Femmes Fantasy League — Game Privacy Notice

This notice explains how Black Sheep Performance Apparel Pty Ltd, ABN 89 606 647 241, of 15 Helen St, Teneriffe QLD 4005, Australia (we, us or the Promoter) handles personal information for Femmes Fantasy League.

It supplements the general Black Sheep store privacy policy. It applies specifically to the fantasy game, versioned entry consents, scoring, leaderboards, support and prizes. The version applying to your entry is FFL-PRIVACY-2026-07-21-v1.

1. Information we collect

The game service collects and holds:

• the verified Shopify customer ID and authorised store domain supplied through Shopify's signed app proxy;
• fantasy-team name;
• country-of-residence code and, for Canada, Great Britain or the United States, the eligible province, constituent-country, state or District of Columbia code;
• confirmation that you meet the published age requirement;
• seven rider selections and their credit values at entry;
• predicted final overall winner and winning margin;
• Competition Rules and Game Privacy Notice versions and acceptance times;
• separate optional marketing-consent state and time;
• entry creation, update and lock times and operational status;
• technical security records, including short-lived write-token records; and
• audit records for rider/result imports, scoring, corrections, leaderboard publication, support and prize verification.

Service providers may also automatically process IP address, browser or device information, request and security logs, and cookies or similar technical data needed to deliver and protect the storefront and game. These fields are not stored in the game entry tables unless stated above.

The game service does not collect your Shopify password. The current game database does not store your customer email address. If we need to administer your account or contact a potential winner, authorised staff may use the contact details held in the relevant Shopify customer account.

2. How we collect it

We collect information:

• directly from you when you name and save your team, make predictions, select riders or provide confirmations;
• from Shopify when its signed app proxy supplies your verified customer identifier;
• from approved race-data and operator imports used to validate riders and calculate scores; and
• from security, support and audit processes used to operate the Competition.

3. Why we use it

We use this information to:

• verify account ownership and Competition eligibility;
• create, retrieve, update and lock one entry per customer;
• validate team size, credits, trade-team limits, rider availability and pricing version;
• calculate scores, tie-breaks and leaderboard positions;
• moderate team names and investigate misuse;
• correct official results and preserve an auditable scoring history;
• contact and verify potential winners and fulfil prizes;
• answer support, access, correction and complaint requests;
• comply with legal, regulatory, taxation and record-keeping obligations; and
• protect the security and integrity of the game.

If you do not supply the required entry information, we cannot accept or score your entry. Marketing consent is optional and does not affect entry or prize eligibility.

4. Public leaderboard

The public leaderboard shows only:

• moderated fantasy-team name;
• rank; and
• points.

It does not publish your Shopify customer ID, real name, email address, country, rider selections, prediction or consent record. We will publish a winner's real name, image or interview only where required by law or with their permission.

5. Service providers and disclosures

We may disclose or make information available to service providers only where reasonably necessary to operate the Competition, including:

• Shopify, for customer authentication and authorised account administration;
• OpenAI, through ChatGPT Sites, for game application hosting, and Cloudflare for content delivery, security and the D1 game database;
• Riverside, when a visitor plays podcast audio hosted by Riverside;
• an approved race-data provider and authorised race operators;
• a messaging provider if required for service communications or prize fulfilment; and
• professional advisers, regulators, courts or law-enforcement bodies where required or authorised by law.

Shopify hosts your Black Sheep customer account and authenticates you. The game receives a signed store identifier and stable customer ID, but not your Shopify password or customer email address. OpenAI, through ChatGPT Sites, hosts the game application and its Cloudflare D1 database. Cloudflare provides delivery, security and database infrastructure for that service. OpenAI and the subprocessors listed for ChatGPT Sites may process hosted and technical data needed to operate, secure, moderate and support the service.

The current game service is not configured for Australia-only data residency. Information may be processed in Australia and overseas, including the United States and other countries where Shopify, OpenAI, Cloudflare and their affiliates or subprocessors operate. ChatGPT Sites, including D1 storage and related logs, is not currently covered by ChatGPT regional data-residency controls. Contractual and security safeguards apply under the relevant provider agreements and applicable law, but privacy protections in another country may differ from Australia. We do not sell Competition personal information.

6. Marketing and analytics

Competition entry is not marketing consent. If you separately choose to receive Black Sheep news and product updates, that choice must be recorded and handled under the applicable marketing privacy and unsubscribe terms.

We do not send rider selections, predictions, age confirmation, residence declaration or Competition consent state to GA4, advertising pixels or other marketing analytics. Any page-level measurement must be aggregated, consent-aware and separate from the private game record.

7. Security

The game uses controls including signed Shopify app-proxy requests, verified store and customer identity, expiring one-use write tokens, server-side team and deadline validation, private no-store responses for customer data, operator authentication and append-only scoring/correction audit records.

No internet service is completely risk-free. If a data breach is likely to cause serious harm, we will assess and respond in accordance with applicable privacy law.

8. Retention

Short-lived mutation tokens are deleted when used or expired. Other technical records are retained only for the period reasonably needed for security and troubleshooting.

Core entry, consent, prize, source-import, scoring and correction records are retained for five years after the Competition closes, unless a longer period is required for an unresolved dispute, investigation or legal obligation. When information is no longer required, we take reasonable steps to delete or de-identify it.

9. Access, correction and deletion

You may ask to access or correct personal information we hold about you by contacting info@blacksheepcycling.cc. You may also ask us to delete information, although we may need to retain limited records for Competition integrity, completed prize administration, fraud prevention, disputes or legal obligations.

Correcting contact information in your Shopify account does not automatically alter an already locked Competition record. Contact us if a Competition record itself is inaccurate.

10. Complaints

If you have a privacy concern, contact info@blacksheepcycling.cc with enough detail for us to investigate. We will acknowledge and respond within a reasonable period. If you are not satisfied, you may have the right to contact the Office of the Australian Information Commissioner or another regulator available where you live.

11. Changes to this notice

We may update this notice where the game, providers or legal requirements change. We will not retrospectively replace the version accepted with a valid entry. Material changes affecting open entries will be clearly communicated and, where required, new acknowledgement will be requested before a further save.

12. Contact

Privacy contact: info@blacksheepcycling.cc Promoter: Black Sheep Performance Apparel Pty Ltd Address: 15 Helen St, Teneriffe QLD 4005, Australia