Privacy Policy

What This Policy Covers

VeloVisa, Inc. ("we," "us," or "VeloVisa") is committed to protecting the privacy and security of our users. This Privacy Policy describes how we collect, use, disclose, transfer, and store your information when you use our products, services, and websites (collectively, the "Services"). It also tells you about your rights and choices with respect to your information, and how you can contact us if you have any questions or concerns.

This policy covers all products and services offered by VeloVisa, including our web-based platform, mobile applications, and related support and consulting services. It applies to information we collect when you visit our websites, use our products, communicate with us, or otherwise interact with our Services.

Our Role: Processor / Service Provider

VeloVisa acts solely as a Processor / Service Provider in providing its Services to our clients and customers ("Clients"), who are the Controller / Business with respect to the personal information of athletes, players, coaches, and staff ("Player Data") processed through our platform. VeloVisa does not determine the purposes or means of processing Player Data — our Clients do. We process Player Data only on behalf of, and under the instruction of, the Client.

Privacy obligations with respect to Player Data are governed by the privacy policy of the Client and flow down to VeloVisa as a Processor / Service Provider. We do not sell, share, or use Player Data for our own marketing or commercial purposes.

If you are an individual whose personal information is processed through our platform on behalf of a Client, please direct any privacy inquiries or data access requests to your organization (the Client), as they are the Controller / Business responsible for your information.

Player Data and Sensitive Immigration Information

In our role as Processor / Service Provider, VeloVisa processes sensitive personal information on behalf of Clients, including but not limited to: full legal names, dates of birth, nationalities, passport numbers and images, visa application data (including DS-160 form fields), travel itineraries, government-issued identification numbers, and other information required for immigration filings and work authorization. All Player Data is stored exclusively within our AWS infrastructure (Amazon RDS, Amazon S3) in the United States and is processed only as necessary to provide the Services to the Client. We do not access, use, or disclose Player Data except as directed by the Client or as required by law.

No Independent Use of Player Data

VeloVisa does not independently access, analyze, mine, profile, or use Player Data for any purpose other than providing the Services as instructed by the Client. Specifically:

• Player Data is not used for training machine learning or artificial intelligence models
• Player Data is not used for analytics, benchmarking, or trend analysis outside of Client-directed reporting
• Player Data is not used for marketing, advertising, or promotional purposes
• Player Data is not shared with, sold to, or made accessible to any third party except as directed by the Client or required by law
• Player Data is not combined with data from other Clients or external sources

VeloVisa personnel access Player Data only when necessary to provide technical support, resolve service issues, or fulfill Client instructions, and such access is logged, audited, and subject to our SOC 2 Type II controls.

Client Responsibility for Data Authorization

The Client is solely responsible for ensuring that it has obtained all necessary consents, authorizations, or other legal bases required under applicable law for the collection and submission of Player Data to the Services. This includes, but is not limited to, any consents required under the Client's own privacy policies, employment agreements, collective bargaining agreements, or applicable data protection laws.

By submitting Player Data to VeloVisa, the Client represents and warrants that it has the lawful authority to provide such data and has satisfied any applicable notice or consent requirements. VeloVisa relies on this representation in processing Player Data on the Client's behalf.

Data Processing Agreements

VeloVisa enters into Data Processing Agreements ("DPAs") with Clients that formalize the scope, purpose, duration, and restrictions of Player Data processing. DPAs define the specific categories of data processed, the permitted purposes of processing, sub-processor obligations, data breach notification procedures, and data return or deletion upon termination. Clients may request a copy of our standard DPA by contacting support@velovisa.com.

Information We Control Directly

For information we collect directly from website visitors, prospective customers, and Client administrators who access the platform — such as account credentials, contact information, and usage data — VeloVisa determines how that information is used and is responsible for it under this Privacy Policy.

What Information We Collect About You

We collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below.

Account and Profile Information

We collect information about you when you register for an account, create or modify your profile, set preferences, sign up for or make purchases through the Services. For example, you provide your contact information and, in some cases, billing information when you register for the Services. You also have the option of adding a display name, profile photo, job title, and other details to your profile information to be displayed in our Services. We keep track of your preferences when you select settings within the Services.

Content You Provide Through Our Products

The Services include products you use, where we collect and store content that you post, send, receive, and share. This content includes any information about you that you may choose to include. Examples of content we collect and store include: immigration documents and case information, personnel records, travel itineraries, compliance documentation, and any other information you upload or provide through our platform. Content also includes the files and links you upload to the Services.

Content You Provide Through Our Websites

The Services also include our websites owned or operated by us. We collect other content that you submit to these websites, which include social media or social networking websites operated by us. For example, you provide content to us when you provide feedback or when you participate in any interactive features, surveys, contests, promotions, activities, or events.

Information You Provide Through Our Support Channels

The Services also include our customer support, where you may choose to submit information regarding a problem you are experiencing with a Service. Whether you designate yourself as a technical contact, open a support ticket, speak to one of our representatives directly, or otherwise engage with our support team, you will be asked to provide contact information, a summary of the problem you are experiencing, and any other documentation, screenshots, or information that would be helpful in resolving the issue.

Payment Information

We collect certain payment and billing information when you register for certain paid Services. For example, we ask you to designate a billing representative, including name and contact information, upon registration. You might also provide payment information, such as payment card details, which we collect via secure payment processing services. We do not directly store full payment card numbers or personal bank account numbers.

Information We Collect Automatically

We collect information about you when you use our Services, including browsing our websites and taking certain actions within the Services.

Your Use of the Services

We keep track of certain information about you when you visit and interact with any of our Services. This information includes the features you use, the links you click, the type, size, and filenames of attachments you upload to the Services, search terms, and how you interact with others on the Services.

Device and Connection Information

We collect information about your computer, phone, tablet, or other devices you use to access the Services. This device information includes your connection type and settings when you install, access, update, or use our Services. We also collect information through your device about your operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and crash data. We use your IP address and/or country preference in order to approximate your location to provide you with a better Service experience.

Cookies and Other Tracking Technologies

VeloVisa uses cookies primarily for essential platform functionality. Specifically, we use session cookies to authenticate users and maintain your login session while you use the Services. These cookies are strictly necessary for the operation of the platform and cannot be disabled without losing access to the Services.

We do not use advertising cookies, cross-site tracking pixels, or third-party behavioral analytics cookies. You can control cookies through your browser settings; however, disabling session cookies will prevent you from using the authenticated portions of the Services.

Information We Receive from Other Sources

We receive information about you from other Service users, from third-party services, and from our business and channel partners.

Other Users of the Services

Other users of our Services may provide information about you when they submit content through the Services. For example, an administrator of your organization may provide your contact information when they designate you as a user of the Services. Similarly, other users may upload personnel records, immigration documents, or other files that contain information about you.

Other Services You Link to Your Account

We receive information about you when you or your administrator integrate or link a third-party service with our Services. For example, if you create an account or log into the Services using your credentials from a third-party service, we receive your name and email address as permitted by your profile settings on the third-party service in order to authenticate you.

VeloVisa Partners

We work with immigration law firms and legal consulting partners who support Clients in connection with the Services. These partners may receive Player Data as directed by the Client, solely for the purpose of providing legal services related to the immigration matters for which the Client has engaged both VeloVisa and that firm. Any Player Data shared with such partners is governed by the applicable data processing agreement and subject to the professional obligations of the receiving firm. We also work with implementation and training partners who may access account-level information — but not Player Data — in the course of supporting platform onboarding and configuration.

How We Use Information We Collect

How we use the information we collect depends in part on which Services you use, how you use them, and any preferences you have communicated to us. Below are the specific purposes for which we use the information we collect about you.

To Provide the Services and Personalize Your Experience

We use information about you to provide the Services to you, including to process transactions with you, authenticate you when you log in, provide customer support, and operate and maintain the Services. We may also use information we collect to personalize the Services, including remembering your information so you will not have to re-enter it during your visit or the next time you visit the Services.

For Research and Development

We are always looking for ways to make our Services smarter, faster, secure, integrated, and useful to you. We use collective learnings about how people use our Services and feedback provided directly to us to troubleshoot and to identify trends, usage, activity patterns, and areas for integration and improvement of the Services.

To Communicate with You About the Services

We use your contact information to send transactional communications via email and within the Services, including confirming your purchases, reminding you of subscription expirations, responding to your comments, questions, and requests, providing customer support, and sending you technical notices, updates, security alerts, and administrative messages.

To Market, Promote, and Drive Engagement with the Services

We use your contact information and information about how you use the Services to send promotional communications that may be of specific interest to you, including by email. These communications are aimed at driving engagement and maximizing what you get out of the Services, including information about new features, survey requests, newsletters, and events we think may be of interest to you.

Customer Support

We use your information to resolve technical issues you encounter, to respond to your requests for assistance, to analyze crash information, and to repair and improve the Services.

For Safety and Security

We use information about you and your Service use to verify accounts and activity, to monitor suspicious or fraudulent activity, and to identify violations of Service policies.

To Protect Our Legitimate Business Interests and Legal Rights

Where required by law or where we believe it is necessary to protect our legal rights, interests, and the interests of others, we use information about you in connection with legal claims, compliance, regulatory, and audit functions, and disclosures in connection with the acquisition, merger, or sale of a business.

With Your Consent

We use information about you where you have given us consent to do so for a specific purpose not listed above. For example, we may publish testimonials or featured customer stories to promote the Services, with your permission.

Legal Bases for Processing (EEA and UK)

If you are an individual in the European Economic Area (EEA) or the United Kingdom (UK), we collect and process information about you only where we have legal bases for doing so under the EU General Data Protection Regulation (GDPR) or the UK GDPR, as applicable. The legal bases depend on the Services you use and how you use them. This means we collect and use your information only where: (a) we need it to provide you the Services, including to operate the Services, provide customer support and personalized features, and to protect the safety and security of the Services; (b) it satisfies a legitimate interest (which is not overridden by your data protection interests), such as for research and development, to market and promote the Services, and to protect our legal rights and interests; (c) you give us consent to do so for a specific purpose; or (d) we need to process your data to comply with a legal obligation.

Where we process Player Data on behalf of a Client, the Client is the Controller / Business and is responsible for establishing the legal basis for processing. VeloVisa processes such data solely under the Client's instructions pursuant to a data processing agreement.

How We Share Information We Collect

Sharing with Other Service Users

Collaboration

The Services allow you to share information, including immigration case files, personnel records, and other content, with other users of the Services. Information shared in this manner is accessible to those with whom you choose to share it, as well as administrators of the organizations to which you belong.

Managed Accounts and Administrators

If you register for or access the Services using an email address with a domain that is owned by your employer or organization, or associate that email address with your existing account, and such organization wishes to establish a VeloVisa account, certain information about you including your name, profile picture, contact info, content, and account use may become accessible to that organization's administrator and other Service users sharing the same domain.

Sharing with Third Parties

Service Providers

We work with third-party service providers to provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing (solely for Client billing information and not for Player Data), and other services for us, which may require them to access or use information about you. If a service provider needs to access information about you to perform services on our behalf, they do so under close instruction from us, including policies and procedures designed to protect your information.

Links to Third-Party Sites

The Services may include links that direct you to other websites or services whose privacy practices may differ from ours. If you submit information to any of those third-party sites, your information is governed by their privacy policies, not this one. We encourage you to carefully read the privacy policy of any website you visit.

With Your Consent

We share information about you with third parties when you give us consent to do so. For example, we display personal testimonials of satisfied customers on our public websites. With your consent, we may post your name alongside the testimonial.

Compliance with Enforcement Requests and Applicable Laws; Enforcement of Our Rights

In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process, or governmental request, including to meet national security requirements; (b) enforce our agreements, policies, and terms of service; (c) protect the security or integrity of our products and services; (d) protect VeloVisa, our customers, or the public from harm or illegal activities; or (e) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person.

Business Transfers

We may share or transfer information we collect under this Privacy Policy in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. You will be notified via email and/or a prominent notice on the Services if a transaction takes place, as well as any choices you may have regarding your information.

How We Store and Secure Information We Collect

Information Storage and Security

We use industry-standard technical and organizational measures designed to secure your personal data, including encryption at rest and in transit, role-based access controls, and infrastructure provided by Amazon Web Services. VeloVisa maintains a SOC 2 Type 2 report covering the Security and Confidentiality trust services criteria, issued by an independent service auditor. Amazon Web Services maintains its own independent attestations. Our current report is available to Clients and prospective Clients on request. All Player Data is stored exclusively within our AWS infrastructure in the United States. While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others.

Data Breach Notification

If VeloVisa becomes aware of a personal data breach affecting information processed on a Client's behalf, VeloVisa will notify that Client without undue delay, provide the information reasonably available to assist the Client in meeting its own notification obligations, and cooperate with the Client's investigation and remediation. Incident handling, retention of incident records, and the Company's obligations on timing are set out in the applicable data processing agreement.

How Long We Keep Information

Account Information

We retain your account information for as long as your account is active. Player Data and other Client data submitted to the Services is retained only for the duration of the applicable Client agreement and is purged from the platform environment upon termination of the Client's service agreement. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Services.

Information You Have Shared with Others

If you have shared information with others through the Services, that information may be retained by those with whom you shared it, even after your account is closed. We do not control data that other users may have copied out of our Services.

Managed Accounts

If the Services are made available to you through an organization (e.g., your employer), we retain your information as long as required by the administrator of your account. For more information, see the "Managed Accounts and Administrators" section above.

Marketing Information

If you have elected to receive marketing emails from us, we retain information about your marketing preferences for up to 24 months from the date you last expressed interest in our Services, such as when you last opened an email from us or ceased using your VeloVisa account. We retain information derived from cookies and other tracking technologies for up to 12 months from the date such information was created.

How to Access and Control Your Information

You have certain choices available to you when it comes to your information. Below is a summary of those choices, how to exercise them, and any limitations.

Your Choices

You have the right to request access to, correction of, or deletion of your personal data. You may also have the right to object to or restrict certain types of processing of your personal data. If you have provided consent for the processing of your data, you have the right to withdraw that consent at any time, which will not affect the lawfulness of the processing before your consent was withdrawn.

Access and Update Your Information

Our Services give you the ability to access and update certain information about you from within the Service. For example, you can access your profile information from your account and search for content containing information about you using key word searches in the Service. You can update your profile information within your profile settings and modify content that contains information about you using the editing tools associated with that content.

Deactivate Your Account

If you no longer wish to use our Services, you or your administrator may be able to deactivate your Services account. If you can deactivate your own account, that setting is available to you in your account settings. Otherwise, please contact your administrator. If you are an administrator and are unable to deactivate an account through your administrator settings, please contact VeloVisa support. Please be aware that deactivating your account does not delete your information; your information remains visible to other Service users based on your past participation within the Services.

Delete Your Information

Our Services give you the ability to delete certain information about you from within the Service. For example, you can remove content that contains information about you using the key word search and editing tools associated with that content, and you can remove certain profile information within your profile settings. Please note, however, that we may need to retain certain information for record keeping purposes, to complete transactions, or to comply with our legal obligations.

Request That We Stop Using Your Information

In some cases, you may ask us to stop accessing, storing, using, and otherwise processing your information where you believe we don't have the appropriate rights to do so. For example, if you believe a Services account was created for you without your permission or you are no longer an active user, you can request that we delete your account. Where you gave us consent to use your information for a limited purpose, you can contact us to withdraw that consent, but this will not affect any processing that has already taken place at the time.

Opt Out of Communications

You may opt out of receiving promotional communications from us by using the unsubscribe link within each email, updating your email preferences within your Service account settings, or by contacting us as provided below. Even after you opt out of receiving promotional messages from us, you will continue to receive transactional messages from us regarding our Services.

Do Not Track (DNT) and Global Privacy Control (GPC)

Some Internet browsers may be configured to send "Do Not Track" or Global Privacy Control (GPC) signals to the online services that you visit. Because VeloVisa does not engage in cross-site tracking, sell personal information, or share personal information for behavioral advertising, these signals do not change the operation of our Services. We do not track users across third-party websites. To find out more about GPC, please visit globalprivacycontrol.org.

Data Portability

Data portability is the ability to obtain some of your information in a format you can move from one service provider to another. Depending on the context, this applies to some of your information, but not to all of your information. Should you request it, we will provide you with an electronic file of your basic account information and the information you create on the spaces you under your sole control.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with additional rights regarding your personal information. This section applies to information we collect directly from platform users (Client administrators) and website visitors — not to Player Data, which is governed by the Client's privacy policy.

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information from our users and website visitors:

• Identifiers — name, email address, phone number, account credentials
• Commercial information — billing details, subscription and purchase history
• Internet or electronic network activity — login activity, pages visited, features used, browser type, IP address
• Professional or employment-related information — job title, employer/Club affiliation
• Geolocation data — approximate location derived from IP address

Our Role as a Service Provider for Player Data

Under the CCPA, VeloVisa acts as a "service provider" when processing Player Data on behalf of Clubs. We process this data solely to provide the Services under our contractual agreements with Clubs and do not sell, share, or use Player Data for any purpose other than performing the Services. California residents whose personal information is contained in Player Data should direct any CCPA requests to the Club that submitted their information.

Your California Privacy Rights

As a California resident, you have the right to:

• Know and access — request the categories and specific pieces of personal information we have collected about you
• Delete — request deletion of personal information we have collected about you, subject to certain exceptions
• Correct — request correction of inaccurate personal information we maintain about you
• Non-discrimination — exercise any of these rights without receiving discriminatory treatment

We Do Not Sell or Share Personal Information

VeloVisa does not sell personal information, and we do not share personal information for cross-context behavioral advertising purposes, as those terms are defined under the CCPA. We have not sold or shared personal information in the preceding 12 months.

Sensitive Personal Information

To the extent we process sensitive personal information (such as government-issued identification numbers contained in Player Data), we do so solely to provide the Services on behalf of Clubs and not for the purpose of inferring characteristics about individuals. No opt-out is required because we limit our use of sensitive personal information to what is necessary to perform the Services.

How to Submit a Request

To exercise your California privacy rights, please contact us at support@velovisa.com. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf by providing written authorization.

How We Transfer Information We Collect Internationally

We collect information globally and store that information exclusively in the United States within our AWS infrastructure. We transfer, process, and store your information outside of your country of residence for the purpose of providing you the Services. Whenever we transfer your information, we take steps to protect it. For transfers from the EEA or UK, we use Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum, where applicable) or other appropriate legal mechanisms to safeguard the transfer.

Other Important Privacy Information

Notice to End Users

Many of our products are intended for use by organizations. Where the Services are made available to you through an organization (e.g., your employer), that organization is the administrator of the Services and is responsible for the accounts and/or Service sites over which it has control. If this is the case, please direct your data privacy questions to your administrator, as your use of the Services is subject to that organization's policies. We are not responsible for the privacy or security practices of an administrator's organization, which may be different than this policy.

Administrators are able to:

• Require you to reset your account password
• Restrict, suspend, or terminate your access to the Services
• Access information in and about your account
• Access or retain information stored as part of your account
• Install or uninstall third-party apps or other integrations

Even if the Services are not currently administered to you by an organization, if you are a member of a team administered by an organization, or if you use an email address provided by an organization to access the Services, then the administrator of that organization may assert administrative control over your account and use of the Services at a later date.

Automated Decision-Making

VeloVisa does not use automated processing, including artificial intelligence or machine learning, to make decisions about individuals that produce legal or similarly significant effects. Player Data is not used to train, fine-tune, or evaluate machine learning or artificial intelligence models, and is not used as input to automated inference or profiling systems. Platform features that use automation — such as document processing, form pre-population, and workflow routing — are tools that assist our Clients and their administrators; all material decisions are made by human users.

Our Policy Toward Children

The Services are not directed to individuals under 16, and VeloVisa does not knowingly collect personal information directly from children. VeloVisa may process information about individuals under 18, including athletes signed or prospected by our Clients, where a Client submits that information to the Services. VeloVisa acts solely as a Processor and Service Provider in providing the Services to the Client, who is the Controller and Business as to the personal information of athletes. Privacy obligations as to that information are governed by the Client's own privacy policy and flow down to VeloVisa under the applicable data processing agreement, including any lawful basis and any parental or guardian consent required by applicable law. If we become aware that a child under 16 has provided us with personal information directly, we will take steps to delete such information. If you become aware that a child has provided us with personal information directly, please contact us at support@velovisa.com.

Changes to Our Privacy Policy

We may change this Privacy Policy from time to time. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice by adding a notice on the Services homepages, login screens, or by sending you an email notification. We will also keep prior versions of this Privacy Policy in an archive for your review. We encourage you to review our Privacy Policy whenever you use the Services to stay informed about our information practices and the ways you can help protect your privacy.

Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

VeloVisa, Inc.
3965 W 83rd Street, PMB 119
Prairie Village, KS 66208-5308
support@velovisa.com