PRIVACY POLICY

Effective: 9/4/2026

This Privacy Policy explains how and why the Multi-State Lottery Association collects and uses personal information from our Powerball Official App and Website, Powerball websites, online and offline interactions with you, and related services (collectively, “Services”). The terms “MUSL”, “Association,” “we,” “us,” and “our” refer to the Multi-State Lottery Association, an unincorporated nonprofit association established under Iowa Code Chapter 501B. The terms “you,” “your,” and “user” refer to you in your individual capacity, and, if you use the Services on behalf of your employer, to your employer as well. This Privacy Policy applies to all information we collect in our email, text, and other electronic communications sent through or in connection with the Services.

Our Privacy Policy should be read together with our Terms of Service and/or any other relevant terms of service that govern our Services, as applicable. Please read these terms carefully as use of our Services constitutes your consent to and acceptance of this Privacy Policy.

COLLECTION OF PERSONAL INFORMATION

To access and use our Services, we may collect:

• Contact information, such as first and last name, date of birth, email address, phone number, and address
• Usernames and passwords
• Government-issued identification information, such as a copy of your passport, driver's license or state identification card, and associated information, as well as the last four digits of your Social Security number
• Photograph or other image data
• User preferences or feedback
• Information sent to us by your web browser or mobile application, such as your IP address, date and time of your visit, the pages you visit, and your geolocation

SOURCES OF PERSONAL INFORMATION

We collect personal information from the following sources:

• Directly From You. MUSL collects the personal information you manually provide when you use our Services. For example, we collect information when you send us a message, interact with our social media accounts, or otherwise interact with us. Types of personal information we may collect directly from you include, for example, your name, email address, and phone number.
• From Service Providers & Third Parties. MUSL collects personal information from our service providers and from third parties who disclose personal information to us.
• Via Cookies & Other Tracking Technologies. MUSL collects personal information passively via Cookies and other tracking technologies (collectively, “Cookies”). This information typically includes your IP address, the identity of your Internet service provider, the name and version of your operating system, the name and version of your browser, the date and time of your visit, your geolocation, and the pages you visit. For example, we use Google Analytics, a web analytics tool that helps us understand how visitors engage with our Services. To learn more about Google Analytics, visit [http://www.google.com/intl/en/analytics/privacyoverview.html].

USE OF YOUR PERSONAL INFORMATION

Generally, MUSL, and service providers processing personal information on our behalf, process personal information for the following purposes:

• Quality assurance testing;
• Account creation and authentication;
• Delivery of personalized content and advertising;
• Providing technical and customer support;
• Improvement of the Services and user experience;
• Administering, fulfilling, and delivering complimentary or promotional products, services, and experiences;
• Better understanding your needs and interests;
• Inviting you to participate in surveys and provide feedback to us (in accordance with any privacy preferences you have expressed to us);
• Contacting you with special updates and other information we believe will be of interest to you (in accordance with any privacy preferences you have expressed to us);
• to improve our marketing and promotional efforts;
• Security monitoring and technical maintenance;
• Prevention of unlawful or unauthorized use of the Services;
• Detecting, investigating, and preventing harmful, abusive, fraudulent, or other malicious activity;
• Complying with our legal and regulatory obligations, and enforcing our rights and policies; and
• For any other purpose identified in an applicable privacy notice, click-through agreement, or other agreement between you and us.

We may also de‑identify personal information collected through the Services. When we do so, we take reasonable measures to ensure that the information cannot be associated with a consumer or household, and we maintain and use the information in de-identified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer Personal Information and is not subject to this Privacy Policy.

Additionally, we may process personal information via use of automated technologies, including artificial intelligence, for the purposes listed above. To the extent permitted by applicable law, we may also use personal information we collect to train automated technologies we use for the above purposes.

STORAGE & SECURITY

While MUSL and its service providers implement reasonable administrative, technical, and physical safeguards designed to protect personal information, you acknowledge that no data transmission or storage system can be guaranteed to be completely secure. As a result, the security, integrity, and confidentiality of information transmitted through our Services cannot be assured, and such information may, despite our best efforts, be intercepted, accessed, or altered by third parties while in transit.

In the event we become aware that the security of the Services has been compromised or that users’ personal information has been disclosed to unauthorized or unrelated third parties due to external activity, including security breaches or fraud, we may take reasonable and appropriate corrective measures. These measures may include investigation, reporting, notification of affected individuals, and cooperation with law enforcement authorities, as required or permitted by law. Where legally required, or where we believe there is a reasonable risk of harm, we will make reasonable efforts to notify affected users of a data breach.

RETENTION OF PERSONAL INFORMATION

We, and our service providers, will retain personal information for only as long as necessary to fulfill the purposes outlined in this Privacy Policy, including complying with legal obligations, resolving disputes, and enforcing our agreements, unless a longer retention period is required or permitted by law. Once the applicable retention period has expired, personal information will be deleted or securely destroyed in accordance with applicable law and contractual obligations.

DISCLOSURES

We may disclose personal information in the following contexts:

• To Our Affiliates & Service Providers. MUSL discloses personal information collected through our Services to our affiliates and with service providers who act on our behalf. For example, we use service providers to operate our Services and help us with our promotional efforts. We impose contractual limitations on our service providers’ use of personal information they collect in conjunction with providing services to us.
• To Third Parties for Marketing & Analytics Purposes. MUSL may disclose your personal information to third parties who process personal information for their own purposes, including marketing and analytics companies. This includes disclosures of IP addresses and related web browsing information via tracking technologies such as Cookies.
• As Described in a Privacy Policy or With Your Consent. MUSL may disclose personal information as described in any privacy notice we provide to you via our Services, or with your consent if we obtain it from you in a particular context.
• In Aggregate or De-Identified Form. MUSL may aggregate or de-identify the personal information we collect, and we may disclose aggregated and/or de-identified information to our service providers and to third parties for our business operational purposes and for any other purposes permitted by applicable law.

We may also disclose personal information in the following contexts:

• As Part of a Business Transfer. Your personal information may be transferred to a successor organization if, for example, we transfer the ownership or operation of the Services to another organization, if we merge with or are acquired by another organization, or if we liquidate our assets. In negotiating with a third party about entering into such an arrangement, we may need to disclose your personal information. In such cases, we will take reasonable measures to protect the personal information we disclose, and we will seek assurances that the successor organization’s use of your personal information will still be subject to this Privacy Policy and the privacy preferences you have expressed to us.
• For Compliance with Laws and Protection of Our Rights and the Rights of Others. We may disclose your personal information when we, in good faith, believe disclosure is appropriate to comply with the law, a court order, or a subpoena. We may also disclose your personal information to prevent or investigate a possible crime, such as fraud or identity theft; to protect the security of the Services; to enforce or apply our Terms of Service or other agreements; or to protect our own rights or property or the rights, property, or safety of others.

ADDITIONAL DISCLOSURES FOR RESIDENTS OF CERTAIN U.S. STATES

This section provides disclosures applicable to residents of U.S. states with comprehensive privacy laws that apply to us (collectively, “U.S. Privacy Laws”). Please note that some state privacy laws, including the California Consumer Privacy Act (“CCPA”), do not regulate processing of personal information by non-profit organizations. The disclosures in this section do not apply to consumers who reside in states with state privacy laws that do not apply to us.

Please also note that this section does not apply to business contact information, including any information that we may collect about an individual in their capacity as an employee of another entity, as that information is outside the scope of the U.S. Privacy Laws.

• Data Subject Rights. Residents of states with U.S. Privacy Laws have certain rights with respect to the processing of their personal information. Depending on your state of residence, these rights may include rights to access, correct, and delete your personal information, confirm processing of your personal information, obtain a copy of your personal information in a portable format, and opt out of certain types of processing of personal information, including by opting out of sale and processing of their personal information for targeted advertising. For example:
  • Colorado Residents. Colorado residents have rights to access, correct, and delete their personal information, to obtain their personal information in a portable format, to opt out of sales of their personal information, processing of their personal information for purposes of targeted advertising, and profiling of their personal information in furtherance of decisions that produce legal or similarly significant effects, and to revoke their consent to certain types of processing activities.
  • Minnesota Residents. Minnesota residents have rights to access, correct, and delete their personal information, to confirm whether or not their personal information is being processed by the organization, to obtain their personal information in a portable format, to opt out of sales of their personal information, processing of their personal information for purposes of targeted advertising, and profiling of their personal information in furtherance of decisions that produce legal or similarly significant effects, to question the results of and obtain information about profiling decisions about them, to obtain a list of the specific third parties to which the organization has disclosed their personal information, and to revoke their consent to certain types of processing activities.
• Exercising Data Subject Rights & Authorized Agents. To exercise data subject rights applicable to you, you can email us at legal@musl.com. Residents of some states may also authorize an agent to make data subject requests on your behalf. In such instances, authorized agents may use the same method as you to submit requests on your behalf. To verify your identity and protect your personal information, and depending on the type of request you make, we may ask the requestor to provide information that will enable us to verify your identity in order to comply with your data subject request, such as asking your agent to provide proof of signed permission from you, or asking you to confirm with us directly that you provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
• Appeals. If we deny your request, residents of some states that provide for a right to appeal denial of data subject rights requests may appeal our decision by contacting us at the contact methods listed above. If you submit an appeal, please enclose or otherwise specifically reference your initial request so that we may appropriately assess and respond to your appeal. We will process appeals in accordance with applicable law.
• Sales & Processing for Purposes of Targeted Advertising. We sell personal information and process personal information for targeted advertising purposes, as those terms are defined by state comprehensive privacy laws. For example, we disclose personal information to third parties for marketing purposes. This includes information we collect via cookies and other tracking technologies, such as IP address and browsing data, and disclose to third party marketing and analytics providers. To opt out of sale and processing of your personal information for targeted advertising purposes via cookies and other tracking technologies, click “Reject All” on our cookie banner. To opt out of sale and processing of your personal information for targeted advertising purposes in other contexts, you can email us at legal@musl.com.
• Opt-Out Preference Signals. Some web browsers or devices offer settings where you may pre-set a signal to websites that you do not want to have your online activity and behavior sold or processed for targeted advertising purposes. We recognize and process opt-out preference signals, such as the Global Privacy Control signal, to the extent we are required to do so for compliance with applicable law.
• Profiling. We do not process personal information for profiling in furtherance of legal or similarly significant effects.
• Training Large Language Models. We do not collect, use, or sell personal information for the purpose of training large language models.

OTHER DISCLOSURES

• Retention of Personal Information. We, and our service providers, will retain personal information for only as long as necessary to fulfill the purposes outlined in the above Privacy Policy, including complying with legal obligations, resolving disputes, and enforcing our agreements, unless a longer retention period is required or permitted by law. Once the applicable retention period has expired, personal information will be deleted or securely destroyed in accordance with applicable law and contractual obligations.
• Direct Marketing Disclosure for California Residents. California’s “Shine the Light” law regulates the disclosure of certain personal information to third parties by a company for the recipients’ direct marketing purposes by requiring companies to provide certain information upon request and allow consumers to opt out of such disclosures. To make such a request, please contact us at legal@musl.com with the subject “Shine the Light Request.” We process such requests in accordance with applicable law.
• Disclosure for Nevada Residents. To the extent we collect personal information that identifies you through an online website or service among the categories of personal information listed in this Privacy Policy, we do not sell that personal information for monetary consideration.
• International Users. If you access the Services from outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate. These jurisdictions may have data protection and privacy laws that differ from those in your country of residence. By continuing to use the Services, you consent to the transfer of your personal information to the United States and other applicable jurisdictions.

THIRD PARTY CONTENT

Our Services may include access to third-party content that we do not control. These third parties may use tracking technologies to collect information about you when you use our Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites, apps, and other online services. They may use this information to provide you with interest-based advertising or other targeted content.

We recommend that you consult the privacy policies of third parties whose websites or applications you may be accessing through our Services. We are not responsible for examining or evaluating their content for accuracy and we do not warrant and will not have any liability or responsibility for any third-party materials or websites, or for any other materials, products, or services of third parties accessed through our Services.

CHILDREN’S PRIVACY

Our Services are not offered to anyone under the age of eighteen (18). We do not knowingly collect or maintain, through our Services, personal information from anyone under the age of eighteen (18). In the event we become aware that a person under the age of eighteen (18) has provided us with personal information through the Services, we will make reasonable efforts to delete the information from our files, unless we are required to retain it under applicable law or legal process.

CHANGES AND UPDATES TO THIS PRIVACY POLICY

We may revise and update this Privacy Policy from time to time in our sole discretion. All changes are effective immediately when we post them and apply to all use of the Services thereafter. If it is a material change, notification may be provided to you if required by applicable law. It is your responsibility to review the Privacy Policy periodically for changes. Your continued use of our Services following any changes to this Privacy Policy will indicate your acknowledgement of and consent to such changes.

CONTACT INFORMATION

Questions about our Privacy Policy should be sent to us at legal@musl.com.