GARMIN x MYZONE GLOBAL CHALLENGE

Challenge Privacy Notice

Applies to the Activity Challenge and free Prize Draw entry routes

Drafting date: 15 July 2026

Controller: Myzone Holdings Ltd

1. Who is responsible for your information?

1.1 Myzone Holdings Ltd is the controller responsible for personal information used to administer the Garmin x Myzone Global Challenge (the "Campaign"). Myzone Holdings Ltd is incorporated in the Isle of Man under company number 017376V and has its registered office at Level 3, Gordon House, 10a Prospect Hill, Douglas, Isle of Man IM1 1EJ, British Isles.

1.2 You may contact the campaign team at challenges@myzone.org. You may contact Myzone's Data Protection Officer at dpo@myzone.org.

General Myzone Privacy Policy: https://www.myzone.org/legal/privacy

2. What this notice covers

2.1 This notice supplements the general Myzone Privacy Policy and applies to information used specifically to operate the Campaign, verify eligibility, calculate or verify Activity Challenge progress, administer the Prize Draw, contact and verify the winner, fulfil the Prize, prevent fraud, handle complaints, and comply with law.

2.2 If this notice conflicts with the general Myzone Privacy Policy about Campaign-specific processing, this notice controls for that processing. The general policy continues to apply to ordinary use of the Myzone app, Myzone Go subscription, and account services.

3. Information we use

Route / stage	Information	What is not required
Activity Challenge	Name, email, Myzone account ID, age/residence eligibility, rules/privacy acceptance, Garmin connection status, device identifier/model, activity date/time, workout and heart-rate data received from Garmin, calculated MEPs, sync and verification logs, fraud/support records.	Precise location is not required for this Campaign. We do not require unrelated medical records.
Free Prize Draw entry	Name, email, country and state/nation of residence, age declaration, rules/privacy acceptance, entry timestamp, verification and anti-fraud logs.	No Myzone or Garmin account, device, subscription, exercise, heart-rate, workout, location, or other health data.
Provisional winner	Proof of identity, age and residence; contact and delivery address; Prize preferences/sizes; eligibility evidence; U.S. tax forms or taxpayer information where required; contact and fulfilment records.	We will not ask for payment to claim the Prize. We will not request passwords.
Optional publicity	Only information separately agreed, which may include approved name, photograph, video, voice, social handle, region and comments.	Optional publicity is not required for UK/NI winners to receive the Prize.

4. How we obtain information

4.1 We obtain information directly from you when you join, enter, contact support, complete verification, or communicate with us.

4.2 For the Activity Challenge route, Garmin provides authorised workout and heart-rate information to Myzone through the connected account interface. Garmin's own privacy terms govern its collection and disclosure before the data reaches Myzone.

4.3 We generate MEP totals, connection status, validation flags, entry records, draw records, and support or fraud-review records from the information described above.

5. Why we use information and our legal bases

Purpose	Information	Legal basis / condition
Accept an entry, apply the Official Rules, verify eligibility and administer the Prize Draw.	Identity, contact, territory, age declaration, acceptance, entry and verification records.	Performance of the Campaign terms; legitimate interests in fair administration; and, where applicable, steps taken at your request.
Calculate, display and verify MEPs for the Activity Challenge.	Garmin connection, workout, heart-rate and MEP data.	Express consent where health/special-category or consumer-health-data law requires it; otherwise the lawful basis described in the general Myzone Privacy Policy, subject to local law.
Prevent duplicate, fraudulent, manipulated or abusive entries and protect systems.	Account, device, entry, technical, security and support logs.	Legitimate interests in campaign integrity and security; legal claims; and compliance with platform or legal obligations.
Select, contact and verify the winner; deliver the Prize.	Entry ID, contact, identity/residence proof, address, tax and fulfilment information.	Performance of the Campaign terms; legal obligations; legitimate interests in delivering and auditing the Prize.
Tax, accounting, regulatory, complaint and legal-claim handling.	Winner, payment/fulfilment, entry, draw, complaint and legal records.	Legal obligation and legitimate interests in establishing, exercising or defending legal claims.
Optional publicity.	Only the name, image, voice, social and comments specifically agreed.	Consent or another valid local basis stated in the applicable release. UK/NI consent will be separate and optional.

6. Workout and heart-rate information

6.1 If you participate in the Activity Challenge, Myzone will use workout, heart-rate and related activity information available through your Myzone account and connected Garmin service to calculate MEPs, verify your challenge progress and administer the Activity Challenge. This information is processed in accordance with the Myzone Privacy Notice, which explains the purposes of the processing, the legal bases relied on, any applicable consent arrangements, and your rights and choices.

6.2 The Free Entry Route does not require you to connect a Garmin service or provide workout, heart-rate or other health-related information.

6.3 If you withdraw before we can verify Activity Challenge completion, we may be unable to award an entry through that route. You may use the free route while the Entry Period remains open. Where verification was completed before withdrawal, we will retain only the minimal entry and audit information reasonably required, subject to your legal rights.

7. Sharing

7.1 We may share the minimum necessary information with Myzone group companies and service providers supporting hosting, email, customer support, security, entry-form operation, draw supervision, legal compliance, tax, prize delivery, and professional advice. They must use the information only for the authorised purpose and protect it appropriately.

7.2 Garmin provides authorised data to Myzone through the connection. We do not routinely send Campaign progress, entries, MEPs, or heart-rate data back to Garmin. We may tell Garmin limited winner information only if you separately agree or where it is reasonably necessary for authorised product support or warranty fulfilment and is disclosed to you.

7.3 We may disclose information to a regulator, court, law-enforcement authority, tax authority, or other body where required or permitted by law, or to establish, exercise or defend legal rights.

7.4 We do not sell Campaign health data, use it for unrelated advertising, or use precise location or geofencing around healthcare facilities for this Campaign. Entry does not enrol you in marketing.

8. International transfers and storage

8.1 Campaign information is primarily held in the Isle of Man. Some Myzone group companies or service providers may access or process information in other countries as described in the general Myzone Privacy Policy.

8.2 Where information is transferred to a country that does not provide an equivalent level of protection, we will use an applicable adequacy decision, contractual safeguards, or another lawful transfer mechanism and apply supplementary security measures where required.

9. Retention

Record category	Retention
Unsuccessful free entries, minimal Activity Challenge qualification records, duplicate decisions, consent/acceptance versions, draw audit and complaint records.	Up to 24 months after the draw, then delete or irreversibly anonymise, unless a complaint, regulatory request or legal claim requires longer.
Detailed Campaign-specific workout/heart-rate verification extracts.	Keep only as long as reasonably needed to calculate and verify MEPs, resolve timely complaints and defend a specific issue; target deletion or return to ordinary account retention within 90 days after the Prize is awarded.
Winner identity, eligibility, delivery, tax, accounting and release records.	Up to six years after the end of the relevant financial year, or another period required by tax, accounting, limitation or local law.
Ordinary Myzone account and workout history.	Governed by the general Myzone Privacy Policy and account retention schedule. The Campaign should not automatically extend all account data to six years.

10. Your rights

10.1 Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, information about disclosures, withdrawal of consent, objection to certain processing, and review or appeal of a privacy decision. You may also have a right not to receive discriminatory treatment for exercising a privacy right.

10.2 Contact dpo@myzone.org to exercise a right. We may need proportionate information to verify your identity. You may complain to the Isle of Man Information Commissioner or another privacy authority with jurisdiction in your place of residence.

10.3 For U.S. residents, any state-specific consumer-health-data notice and rights process at [U.S. HEALTH DATA NOTICE URL] is incorporated into this notice.

11. Security

11.1 We use organisational and technical measures designed to protect Campaign information, including role-based access, encryption where appropriate, logging, minimisation, incident response, and contractual controls for service providers. No system can be guaranteed completely secure.

11.2 Never send your Myzone, Garmin, email, or app-store password to the campaign team. We will not ask you to pay a fee to claim the Prize. Report suspicious winner messages to dpo@myzone.org using contact details obtained independently from the Official Rules.

12. Children

12.1 The Campaign is not open to anyone under 18 or under the age of majority where they live. We do not knowingly collect Campaign entries from children. If we learn that an ineligible child entered, we will delete or restrict the information as required and reject the entry.

13. Updates

13.1 We may update this notice where reasonably necessary to reflect a lawful change in Campaign administration. We will not materially expand use of health data during the Campaign without providing a new notice and obtaining any required consent. Material updates will be dated and communicated through the campaign page or app.

13.2 Version: 1.0. Effective date: 16.07.2026.

Appendix - Separate optional publicity consent