subject us to the laws or jurisdiction of any state, country or territory other than those of the United States. Your information may be stored and processed in any country where we have facilities or in which we engage service providers and, by using the Services, you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have different data protection rules than those of your country.

11. CALIFORNIA PRIVACY RIGHTS

California Consumer Privacy Act

California residents (“CA Consumers”) have certain rights concerning their personal information, including under the California Consumer Privacy Act (“CCPA”). This section supplements the preceding sections of this privacy notice by describing CA Consumers’ additional rights with respect to their personal information and explaining how to exercise such rights. As described in more detail above, we may collect and use the following categories of personal information for the business and commercial purposes described in this privacy notice:
• Identifiers, including, but not limited to, real name, username, postal address, email address, telephone number, and government-issued identification numbers; 
• Information included in customer records as described in subdivision (e) of California Civil Code Section 1798.80, including, but not limited to, profile photos; payment card and financial account information;
• Demographic information and characteristics of protected classifications under California or federal law, including, but not limited to, date of birth and age;  
• Commercial information, including records of products or services purchased, obtained, or considered;
• Employment information;
• Education information;
• Internet or other electronic network activity information, including, but not limited to, information on users’ interaction with the Services and other companies’ websites and applications, including, but not limited to, information on preferences, usage, communications, subscriptions, usernames, associations, likes, and public profile information; 
• Geolocation information; and 
• Inferences drawn from the information described above. 

We may collect this personal information from the categories of sources described in this privacy notice. We may disclose the above-referenced categories of personal information for our business and/or commercial purposes to the extent permitted by applicable law with the categories of parties described in Section 3 and Section 4 of this notice.
Based on our advertising and marketing practices, we may share the following categories of personal information: online identifiers (such as IP addresses, advertising identifiers, cookie identifiers, and pixel tags), email addresses, names, general demographics, and certain commercial information. We may disclose these categories of personal information to the categories of parties described in Section 3 and Section 4 of this notice, including advertisers and marketing entities, Analytics Companies, and SNS. 
From time to time, we may collect personal information in connection with a promotion, offer, program, or discount. The offers and incentives made available through them are generally related to the value of the relationships that we have with the individuals who participate. Participation is voluntary, and you may withdraw at any time by emailing us using the information set forth in Section 14.

Sensitive Personal Information Processing. 

We and/or our service providers may process the following categories of sensitive personal information as necessary to provide DK’s services and for permitted business purposes: credit or debit card numbers; financial account numbers; government-issued identification numbers (such as driver’s license, Social Security, and passport numbers); precise geolocation; and username and password.

Right to Know and Access Personal Information Collected, Used, Shared, or Sold.

As described in this Section 12, CA Consumers have the right to request access to personal information we collect about them. The CCPA provides more details on the requests CA Consumers can make. CA Consumers have the right to request that we disclose the following information for the period covering at least the twelve (12) months preceding their request:

• the categories of personal information we collected about you;
• the categories of sources from which we collected personal information about you;
• the categories of personal information that we have disclosed about you for our business purposes and the categories of suppliers to whom the personal information was disclosed;
• the categories of personal information that we sold to third parties and the categories of third parties to whom the personal information was sold, if any;
• the business or commercial purpose(s) for which personal information about you was collected, shared, or sold; and
• the specific pieces of personal information we collected about you.


Right to Correct Inaccurate Personal Information.

CA Consumers have the right to request that we correct inaccurate personal information we maintain about the CA Consumer, as described in Section 7.


Right to Request Deletion of Personal Information.

CA Consumers have the right to request that we delete the personal information we maintain about them, subject to certain exceptions, as described in Section 7.

Right to Opt-Out of the Sale or Sharing of Personal Information.

CA Consumers have the right to opt-out of a business’s sale or sharing of their personal information. See Section 7 for details on submitting a request to opt-out of the sale or sharing of your personal information. We do not knowingly sell or share the personal information of individuals under 18 years of age.

     Right to Non-Discrimination for Exercising Privacy Rights.

DK will not discriminate against CA Consumers for exercising their rights under the CCPA or other applicable privacy laws. We will not do any of the following based on a CA Consumer’s exercise of their rights under the CCPA:
• Deny the CA Consumer goods or services;
• Charge the CA Consumer different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Provide the CA Consumer with a different level or quality of goods or services;
• Suggest that the CA Consumer may receive a different price or rate for goods or services or a different level or quality of goods or services; or  
• Retaliate against an employee, applicant, or independent contractor who exercises their rights under the CCPA.


How To Request Access, Deletion, or Correction.

You may submit a request to access, delete, or correct your personal information by emailing us at DKHorsePrivacy@draftkings.com.  Please review Section 7 for more information. By registering for and using the Services, you consent to DK disclosing to CDTIC any privacy request you send to DK so that it may be separately actioned by CDTIC in accordance with its Privacy Policy.            


Designating an Authorized Agent to Submit Privacy Requests.

CA Consumers may use an authorized agent to submit requests to access, delete, or correct their personal information. An authorized agent is a person or entity registered with the California Secretary of State that a CA Consumer has authorized to act on their behalf. In the event you choose to submit a privacy request to us through an authorized agent, we may require that you provide the agent with written permission to do so and that the agent verify their own identity with us. In the event your privacy request is submitted by an agent without proof that they have been authorized by you to act on your behalf, we may deny the request. 


“Shine the Light” Law.

A CA Consumer who has provided personal information to a business with whom they have established a business relationship for personal, family, or household purposes is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. In general, in the event the business has made such a disclosure of personal information, upon receipt of a request from a CA Consumer, the business is required to provide a list of all third parties to whom personal information was disclosed in the preceding calendar year, as well as a list of the categories of personal information that were disclosed.
However, under the law, a business is not required to provide the above-described lists in the event the business adopts and discloses to the public (in its privacy notice) a policy of not disclosing CA Consumer’s personal information to third parties for direct marketing purposes unless the business gives users a mechanism to opt out of having their personal information disclosed to third parties for direct marketing purposes. Rather, the business may comply with the law by notifying the CA Consumer of their right to prevent disclosure of personal information and providing a cost-free means to exercise the right.
We have opted for this alternative approach. As stated in this notice, we give CA Consumers a mechanism to opt out of having their personal information disclosed to third parties for direct marketing purposes. Therefore, we are not required to maintain or disclose a list of third parties that received your personal information for marketing purposes. In the event you wish to opt out of sharing your personal information with third parties for direct marketing purposes, please email us at DKHorsePrivacy@draftkings.com with “Opt Out” in the subject line or body of your request.

12. VIRGINIA PRIVACY RIGHTS 

Virginia Consumer Data Protection Act. 

Virginia residents (“VA Consumers”) have certain rights concerning their personal information under the Virginia Consumer Data Protection Act (“VCDPA”). This section supplements the preceding sections of this notice by describing VA Consumers’ additional rights with respect to their personal information and explaining how to exercise such rights, all of which are subject to applicable exceptions.


Sensitive Personal Information Processing. 

We and/or our service providers may process the following categories of sensitive personal information: precise geolocation; citizenship and/or immigration status. 


Right to Request Access, Deletion, and Correction.

VA Consumers have the right to request that we confirm whether or not we are processing their personal information and request access to, correction of, and deletion of their personal information. You may submit a request by emailing us at DKHorsePrivacy@draftkings.com.  Please see Section 7 above for more information, including applicable verification requirements and limitations. By registering for and using the Services, you consent to DK disclosing to CDTIC any privacy request you send to DK so that it may be separately actioned by CDTIC in accordance with its Privacy Policy. 


Right to Opt-Out of Targeted Advertising.

We may use personal information obtained from VA Consumers’ activities across unaffiliated sites to target more relevant advertising to you. VA Consumers have the right to request that we stop using their personal information for such targeted advertising. See Section 7 for information on how to opt-out of sharing data with third parties for such purposes. 


Right to Appeal.

VA Consumers have the right to submit a formal appeal in the event they are not satisfied with the outcome of a privacy request. Please email appeals to DKHorsePrivacy@draftkings.com with “Appeal” in the subject line or body of the message.

13. HOW TO CONTACT US

Any inquiries or comments regarding your personal information and privacy rights, our data privacy practices, this privacy notice, or any reports regarding suspected or actual security violations or harmful or unlawful activity should be directed to our privacy team via email to DKHorsePrivacy@draftkings.com.  


14. CHANGES AND UPDATES TO THIS PRIVACY NOTICE

This privacy notice may be revised periodically in our sole discretion, and any changes will be effective upon the revised privacy notice being posted to the Website or Applications. You are solely responsible for reviewing this notice for any changes. In the event we make material changes to this notice, as determined by us in our sole discretion, we will notify you. You are solely responsible for updating your personal information to provide CDTIC and us with your most current contact information. In the event the last email address you provided is not valid or for any reason is not capable of delivering notifications to you, then, in the event we provide you notification via email, our dispatch of the email containing such notification will constitute effective notification of the changes made to the notice. In the event you do not wish to permit changes in our use of your personal information, you must notify us that you wish to deactivate your account. Your continued use of the Services following any changes to this privacy notice will indicate your acknowledgement of and consent to such changes and to be bound by such changes, with the understanding that the updated privacy notice applies to all of your personal information, including the personal information collected before the changes went into effect.