Student Data and Minor Athlete Information Notice

This Student Data and Minor Athlete Information Notice explains how TUBBARD DEVELOPMENT LLC d/b/a EXCEEDING SPORTS, which operates Exceeding Stats, handles information concerning student-athletes and other minor athletes.

This Notice supplements our Privacy Policy and Terms of Service.

1. Scope

This Notice applies when a school, school district, athletic department, youth sports program, team, club, league, or other Organization enters or manages information concerning:

• A student.
• A student-athlete.
• A minor athlete.
• An individual participating in a school or youth sports program.

Not every item of information concerning an athlete is an “education record,” and not every Organization is subject to FERPA. The applicable rules depend on the Organization, the source and nature of the information, how it is maintained, and how it is used or disclosed.

2. Roles and Responsibilities

The school or Organization determines:

• Which information to enter.
• Which users may access it.
• How long it should be retained.
• Whether eligible information should be published.
• Whether a particular disclosure is authorized.
• How to respond to student, parent, or guardian requests.

Exceeding Sports processes information to provide the Service according to the Organization’s instructions and the settings selected by authorized users.

The Organization is responsible for complying with laws and policies applicable to its collection, use, and disclosure of student or minor information.

3. FERPA

The Family Educational Rights and Privacy Act (“FERPA”) applies to education records maintained by educational agencies and institutions receiving applicable federal funding.

When a school discloses FERPA-protected information to Exceeding Sports under the school-official exception, Exceeding Sports will act as a service provider under the school’s direct control with respect to the use and maintenance of that information, but only when the school has determined that:

1. Exceeding Sports performs an institutional service or function for which the school would otherwise use employees.
2. Exceeding Sports meets the school’s criteria for a school official with a legitimate educational interest.
3. The school maintains direct control over the use and maintenance of the education records.
4. The information is used only for authorized purposes.
5. Redisclosure is restricted as required by FERPA.

Exceeding Sports does not independently declare that every school relationship qualifies for the school-official exception. Each school must make that determination based on its annual FERPA notice, policies, agreement, and circumstances.

Where FERPA applies, Exceeding Sports will:

• Use covered information only to provide the authorized Service.
• Follow the school’s lawful instructions.
• Not sell the information.
• Not use the information for targeted advertising.
• Not use the information for unrelated commercial purposes.
• Limit access to personnel and service providers with a need to support the Service.
• Support school requests for access, correction, export, or deletion.
• Restrict redisclosure except as directed by the school and permitted by law.
• Maintain reasonable safeguards.
• Return or delete information as described in this Notice and any applicable written agreement.

4. Information Organizations May Enter

Organizations may enter limited sports-related information, including:

• School, team, or program name.
• Sport and season.
• Schedule and opponent information.
• Game dates, times, and locations.
• Player name.
• Graduation year.
• Jersey number.
• Position.
• Participation and game events.
• Scores.
• Play-by-play information.
• Athletic performance statistics.
• Season, career, and historical sports records.

The Organization chooses which eligible information to enter.

5. Information Organizations Must Not Enter

Unless separately approved by Exceeding Sports in writing, Organizations must not enter:

• Social Security numbers.
• Student identification numbers used for school authentication.
• Government identification numbers.
• Full dates of birth.
• Home addresses.
• Personal phone numbers.
• Personal email addresses.
• Medical, health, or disability records.
• Athletic-training or injury records.
• Disciplinary records.
• Financial information.
• Immigration information.
• Biometric information.
• Precise geolocation.
• Counseling information.
• Special-education records.
• Information about abuse, neglect, or family legal proceedings.
• Account credentials for school systems or other services.

The Service is intended for sports statistics and program information, not as a general student-record system.

6. Purposes of Processing

Exceeding Sports processes student and minor-athlete information to:

• Maintain rosters.
• Create schedules.
• Record games and plays.
• Calculate scores and statistics.
• Produce game, season, career, and historical records.
• Provide authorized users with account access.
• Display public information selected by the Organization.
• Support exports and corrections.
• Secure and maintain the Service.
• Respond to support requests.
• Comply with applicable law.

We do not use identifiable student information to:

• Target advertising.
• Build unrelated commercial profiles.
• Determine credit or insurance eligibility.
• Sell products directly to students.
• Facilitate data-broker activities.
• Train general-purpose artificial-intelligence models.
• Sell or license student information.

7. Public Pages and Directory Information

The Service may allow an Organization to publish:

• Team and school information.
• Schedules.
• Scores.
• Game results.
• Player names.
• Graduation years.
• Jersey numbers.
• Positions.
• Athletic statistics.

An Organization must not treat information as publicly disclosable merely because it concerns athletics.

Before publishing student information, a school represents that it has determined the disclosure is permitted through one or more valid bases, such as:

• Properly designated directory information for which required notice was given and no applicable opt-out remains in effect.
• Parent or eligible-student consent.
• Another lawful authorization.

The school is responsible for:

• Defining its directory-information categories.
• Providing required annual notice.
• Providing required opt-out rights.
• Honoring applicable opt-outs.
• Limiting disclosure to authorized recipients or purposes where required.
• Removing or correcting information when appropriate.

A non-school youth sports Organization must obtain any permission required by applicable privacy, publicity, contract, league, or child-protection rules.

Public information may be copied, indexed, archived, or republished by third parties. Exceeding Sports cannot guarantee removal of copies outside its control.

8. Public-Page Controls

Authorized Organization administrators may request that public information be:

• Corrected.
• Temporarily hidden.
• Unpublished.
• Deleted from active Service pages.

Exceeding Sports may also restrict public information after receiving a credible complaint involving:

• A publication opt-out.
• Lack of authority.
• Safety concerns.
• Sensitive information.
• Misidentification.
• Harassment.
• Legal process.
• A violation of our policies.

We may ask the requester to verify identity, parental authority, school affiliation, or other relevant authority.

9. COPPA and Children Under 13

Children under 13 may not create Exceeding Stats accounts.

The Service is not designed for children under 13 to submit their own personal information.

A school or authorized adult may enter limited sports information concerning a child under 13. Where the Children’s Online Privacy Protection Act applies, Exceeding Sports will not rely solely on a statement that the school is responsible for compliance.

When a school is legally permitted to authorize collection on behalf of a parent, Exceeding Sports will:

• Provide the school with notice of the information collected.
• Describe how the information is used and disclosed.
• Use the information for the authorized school-related purpose.
• Avoid unrelated commercial use.
• Give the school the ability to review, correct, or request deletion.
• Maintain reasonable security.
• Retain the information only as reasonably necessary.

A school’s authorization does not permit Exceeding Sports to use children’s information for unrelated advertising or commercial profiling.

Where direct parental consent is required, the Organization must not provide the information without obtaining appropriate consent.

10. Parent and Eligible-Student Rights

Parents and eligible students may have rights to inspect, correct, or seek amendment of education records maintained by a school.

Because the school or Organization controls the information, requests should ordinarily be directed to that school or Organization first.

Upon receiving a verified request from the controlling Organization, Exceeding Sports will reasonably assist with:

• Locating relevant information.
• Providing an export.
• Correcting information.
• Removing information from public display.
• Deleting information from active systems.
• Documenting completion.

A parent, guardian, or eligible student may also contact [LEGAL@EXCEEDINGSPORTS.COM]. We may refer the request to the controlling Organization and will not override the Organization’s lawful instructions unless required by law.

11. Organization Responsibilities

Each Organization agrees to:

• Provide student information only when authorized.
• Limit information to what is reasonably necessary.
• Maintain appropriate internal policies.
• Inform authorized users of their responsibilities.
• Use individual accounts and appropriate permissions.
• Promptly remove former users.
• Maintain accurate rosters and statistics.
• Correct material errors.
• Honor privacy and publication restrictions.
• Respond to parent and eligible-student requests.
• Notify Exceeding Sports when information must be deleted or restricted.
• Avoid entering prohibited sensitive information.
• Maintain any legally required independent records.

The Organization must not direct Exceeding Sports to process information in a way that violates applicable law.

12. Access Controls

Organization information is available to authorized users according to assigned permissions.

Organizations are responsible for selecting appropriate administrators and roles.

Exceeding Sports may use:

• Role-based access.
• Organization separation.
• Authentication controls.
• Logging.
• Administrative access restrictions.
• Password protection.
• Session controls.

Organizations should promptly report unauthorized access or permission errors.

13. Service Providers and Subprocessors

Exceeding Sports may use service providers to host, secure, maintain, or support the Service.

Service providers that may access student information must:

• Use it only to perform contracted services.
• Protect it using reasonable safeguards.
• Follow confidentiality restrictions.
• Delete or return it as required by contract.
• Avoid selling it or using it for targeted advertising.

A school may request current information about material service providers by contacting [LEGAL@EXCEEDINGSPORTS.COM].

Where required by a school agreement, we will provide notice before adding a material subprocessor with access to covered student information.

14. Security

We use reasonable safeguards designed to protect student information, which may include:

• Encryption in transit.
• Hashed passwords.
• Role-based permissions.
• Organization-level data separation.
• Monitoring and logging.
• Restricted administrative access.
• Backup and recovery practices.
• Vendor security requirements.
• Software maintenance.

No security program can guarantee that an incident will never occur.

15. Security-Incident Response

If Exceeding Sports discovers unauthorized access to student information, we will:

1. Investigate and contain the incident.
2. Take reasonable corrective measures.
3. Preserve relevant information.
4. Notify the controlling Organization without unreasonable delay when required by law or contract.
5. Provide available information reasonably needed for the Organization’s response.
6. Cooperate concerning legally required notices.

Organizations must promptly report suspected incidents to [LEGAL@EXCEEDINGSPORTS.COM].

A separate school agreement may establish more specific notice periods.

16. Retention and Deletion

Student information is retained while reasonably necessary to provide the Service at the Organization’s direction.

After a verified deletion request or Organization account closure:

• Student information will ordinarily be deleted from active production systems within 90 days.
• Backup copies may remain for up to 180 days through normal backup rotation.
• Backup information will not be used for ordinary business purposes.
• Limited records may be retained when required by law, legal hold, security investigation, or dispute-resolution need.

An authorized Organization administrator may request an available export before deletion.

Organizations should request deletion when information is no longer needed for the authorized purpose.

17. De-Identified and Aggregated Information

Exceeding Sports may create aggregated or de-identified information for:

• Service reliability.
• Security.
• Capacity planning.
• Statistical analysis.
• Product improvement.
• Understanding general feature usage.

Before using student-derived information for these purposes, we will take reasonable steps designed to prevent the information from identifying a student, directly or indirectly.

We will not attempt to reidentify properly de-identified student information.

We will not disclose de-identified information when the surrounding circumstances would reasonably allow a recipient to identify a student.

18. Ownership

The school, Organization, or applicable individual retains ownership of student information it provides, subject to any rights held by the student or others under applicable law.

Exceeding Sports does not claim ownership of student information.

We receive only the limited rights needed to host, process, secure, display, export, and delete the information as directed and as necessary to provide the Service.

19. School Agreements

A school or district may request a separate Data Processing Agreement, student-data privacy agreement, security addendum, or similar written agreement.

If a signed school agreement conflicts with this Notice, the signed agreement controls for the school and subject matter it addresses.

This public Notice is not intended to replace a state- or district-specific agreement where one is required.

20. Changes to This Notice

We may update this Notice.

We will provide reasonable notice of material changes to Organization administrators.

We will not materially expand our use of previously collected identifiable student information without authorization when authorization is required.

21. Contact

TUBBARD DEVELOPMENT LLC d/b/a EXCEEDING SPORTS
[101 CHAD CT ANDERSON SC 29621]

Student privacy: [LEGAL@EXCEEDINGSPORTS.COM]
Security incidents: [LEGAL@EXCEEDINGSPORTS.COM]
General support: [LEGAL@EXCEEDINGSPORTS.COM]