Privacy Policy

Version: 2026-08.2 Company: Arrive Golf, LLC, 1 Southbridge, Cromwell, Connecticut 06416 Privacy contact: legal@arrivegolf.com

Our core commitments

Arrive Golf designs and operates group golf travel. This Privacy Policy explains what personal data we process, why we process it, who receives it, how long we keep it, and how you can exercise your rights.

Our baseline commitments are:

• We do not sell personal data.
• We do not use personal data for cross-context behavioral or targeted advertising.
• We do not use Traveler personal data to train general-purpose artificial-intelligence models, and we do not sell or license it for that purpose.
• We collect and disclose only what is reasonably necessary for the purposes described here.
• Sensitive data is used only with consent or another lawful basis and only for the disclosed operational purpose.

This Policy is a privacy notice. It does not replace or expand the commercial terms in the Booking Conditions or the risk and release terms in a Participation Agreement.

Arrive Golf, LLC (“Arrive Golf,” “we,” “us,” or “our”) is a Connecticut limited liability company. We determine why and how personal data is processed for our website, accounts, inquiries, bookings, Trip operations, payments, communications, private Trip albums, feedback, and related services.

This Policy applies to:

• visitors to our website;
• prospective and confirmed Travelers;
• Golfers and Companions;
• Group Leaders and invitees;
• people who contact us or subscribe to marketing; and
• people appearing in optional Trip media.

Our Trips are for adults age 18 and older. Section 15 addresses minors.

We receive personal data from:

1. You directly, including through an account, checkout, Trip intake, consent form, electronic signature, communication, or support request. 2. A Group Leader or another Traveler, limited to invitation information such as your name and email address. You provide your own private information after receiving the invitation. 3. Payment, authentication, communication, security, and hosting providers, which generate transaction, account, delivery, and security records. 4. Suppliers, when needed to confirm or update rooming, arrivals, activities, service delivery, incidents, or accommodations. 5. Your device and browser, through security logs, essential cookies, and limited analytics described below.

We do not purchase consumer profiles from data brokers and do not combine your information with brokered data to create advertising profiles.

3.1 Identity, account, and contact data

Name, email address, phone number, account identifier, authentication status, profile image if provided, and account preferences. Our authentication provider manages passwords; Arrive Golf does not receive your plaintext password.

3.2 Invitation and group data

Group name, Group Leader, access code or invitation status, package type, and the limited name and email information needed to send an invitation.

3.3 Golf profile

Handicap, GHIN number, preferred tees, playing preferences, and other golf information you choose to provide.

3.4 Booking and Trip data

Trip selection, dates, package type, rooming preference, itinerary, arrivals and departures, transportation needs, activity selections, Extras, Trip Credit, substitutions, and other Trip-operational details.

3.5 Sensitive health, dietary, and accessibility data

When you choose to provide it, we may process allergies, dietary restrictions, accessibility needs, mobility limitations, relevant medical conditions, medication-related safety information, and other information reasonably necessary to evaluate an accommodation or support safer participation.

This data is consent-gated and used only for the purpose explained at collection: accommodation, food service, safety planning, emergency coordination, or another specifically identified Trip need. It is not used for marketing, profiling, or unrelated decision-making.

Providing sensitive information is voluntary. However, as stated in the Booking Conditions, Arrive Golf or a Supplier may be unable to provide a requested accommodation or may limit an activity when information is reasonably necessary to evaluate or implement it safely.

3.6 Travel-document data

Arrive Golf does not collect or store your passport number or other passport details. Whether your passport and other travel documents satisfy entry and carrier requirements is your responsibility, as described in the Booking Conditions. We surface this only as a readiness reminder — for example, a prompt to confirm that your passport is valid for your travel dates — and that reminder does not require you to enter your passport number.

Where a Supplier (such as a resort, an airline, or a government authority) requires passport details for check-in, a manifest, or entry, you present those details to that Supplier directly. They are not collected, transmitted, or retained by Arrive Golf.

3.7 Emergency-contact data

Name, relationship, phone number, and other limited contact information for a person you identify. You represent that you are permitted to provide it. We use it only for emergency or urgent welfare-related communication.

3.8 Payment and Trip Credit data

Our payment processor receives full card details directly. Arrive Golf receives and retains limited transaction information, which may include:

• amount, currency, status, date, and refund status;
• processor and transaction references;
• card brand and last four digits;
• saved-payment-method token and automatic-payment status;
• billing name and contact details;
• fraud, dispute, and chargeback information, including a card fingerprint (a processor-generated code that identifies a card without revealing its number), the IP address and device details recorded when a payment or checkout consent was submitted, and address- and security-check results returned by the processor; and
• Trip Credit balance, issuance, use, restoration, and adjustment records.

Arrive Golf does not store full card numbers or card security codes.

3.9 Communications

Email, text, telephone, contact-form, support, and concierge content; delivery records; time and date; sender and recipient; consent and opt-out records; and call metadata. We do not represent that every telephone call is recorded. If we record a call, we will provide notice or obtain consent as required by law.

3.10 Contract, consent, and electronic-signature evidence

Document title and version, exact text or cryptographic hash, Trip and Traveler identifiers, typed signature, acceptance action, timestamp, IP address, browser or device information, electronic-record consent, and related audit evidence.

The permanent evidence record does not include the contents of your health, dietary, emergency-contact, or free-form Trip-intake data unless inclusion is specifically required by law or necessary to document an incident or legal claim.

3.11 Photos, video, and audio

Trip photographs and video, together with album access and media-management records, only as permitted by the consent presented to you or another lawful basis. Declining the optional release does not affect booking or participation.

3.12 Feedback and testimonials

Private feedback, publication permission, selected attribution format, version and timestamp of consent, withdrawal records, and a fingerprint or identifier used to connect the permission to the approved text.

3.13 Device, website, and security data

IP address, browser type, device and operating-system information, request timestamps, authentication events, session identifiers, error and security logs, and fraud-prevention signals.

3.14 Analytics

We use limited cookieless analytics to understand aggregate website use. We do not use advertising pixels or analytics designed to track individuals across unrelated websites.

3.15 Offer requests before you have an account

If you request a promotional code (for example, the Starter’s Welcome), we process what you enter — your name, your email address, and, only if you choose to add it, your phone number — together with the technical details that evidence the request and any consent you gave: your IP address, your browser’s user-agent, the page you were on, and the version of the consent language you were shown. We use these to send you what you asked for, to enforce the offer’s one-per-guest terms, and to keep a faithful record of any text-message consent (Section 11). If you never book, this is all we hold about you, and you may request its deletion (Section 13); the unsubscribe mechanism in any offer email works without an account.

5.1 Separate and specific consent

When consent is required for sensitive data, the collection interface will identify:

• the categories requested;
• the specific Trip-operational purpose;
• the types of recipients, if any;
• the intended retention period; and
• how to revoke consent.

Consent to sensitive-data processing is separate from acceptance of the Booking Conditions and is not bundled with marketing or media consent.

5.2 Revocation

You may revoke consent through your account or by contacting us. We will stop future consent-based processing as soon as reasonably practicable and no later than required by applicable law. Revocation does not make prior lawful processing unlawful and does not require a Supplier or other recipient to erase information it must retain under its own law.

When practical, we will notify active recipients of the revocation or updated information. Revocation may affect an accommodation or activity when the data is reasonably necessary to provide it safely.

5.3 No unrelated use

We do not use sensitive health, accessibility, dietary, or emergency-contact data for advertising, audience building, general profiling, or AI-model training.

6.1 Companion privacy

A Companion receives a private invitation or signing link and provides their own information, consents, and signature. A booking host or Golfer may see whether required steps are complete but does not see the Companion’s sensitive answers unless the Companion chooses to share them outside Arrive Golf.

6.2 Group Leaders

A Group Leader may provide invitee names and email addresses and may see group-level registration status or other information reasonably necessary to organize the group. Group Leaders do not receive health, dietary, payment-card, emergency-contact, or private communication content through Arrive Golf.

We disclose personal data only for the purposes described here and only to recipients with a legitimate need.

7.1 Technology and operational service providers

We rely on a limited set of established third-party providers to operate the website and deliver the service. We share only the information reasonably necessary for each function, and we select providers that offer appropriate security and data-protection commitments. Current categories include:

A provider may change as our systems change. We will update this Policy before a materially different provider use becomes operative when required by law.

7.2 Trip Suppliers

Resorts, golf courses, transportation providers, restaurants, kitchens, excursion operators, boat operators, spas, photographers, and other Suppliers receive only information reasonably necessary for their role. Depending on operational and legal needs, this may include names, rooming, arrival and departure details, activity selections, golf information, and limited accommodation or dietary notes.

Where feasible, Arrive Golf uses scoped, access-controlled, expiring views rather than unrestricted database exports. Some Suppliers may need a manifest, rooming list, service record, or other copy to perform the service or comply with law. Supplier access and retention are governed by their legal duties and our contractual or operational safeguards where available.

Suppliers do not receive full payment-card details from Arrive Golf.

7.3 Legal, insurance, and dispute recipients

We may disclose relevant data to professional advisers, insurers, payment networks, card issuers, dispute-resolution providers, arbitrators, courts, regulators, law enforcement, or adverse parties where reasonably necessary to:

• comply with law or valid process;
• protect a person’s safety or legal rights;
• investigate fraud or an incident;
• establish, exercise, or defend a legal claim; or
• resolve a transaction or payment dispute.

7.4 Business transaction

If Arrive Golf is involved in a merger, financing, reorganization, acquisition, or asset sale, relevant data may be disclosed under appropriate confidentiality and purpose limitations. We will provide notice before a materially different privacy policy applies where required.

Arrive Golf’s primary systems are hosted in the United States. Technology providers may process request or service data through regional or global infrastructure as described in their services.

For international Trips, the minimum operational information may be disclosed to Suppliers in the destination country. Those Suppliers are subject to local law and, where reasonably available, confidentiality, purpose-limitation, security, and deletion terms.

For current destinations, disclosures may occur in:

• the Dominican Republic; and
• Mexico.

If Arrive Golf opens a new destination, we will update relevant notices and operational safeguards before processing data for that destination.

Our payment processor processes payment-card information under its own privacy and security obligations. Arrive Golf receives limited transaction and payment-method metadata as described in Section 3.8.

If you opt in to automatic balance payment, our payment processor stores the payment method and Arrive Golf retains the token and authorization record needed to initiate the authorized charge. Revoking automatic payment stops future Arrive Golf-initiated charges under that authorization but does not erase transaction records or a payment method that the payment processor must retain under law or its own direct relationship with you.

We use no advertising cookies and no cross-site advertising trackers.

Current cookies and similar storage may include:

Blocking essential authentication or payment technologies may prevent sign-in or checkout. Our analytics is configured without advertising identifiers or cross-site tracking.

If we introduce nonessential tracking, we will update this Policy and obtain or honor consent and opt-out signals as required before activation.

11.1 Service messages

Booking, receipt, payment, itinerary, safety, and account messages are service communications. Email is our primary service channel. You cannot opt out of messages reasonably necessary to administer an active Booking, but you may choose among available channels.

11.2 Marketing

Marketing email or text is sent only as permitted by law and, where required, with separate consent. Marketing consent is not a condition of purchase. Consent to marketing texts may be given at sign-up or when you request a promotional offer; it is collected by a separate, unchecked box and is never a condition of booking or of receiving an offer.

11.3 Opt-out

• Use the unsubscribe link in a marketing email.
• Reply STOP to a text.
• Use another reasonable method to tell us to stop.

We honor email opt-outs within 10 business days and text revocations as soon as practicable and no later than required by law. We may send one nonmarketing confirmation. We keep a minimal suppression record so we do not contact you again contrary to your request.

We retain data only for the period reasonably necessary for the disclosed purpose, legal obligations, security, accounting, insurance, or claims. A legal hold, active dispute, safety incident, or regulatory requirement may extend a period.

Our intended schedule is:

Backups may retain deleted data for a limited rolling period before secure overwrite. Data in backups is not used for ordinary business processing and remains subject to access controls.

Arrive Golf extends the following request process to customers nationwide, subject to identity verification, legal exceptions, and the limits stated here. Applicable law may provide additional rights.

You may request to:

1. Access the personal data we process about you. 2. Correct inaccurate personal data. 3. Delete personal data, subject to lawful retention exceptions. 4. Obtain a portable copy of data where technically feasible. 5. Revoke consent for future consent-based processing. 6. Opt out of sale, targeted advertising, or qualifying profiling. We currently do not engage in those activities. 7. Obtain information about recipients where applicable law provides that right. 8. Appeal a denial of a request.

13.1 How to submit a request

Email legal@arrivegolf.com or use the website contact form. Identify the right you wish to exercise and the account email when possible. An authorized agent may submit a request where permitted, subject to proof of authority and identity verification.

13.2 Verification and response

We use commercially reasonable verification designed to protect you from unauthorized disclosure. We respond without undue delay and ordinarily within 45 days. When reasonably necessary and legally permitted, we may extend the response period and will explain the extension.

13.3 Appeals

If we deny a request, we will explain the reason and how to appeal. Submit an appeal through the same contact channel and label it “Privacy Appeal.” We will respond within the period required by applicable law and ordinarily within 60 days. If an appeal is denied, we will identify an available regulator or attorney-general complaint process where required.

13.4 Deletion limits

A deletion request does not require us to erase data reasonably necessary to:

• complete a transaction or administer an active Booking;
• preserve outstanding Trip Credit;
• comply with tax, accounting, legal, insurance, or security obligations;
• establish, exercise, or defend a legal claim;
• preserve consent, opt-out, contract, payment, or signature evidence;
• prevent fraud or protect safety; or
• maintain deidentified data that cannot reasonably be linked back to you.

We will retain only what is reasonably necessary for the exception and will not use it for an unrelated purpose.

13.5 No unlawful discrimination

We will not unlawfully discriminate against you for exercising a privacy right. A service or accommodation may be unavailable if it objectively requires data you ask us not to process, as explained before the choice is made.

We use administrative, technical, and physical safeguards appropriate to the nature and volume of the data, including as applicable:

• encryption in transit and at rest;
• role-based and row-level access controls;
• least-privilege administrative and Supplier access;
• multi-factor authentication for privileged access;
• secure payment processing through our payment processor;
• logging and write-protected evidence for key consents and signatures;
• sensitive-data minimization and retention sweeps;
• security and dependency monitoring;
• incident-response procedures; and
• vendor and access reviews.

No system is perfectly secure. If a security incident affects personal data, we will investigate, contain, remediate, and provide notifications consistent with applicable law.

Arrive Golf services are directed to adults 18 and older. We do not knowingly create accounts for or sell Trips to minors. A Group Leader or other person should not submit a minor’s information. If we learn that we collected a minor’s information in connection with our adult-only service, we will delete it unless retention is legally required.

We do not use personal data for solely automated decisions that produce legal or similarly significant effects concerning a Traveler.

We may use software automation to send reminders, detect system errors, prevent fraud, organize operations, or assist staff. A human remains responsible for material Booking, accommodation, safety, refund, or participation decisions.

We do not use Traveler personal data to train general-purpose AI models. If we use an AI-assisted service for a limited business function in the future, we will conduct appropriate review, minimize data, contractually restrict provider use where appropriate, and update this Policy before any materially different processing begins.

The package version and proposed or actual effective date appear at the top. We will post an updated Policy before it takes effect and provide additional notice for a material change when required. We will not use previously collected sensitive data for a materially new incompatible purpose without the consent required by law.

Prior versions will be preserved and provided on request.

Arrive Golf, LLC 1 Southbridge Cromwell, Connecticut 06416 Email: legal@arrivegolf.com

End of Arrive Golf Privacy Policy — Version 2026-08.2