Data Protection Provision

Data protection declaration in accordance with Art. 12 ff General Data Protection Regulation (GDPR) for Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, BVB Foundation, besttravel Dortmund GmbH, BVB Fußballakademie GmbH , BVB Asia Pacific Pte. Ltd.) and the BV. Borussia 09 e.V. Dortmund on the handling of personal data.

General information on data processing Borussia Dortmund GmbH & Co. KGaA and the companies associated with us (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, BVB Foundation, besttravel Dortmund GmbH, BVB Fußballakademie GmbH, BVB Asia Pacific Pte. Ltd.) and the BV. Borussia 09 e.V. Dortmund very important. We process your data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR) in conjunction with the Federal Data Protection Act (BDSG). Personal data that is required in all areas, i.e. the so-called master data listed under point IV, is available to the entire group. Data that is only required in individual departments to process certain services is only available to the employees there and only to the extent that they are entrusted with completing the task. The special data protection declarations for the respective task groups can be found under the given link:

Technical data protection & social media Borussia 09 e.V. Dortmund (handball, table tennis, old men's football, women's football, blind football, goal ball, integration sports, Borusseum) Fan department/ member service kids club Youth Performance Center Borussia Dortmund GmbH & Co. KGaA share applications BusinessNetwork BVB App BVB TV design competitions eFootball fan shop Fan Shop International Sweepstakes whistleblower system Login (account.bvb.de) Project Panama ticketing Ticketing (eventimsports) Ticketing hospitality (after sales platform) besttravel dortmund GmbH BVB Events & Catering GmbH BVB football academy GmbH BVB Merchandising GmbH BVB Foundation The following explanations generally apply to the entire Group.

For the KGaA and its affiliated companies, the controller within the meaning of the European General Data Protection Regulation is

Borussia Dortmund GmbH & Co. KGaA

Rheinlanddamm 207-209
44137 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de

For the club:

BV. Borussia 09 e.V. Dortmund

Strobelallee 50
44139 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de/Der-Verein

You can reach the data protection officer at:

Rechtsanwalt Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
c/o BV. Borussia 09 e.V. Dortmund
Strobelallee 50
44139 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de

We collect and use the personal data that is required in the individual business areas of our company. This is essentially the master data:

1. Title, first name, surname
2. date of birth
3. postal address
4. e-mail address
5. Telephone number
6. Payment and invoice data

Billing data is collected when registering for fee-based measures. It relates only to the information relevant to invoicing. Other data is only collected in accordance with special provisions in individual departments and is only accessible there. You will be specifically informed about this on the relevant page. In principle, your data will not be passed on without your express consent. The data will be deleted as soon as it is no longer required, usually when you terminate the business relationship.

We process your personal data to fulfill the contract and for direct advertising, to ensure the security and smooth running of our events.

1. contract

The legal basis for the processing of your personal data by the controller is usually Article 6(1)(1)(b) GDPR (performance of a contract). According to this, your personal data may be processed if and insofar as this is necessary to fulfill our contractual obligations towards you. This also applies to all processing that is necessary in order to carry out pre-contractual measures that are carried out at your request. Further details are regulated in the respective specialist areas (e.g. when purchasing tickets, registering for an event, etc.).

2. legitimate interest

We take all measures within our means to ensure the safety and smooth running of all BVB events. Among other things, we must also comply with the guidelines for the uniform handling of stadium bans of the German Football Association ("DFB") or, in the case of an international match, of "UEFA" and ensure security and order in the stadium by enforcing civil law bans. In this and similar cases, we have a legitimate interest in processing all necessary information and are therefore entitled to do so in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR, unless your interests in the confidentiality of the data prevail and you object to the data processing by stating your personal conflicting interests. In principle, however, security aspects take precedence. Where applicable, this is explained in detail in the individual departments. If your data is processed on the basis of our legitimate interest (Article 6(1)(1)(f) GDPR), you can object to this in the case of direct advertising without giving reasons, otherwise by explaining your conflicting interest in accordance with Art. 21 GDPR. In the case of direct advertising, this is in our legitimate interest and is therefore lawful pursuant to Art. 6 para. 1 subpara. 1 lit. f) GDPR.

3. Data transmission

In principle, your data will not be transmitted. In special cases (e.g. to enforce a nationwide stadium ban), however, this is necessary and contractually regulated in our GTC. However, we transfer data to our service providers (e.g. software companies) on the basis of order processing contracts in accordance with Art. 28 GDPR.

4. Consent

If data processing in individual areas is based on your consent (Article 6(1)(1)(a) GDPR), you can revoke this at any time with effect for the future.

We delete your personal data as soon as we no longer need them to fulfill our contractual and/or legal obligations. Invoice data, for example, may only be deleted after 10 years.

As a data subject, you generally have

1. the right to information about your processed data in accordance with Art. 15 GDPR
2. the right to rectification of your data in accordance with Art. 16 GDPR if we process incorrect information about you
3. the right to erasure of your data in accordance with Art. 17 GDPR, provided that we no longer need the data and there are no legal retention purposes to the contrary
4. the right to restrict the processing of your data in accordance with Art. 18 GDPR, if and as long as your objections to the data processing (Art. 6 para. 1 subpara. 1 lit. f) GDPR) have not yet been clarified, and
5. the right to object to the processing of your data in accordance with Art. 21 GDPR if we process your data in our overriding interest. This is particularly the case if, in your case, our and public interests override your overriding personal interests in data processing.
6. You also have the right to lodge a complaint with the supervisory authority (Art. 77 GDPR), i.e. the State Commissioner for Freedom of Information and Data Protection (LDI) (https://www.ldi.nrw.de/).

We always comply with all these rights. We will be happy to provide you with further information if you require it. To do so, please contact our data protection officer named abAll diesen Rechten kommen wir stets nach. Sofern Sie dazu nähere Auskünfte wünschen, stellen wir Ihnen diese gern bereit. Dazu wenden Sie sich bitte an unseren oben genannten Datenschutzbeauftragten.

The basic handling of newsletters, technical data protection & social media or other IT contact is described in detail at https://www.bvb.de/Datenschutz/BVB-Social-Media and information is provided each time contact is made.

The full text of the GDPR can be found at https://dsgvo-gesetz.de/.