1. Who we are

Capped (capped.my) is a recruitment platform that connects cricket players with clubs. It is operated by S Belston & C.Z Taylor, a partnership trading as Peak Performance Sports Management (ABN 59 550 628 299), based in Queensland, Australia (Capped, we, us).

This policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to everyone who uses Capped: players, club owners, administrators, recruiters and members, and visitors.

For Australian privacy law we are the entity bound by the Australian Privacy Principles. For UK and EU data protection law we are the controller of your personal data.

Contact us: support@capped.my or PO Box 806, Oxenford QLD 4210, Australia. Please put "Privacy" in the subject line.

2. Information we collect

We collect most information directly from you when you create an account, fill in a profile or use the platform. Gender and country of residence are required for player profiles; gender is used only for club search filters. Some comes from other users, such as a club that reviews you, or from our service providers, such as Stripe confirming a payment.

| Category | What it includes | Who it applies to | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | | Account | Name, email address, profile image, membership type (player or club), club role, sign-in codes, session records, and email and notification preferences | Everyone | | Player profile | Biography, date of birth, gender, nationality, passports held, country of residence, detailed location (suburb or city), playing roles, batting and bowling style, preferred positions, countries played in, preferred playing nations | Players | | Visa and work eligibility | Visas you hold or are eligible for, and visa or sponsorship requirements | Players and clubs | | Physical and health | Height, weight and any medical information you choose to disclose | Players (optional) | | Availability | Availability status, dates, notes and contract preferences | Players | | Media and career | Cricket CV (PDF), up to six photos, up to three YouTube video links, statistics links, achievements and endorsements | Players and clubs | | Club | Club name, contact details, facilities, culture, logo, photos, teams, openings and their requirements, members and their roles, recruitment notes | Clubs | | Recruitment | Applications, shortlists, staff recommendations, conversation messages, deals, contract terms and PDF contracts, signature records, completion records and reported problems | Players and clubs | | Reviews | Star ratings and written feedback you give or receive after a deal | Players and clubs | | Payments | Billing name and address, subscription, invoice and success-fee records, GST amounts, and Stripe customer IDs. Stripe holds your card details; we never see or store your full card number | Paying users | | Technical | IP address, device and browser type, push-notification subscription, and server logs | Everyone | | Analytics (only if you accept) | Pages viewed, actions taken in the app (such as searches, applications and deal steps, without their content), device and browser information, and an internal user ID | Users who accept analytics cookies | | Support and moderation | Messages you exchange with the Capped team, emails to support@capped.my, reports you make, records of moderation actions, and internal notes our staff add to user and club records | Where relevant |

Sensitive information. Health information is sensitive information under Australian law and special category data under UK GDPR. Passport and nationality details can also reveal racial or ethnic origin. Clubs never see your health information. Only you and Capped administrators can. You can remove it at any time.

Information about other people. If you add details about someone else, such as a club member you invite, a referee in your CV, or a person quoted in an endorsement, make sure they know you are sharing it with us.

If you don't provide information. You can use Capped without some optional fields, but a less complete profile may appear less often in club searches and may not meet some openings' requirements.

3. How we use your information

We use your information to run Capped and connect players with clubs. UK and EU law requires us to name a legal basis for each use, and these are listed in the right-hand column.

| Purpose | Examples | Legal basis (UK/EU) | | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | Provide your account and the platform | Sign-in codes, onboarding, profiles, club membership, notifications | Contract | | Match players and clubs | Showing profiles in club searches, checking eligibility for openings (role, availability, nationality, passport, visa, height, age, location), staff recommendations | Contract; legitimate interests | | Run recruitment and deals | Applications, conversations, deals, contracts, signatures, completion | Contract | | Take payments | Annual subscriptions, success-fee invoices, payment retries, refunds, GST calculation | Contract; legal obligation | | Verify profiles | Checking identity or supporting evidence before adding a verified badge | Legitimate interests | | Keep Capped safe | Moderating conversations and reviews, handling reports, banning accounts, preventing fraud, rate-limiting sign-in | Legitimate interests; legal obligation | | Support | Answering requests; messaging you as the Capped team; for an approved support case, an administrator may view the site as you to investigate a problem | Contract; legitimate interests | | Improve the service | Fixing faults, reviewing logs, planning features | Legitimate interests | | Service messages | Sign-in codes, invitations, billing notices, notification emails and the daily conversation digest, changes to these policies | Contract; legal obligation | | Legal compliance | Tax and accounting records, responding to lawful requests, resolving disputes | Legal obligation; legitimate interests |

Health information. We only hold health information you choose to add to your profile. Clubs never see it; only you and Capped administrators can. Our legal basis is your explicit consent, which you give by adding it. You can withdraw consent by deleting it from your profile.

Automated matching. Capped automatically filters and sorts who appears in searches and who meets an opening's requirements. It uses your playing roles and styles, formats, availability, country, detailed location, nationality, passports, visa details, height, age, gender and verification status. It also calculates a profile-completeness score. Clubs make the recruitment decisions, not Capped. No decision with a legal or similarly significant effect on you is made solely by automated means.

Marketing. We do not sell your personal information. We will only send you marketing emails if you agree. Optional notification emails and the daily conversation digest carry an unsubscribe link, and you can change your email preferences in Settings. Sign-in codes and essential service emails can't be turned off.

Analytics. If you accept analytics cookies, we use Google Analytics to understand how Capped is used and to find faults. This is based on your consent, which you can withdraw at any time in Cookie settings (section 8). We send Google an internal user ID, but not your name, email address, messages, health or passport details, or anything you type into forms. Analytics is never collected for staff accounts or admin pages.

4. Who can see your information

Clubs. What a club sees depends on its access:

• Every club sees an anonymous summary of your profile and your country.
• A club with a paid or gifted plan sees your full profile: name, photo, playing details, availability, media, achievements, endorsements, published reviews, verification badge and downloadable CV.
• Your detailed location (suburb or city) is only shown to a club with a plan that has started a conversation with you.
• Clubs never see your email address, phone number, date of birth or health information.

Within a club, owners, administrators and recruiters can read all of the club's conversations. Ordinary club members cannot. Someone who leaves the club or loses their role loses that access straight away. A PDF contract is only shown to the two parties to the deal.

Players. Players see a summary of openings. With a paid or gifted plan, they see the full opening, including the club name. Players in a conversation or deal with a club see that conversation and deal.

Reviews. Each party can review the other after a deal is completed. A review stays private until both parties have submitted, or until 30 days after the review period opens. Both reviews are then published on the reviewed person's profile. An average rating is only shown once a person has at least three published reviews. Don't include private contract, health or payment details in a review.

Capped staff. Our administrators and moderators can access accounts, profiles, conversations, deals and billing records for support, moderation and safety. Administrators can also see health information and detailed locations. Staff may join a recruitment conversation to read it for a support or moderation case, but cannot post in it. Staff can also message you directly in a conversation marked with a Capped team badge. Staff only access what a task needs.

Service providers. We use the providers below to run Capped. They may only use your information to provide their service to us.

| Provider | What they do | Where data is processed | | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------- | | Railway | Hosts the website, database, file storage and scheduled jobs | Singapore | | Stripe | Processes subscriptions, success-fee invoices, refunds and GST calculation, and emails invoices to you | Australia, United States and other countries | | Postmark (ActiveCampaign) | Sends sign-in codes, invitations, notification emails and the daily conversation digest | United States | | Google Analytics (Google) | Measures how Capped is used, only if you accept analytics cookies | United States and other countries | | Porkbun | Registers our domain, runs its DNS, and forwards emails sent to support@capped.my to our support mailbox | United States | | [Support mailbox provider] | Hosts the mailbox where we receive and answer support emails | [Country] | | Web push services (e.g. Google, Apple, Mozilla) | Deliver push notifications to your device if you turn them on | Various, depending on your browser | | YouTube (Google) | Plays videos you link on your profile | United States and other countries | | GitHub | Stores our source code (not user data) | United States | | [Avatar service] | Generates placeholder profile images | [Country] |

Others. We may also share information with our professional advisers, with a buyer or successor if Capped's business is transferred (including when we incorporate as a company), and with police, regulators or courts where the law requires or allows it.

5. Overseas transfers

Capped is run from Australia, and our database and files are hosted in Singapore. Some providers also process data in the United States and other countries (see section 4). This means your information will leave the country you live in.

For Australian users, we take reasonable steps to make sure overseas recipients handle your information in line with the Australian Privacy Principles, mainly through contracts with them.

For UK and EU users, where we transfer personal data to a country without an adequacy decision, we rely on approved safeguards. These include the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK–US Data Bridge and EU–US Data Privacy Framework for certified US providers. Contact us for a copy of the relevant safeguards.

6. Players aged 16 and 17

Capped is for people aged 16 and over. Players aged 16 or 17 can only join with the consent of a parent or legal guardian. The guardian must confirm that they consent to the player using Capped, to this policy, and to any health information being added.

• We may ask for evidence of age and guardian consent, and may suspend an account until we receive it.
• A parent or guardian can contact us to access, correct or delete their child's information.
• Clubs must deal with under-18 players responsibly and follow the safeguarding rules that apply to them and their cricket governing body.
• If we learn that someone under 16 has created an account, we will delete it.

7. How long we keep information

We keep information for as long as we need it for the purposes in this policy, or as long as the law requires.

| Information | How long we keep it | | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | Account and profile | While your account is open. Deleted or anonymised within [90] days after you close your account, except as below | | Deals, contracts, related conversations and success-fee records | [7] years after the deal ends, for tax, accounting and legal claims | | Applications and conversations that did not lead to a deal | [2] years after the opening closes | | Billing and invoice records | [7] years, as required by tax law | | Reviews | While both accounts are open, or until removed by moderation | | Moderation and ban records | [2] years after the action, or longer while a ban is in place | | Server logs | Usually no more than [90] days |

Deleted information can remain in backups for up to [90] more days, until the backups are overwritten. Stripe keeps its own payment records under its own privacy policy. Google Analytics data is kept for [14] months, then deleted automatically.

8. Cookies and similar technologies

Capped uses browser storage that the platform needs to work, plus optional analytics cookies that are only set if you accept them. Advertising and ad personalisation are always off.

| Item | Set by | Purpose | Needs your consent? | | ------------------------------------------ | ---------------- | ---------------------------------------------------------------------------------------------------------- | ------------------- | | Sign-in session cookie | Capped | Keeps you signed in | No (essential) | | capped.analytics-consent (browser storage) | Capped | Remembers whether you accepted or declined analytics | No (essential) | | Prompt and app storage | Capped | Remembers when you dismiss the "add to home screen" or push prompt, and lets the installed app cache pages | No (essential) | | _ga and ga<ID> cookies | Google Analytics | Distinguish visitors and sessions for usage statistics | Yes |

The first time you visit, we ask whether you accept analytics. Until you choose, and if you decline, no analytics cookies are set and nothing is sent to Google Analytics. You can change your choice at any time: use Cookie settings on the sign-in page or in the footer of our legal pages, or go to Settings → General → Manage analytics cookies. When you withdraw consent, we delete the analytics cookies and stop collecting. Data Google has already received is kept under our Google Analytics retention setting (section 7).

When you play a YouTube video on a profile, YouTube may set its own cookies under Google's privacy policy.

9. How we protect your information

• Sign-in uses one-time email codes rather than passwords, with rate limits on repeated attempts.
• All traffic to Capped is encrypted in transit (HTTPS).
• CVs, contracts and other private files are stored privately and opened through links that expire after 60 minutes.
• Access is limited by role: club members, moderators and administrators each see only what their role permits. Sensitive staff actions are recorded.
• Stripe, a PCI-DSS certified provider, stores your card details. We never store full card numbers.

No system is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator as required by law. This includes Australia's Notifiable Data Breaches scheme and the UK GDPR's 72-hour rule.

10. Your rights

You can update most of your information yourself in My Profile and Settings. You can also contact us at support@capped.my to:

• access the personal information we hold about you;
• correct information that is wrong, out of date or incomplete;
• delete your account and information, subject to the records we must keep (section 7);
• withdraw consent, for example to health information or marketing.

If you are in the UK or EU, you also have the right to restrict or object to our processing, including processing based on legitimate interests, and to receive your data in a portable format.

We will respond within 30 days, or one month for UK and EU requests. We may need to verify your identity first. We won't charge you unless a request is clearly unfounded or excessive. If we refuse a request, we will tell you why.

11. Complaints

Please contact us first at support@capped.my and we will try to resolve your complaint within 30 days. If you are not satisfied, you can complain to the regulator:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992
• United Kingdom: Information Commissioner's Office, ico.org.uk, 0303 123 1113
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz
• EU: the data protection authority in your country

12. Changes to this policy

We may update this policy as Capped changes, including when we become a company. We will post the new version at capped.my/privacy with a new effective date. If a change materially affects you, we will tell you by email or in the app before it takes effect.

Effective date: 21/10/2026