Effective date: 30 June 2026

English version – Thailand PDPA-focused

This Privacy Policy explains how Education AI Group Co., Ltd. operates the Exsportia platform and handles personal data when you use our websites, booking pages, software, mobile applications, customer-support channels and related services (together, the “Platform”).

1. Who We Are

Exsportia is the software, marketplace and booking-platform brand operated by Education AI Group Co., Ltd. (บริษัท เอ็ดดูเคชั่น เอไอ กรุ๊ป จำกัด), a company incorporated in Thailand. In this policy, “Education AI Group”, “Exsportia”, “we”, “us” and “our” mean Education AI Group Co., Ltd.

• Company registration number: 0845568020186
• Registered office: 2/1 Moo 6, Bophut, Ko Samui, Surat Thani, Thailand
• Privacy contact: support@exsportia.com

For Platform-level processing, Education AI Group is generally the personal-data controller. A venue, sports organiser, coach, club, school or other business that uses Exsportia (each a “Host”) may independently decide why and how it uses personal data about its own customers. In those cases, the Host may be a separate controller and is responsible for its own privacy notices, marketing choices and legal obligations.

2. Scope of This Policy

This policy applies to Players, parents or guardians, Hosts, venue staff, event participants, coaches, website visitors, prospective customers and people who contact us. It does not replace a Host’s own privacy policy where the Host is independently responsible for your personal data.

3. Personal Data We Collect

We collect only personal data that is relevant and reasonably necessary for the purposes described in this policy. Depending on how you use Exsportia, this may include:

• Account and profile data: name, email address, mobile number, password or sign-in details, profile photograph, age/date of birth where required, language, and account preferences.
• Booking and participation data: bookings, registrations, memberships, classes, events, attendance/check-in records, teams, invitations, cancellations, waivers, notes you submit, and booking-related communications.
• Host and business data: business name, contact details, venue or event details, staff accounts, bank or payout details where required, business documents, bookings, customer-management records and transaction information.
• Payment and billing data: transaction reference, payment status, refund status, invoice and tax details. Card details are handled by the payment provider used at checkout and should not be stored by Exsportia unless expressly stated at the point of payment.
• Sports and platform-preference data: sports interests, activity history, rankings or results, feedback and preferences where a Platform feature permits this.
• Communications and support data: messages, emails, WhatsApp or chat correspondence, call notes, support tickets, surveys and feedback.
• Technical and usage data: IP address, browser and device details, operating system, app version, identifiers, log records, approximate location inferred from IP, pages viewed, clicks, access times, error reports and cookie identifiers.
• Content you choose to provide: photographs, videos, reviews, comments or other content uploaded to the Platform.

Do not provide sensitive personal data (for example, health, biometric, identity, religious, political, criminal-record or other legally sensitive information) unless the relevant feature clearly requests it and gives you an appropriate notice or consent option. Where sensitive personal data is necessary, we will apply additional safeguards and obtain explicit consent or rely on another lawful basis permitted by law.

4. Where We Obtain Personal Data

We may receive personal data directly from you, from the Host you book with or work for, from another person who makes a booking or invitation on your behalf, from your authorised parent or guardian, from payment providers, from our technology and security providers, and automatically through your use of the Platform.

5. Why We Use Personal Data and Our Legal Grounds

Under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), we process personal data only where there is an appropriate legal basis. Depending on the situation, we use personal data for the following purposes:

Providing the Platform and fulfilling a request or contract

• Create and manage accounts; process bookings, registrations, payments, cancellations and refunds; deliver check-in, memberships, event and venue management; provide customer support; and communicate important service information.
• Legal grounds: performance of a contract; steps requested before entering into a contract; and, where relevant, consent.

Operating, securing and improving Exsportia

• Maintain, troubleshoot, protect and improve the Platform; prevent fraud, misuse and security incidents; analyse platform use; create aggregated reports; and manage our business operations.
• Legal grounds: legitimate interests, provided these are not overridden by your rights; and compliance with legal obligations where applicable.

Legal, accounting and regulatory compliance

• Keep records, issue invoices, manage tax and accounting requirements, respond to lawful requests, resolve disputes, establish or defend legal claims, and enforce our terms.
• Legal grounds: legal obligation and legitimate interests.

Marketing and optional communications

• Send news, offers and promotional communications from Exsportia or, where appropriate, a Host. We will use consent where required by applicable law or where we ask for it. You can unsubscribe or withdraw marketing consent at any time through the message, your account settings or by contacting us.
• Legal grounds: consent and, where permitted, legitimate interests. Service, security and transactional messages are not marketing and may still be sent where necessary.

Matching, rankings, feedback and social/event functions

• Where enabled, use relevant activity, booking, ranking or feedback information to help operate sporting events, teams, invitations and matching features. We will not use sensitive personal data for these purposes without a lawful basis and appropriate safeguards.
• Legal grounds: performance of a contract, consent, and/or legitimate interests depending on the feature.

6. When We Share Personal Data

We do not sell personal data. We may disclose personal data only where necessary for the purposes above, including to:

• The Host, venue, coach, organiser or business connected with your booking, registration, membership or event, so it can manage the relevant service.
• Other event participants only where a feature reasonably requires it, such as a team list, invitation, match or league table. We limit this to the relevant basic information and feature data.
• Payment processors, banks and payment-related service providers to process payments, refunds, chargebacks and fraud checks.
• Technology, hosting, communications, analytics, security, professional-adviser, accounting and customer-support providers that process data on our behalf under appropriate contractual controls.
• Authorities, regulators, courts, insurers, legal advisers or other parties where required by law or reasonably necessary to protect rights, safety, property or the Platform.
• A buyer, investor, successor or group company in connection with a business reorganisation, financing, merger, sale or transfer, subject to appropriate confidentiality and legal safeguards.

7. International Transfers

Our service providers may process personal data in Thailand and in other countries. When personal data is transferred outside Thailand, we will use safeguards required by the PDPA and applicable law, which may include contractual protections, an adequate destination-country assessment, your consent where appropriate, or another lawful transfer mechanism.

8. Cookies and Similar Technologies

We use cookies, SDKs, pixels and similar technologies to keep the Platform working, remember preferences, understand use, improve performance and protect security. Some are necessary for the Platform; others are optional. Where legally required, we will ask for your consent before placing non-essential cookies or similar technologies. You can manage cookies through the Platform’s cookie controls or your browser settings, but blocking necessary cookies may affect functionality.

9. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law. We consider the nature of the data, the purpose, security needs, legal requirements, disputes and limitation periods when deciding retention periods.

• Account, profile and platform records: generally while your account remains active and for a reasonable period afterwards to deal with support, security, disputes and reactivation requests.
• Booking, payment, invoice and business records: normally retained for at least five years from the relevant accounting period or transaction, and longer where a law, tax authority, dispute or legal claim requires it.
• Marketing-consent and unsubscribe records: retained while relevant to demonstrate your choice and to respect your opt-out.
• Logs and security records: retained for a limited period appropriate to security, troubleshooting and fraud-prevention needs.

When retention is no longer necessary, we delete, anonymise or securely aggregate the data. Some information may remain in backups for a limited period before it is overwritten.

10. Security

We use reasonable technical, organisational and administrative measures designed to protect personal data against unauthorised access, use, disclosure, alteration, loss or destruction. These measures may include access controls, role-based permissions, encryption where appropriate, secure service providers, monitoring and staff controls. No online service can guarantee absolute security. If a personal-data breach occurs, we will investigate and take steps required by the PDPA, including notifying the Personal Data Protection Committee Office and affected people where required.

11. Your Rights Under the PDPA

Subject to legal conditions and exceptions, you may have the right to:

• Withdraw consent at any time where we rely on consent. This does not affect processing already carried out lawfully before withdrawal.
• Request access to and a copy of your personal data.
• Request correction of inaccurate, incomplete or out-of-date personal data.
• Request deletion, destruction or anonymisation of personal data in certain circumstances.
• Request restriction of the use of personal data in certain circumstances.
• Request data portability where applicable.
• Object to processing based on legitimate interests, direct marketing, or certain research/statistical purposes.
• Complain to the Personal Data Protection Committee Office (PDPC) if you believe your rights have been infringed.

To exercise a right, contact support@exsportia.com with “Privacy Request” in the subject line. We may ask for information reasonably needed to verify your identity and will respond in accordance with applicable law. If your request concerns data controlled by a Host, we may direct you to that Host or assist where appropriate.

12. Children and Minors

The Platform may be used to book or manage activities involving minors. Where personal data of a minor requires consent under applicable law, we will seek consent from a parent, legal guardian or other authorised person, as required. Parents or guardians should not allow a child to use the Platform independently where the child is not legally able to provide the required consent. Hosts that collect or use children’s information through Exsportia are responsible for ensuring that they have the appropriate lawful basis, notices and permissions for their own processing.

13. Account Deletion

You may request deletion of your Exsportia account through account settings, where available, or by emailing support@exsportia.com. Account deletion is irreversible and may remove access to bookings, memberships, messages and other account features. We may retain limited data where necessary for legal, accounting, fraud-prevention, security, dispute-resolution or record-keeping reasons.

14. Changes to This Policy

We may update this policy when our services, processing activities or legal requirements change. We will post the updated version on the Platform and update the effective date. For material changes, we may provide additional notice through the Platform, email or another appropriate channel.

15. Contact Us

For privacy questions, requests or complaints, please contact:

• Education AI Group Co., Ltd. (operating Exsportia)
• 2/1 Moo 6, Bophut, Ko Samui, Surat Thani, Thailand
• Email: support@exsportia.com

This policy should be read together with the Exsportia Terms & Conditions and any Host-specific privacy notice that applies to your booking or activity.