Data Protection Provision

Data protection declaration in accordance with Art. 12 ff General Data Protection Regulation (GDPR) for Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, BVB Foundation, besttravel Dortmund GmbH, BVB Fußballakademie GmbH , BVB Asia Pacific Pte. Ltd.) and the BV. Borussia 09 e.V. Dortmund on the handling of personal data.

General information on data processing Borussia Dortmund GmbH & Co. KGaA and the companies associated with us (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, BVB Foundation, besttravel Dortmund GmbH, BVB Fußballakademie GmbH, BVB Asia Pacific Pte. Ltd.) and the BV. Borussia 09 e.V. Dortmund very important. We process your data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR) in conjunction with the Federal Data Protection Act (BDSG). Personal data that is required in all areas, i.e. the so-called master data listed under point IV, is available to the entire group. Data that is only required in individual departments to process certain services is only available to the employees there and only to the extent that they are entrusted with completing the task. The special data protection declarations for the respective task groups can be found under the given link:

Technical data protection & social media Borussia 09 e.V. Dortmund (handball, table tennis, old men's football, women's football, blind football, goal ball, integration sports, Borusseum) Fan department/ member service kids club Youth Performance Center Borussia Dortmund GmbH & Co. KGaA share applications BusinessNetwork BVB App BVB TV design competitions eFootball fan shop Fan Shop International Sweepstakes whistleblower system Login (account.bvb.de) Project Panama ticketing Ticketing (eventimsports) Ticketing hospitality (after sales platform) besttravel dortmund GmbH BVB Events & Catering GmbH BVB football academy GmbH BVB Merchandising GmbH BVB Foundation The following explanations generally apply to the entire Group.

For the KGaA and its affiliated companies, the controller within the meaning of the European General Data Protection Regulation is

Borussia Dortmund GmbH & Co. KGaA

Rheinlanddamm 207-209
44137 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de

For the club:

BV. Borussia 09 e.V. Dortmund

Strobelallee 50
44139 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de/Der-Verein

You can reach the data protection officer at:

Rechtsanwalt Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
c/o BV. Borussia 09 e.V. Dortmund
Strobelallee 50
44139 Dortmund
Deutschland
Tel.: 02 31 - 90 20 0
E-Mail: [email protected]
Website: www.bvb.de

We collect and use the personal data that is required in the individual business areas of our company. This is essentially the master data:

1. Title, first name, surname
2. date of birth
3. postal address
4. e-mail address
5. Telephone number
6. Payment and invoice data

Billing data is collected when registering for fee-based measures. It relates only to the information relevant to invoicing. Other data is only collected in accordance with special provisions in individual departments and is only accessible there. You will be specifically informed about this on the relevant page. In principle, your data will not be passed on without your express consent. The data will be deleted as soon as it is no longer required, usually when you terminate the business relationship.

We process your personal data to fulfill the contract and for direct advertising, to ensure the security and smooth running of our events.

1. contract

The legal basis for the processing of your personal data by the controller is usually Article 6(1)(1)(b) GDPR (performance of a contract). According to this, your personal data may be processed if and insofar as this is necessary to fulfill our contractual obligations towards you. This also applies to all processing that is necessary in order to carry out pre-contractual measures that are carried out at your request. Further details are regulated in the respective specialist areas (e.g. when purchasing tickets, registering for an event, etc.).

2. legitimate interest

We take all measures within our means to ensure the safety and smooth running of all BVB events. Among other things, we must also comply with the guidelines for the uniform handling of stadium bans of the German Football Association ("DFB") or, in the case of an international match, of "UEFA" and ensure security and order in the stadium by enforcing civil law bans. In this and similar cases, we have a legitimate interest in processing all necessary information and are therefore entitled to do so in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR, unless your interests in the confidentiality of the data prevail and you object to the data processing by stating your personal conflicting interests. In principle, however, security aspects take precedence. Where applicable, this is explained in detail in the individual departments. If your data is processed on the basis of our legitimate interest (Article 6(1)(1)(f) GDPR), you can object to this in the case of direct advertising without giving reasons, otherwise by explaining your conflicting interest in accordance with Art. 21 GDPR. In the case of direct advertising, this is in our legitimate interest and is therefore lawful pursuant to Art. 6 para. 1 subpara. 1 lit. f) GDPR.

3. Data transmission

In principle, your data will not be transmitted. In special cases (e.g. to enforce a nationwide stadium ban), however, this is necessary and contractually regulated in our GTC. However, we transfer data to our service providers (e.g. software companies) on the basis of order processing contracts in accordance with Art. 28 GDPR.

4. Consent

If data processing in individual areas is based on your consent (Article 6(1)(1)(a) GDPR), you can revoke this at any time with effect for the future.

We delete your personal data as soon as we no longer need them to fulfill our contractual and/or legal obligations. Invoice data, for example, may only be deleted after 10 years.

As a data subject, you generally have

1. the right to information about your processed data in accordance with Art. 15 GDPR
2. the right to rectification of your data in accordance with Art. 16 GDPR if we process incorrect information about you
3. the right to erasure of your data in accordance with Art. 17 GDPR, provided that we no longer need the data and there are no legal retention purposes to the contrary
4. the right to restrict the processing of your data in accordance with Art. 18 GDPR, if and as long as your objections to the data processing (Art. 6 para. 1 subpara. 1 lit. f) GDPR) have not yet been clarified, and
5. the right to object to the processing of your data in accordance with Art. 21 GDPR if we process your data in our overriding interest. This is particularly the case if, in your case, our and public interests override your overriding personal interests in data processing.
6. You also have the right to lodge a complaint with the supervisory authority (Art. 77 GDPR), i.e. the State Commissioner for Freedom of Information and Data Protection (LDI) (https://www.ldi.nrw.de/).

We always comply with all these rights. We will be happy to provide you with further information if you require it. To do so, please contact our data protection officer named abAll diesen Rechten kommen wir stets nach. Sofern Sie dazu nähere Auskünfte wünschen, stellen wir Ihnen diese gern bereit. Dazu wenden Sie sich bitte an unseren oben genannten Datenschutzbeauftragten.

The basic handling of newsletters, technical data protection & social media or other IT contact is described in detail at https://www.bvb.de/Datenschutz/BVB-Social-Media and information is provided each time contact is made.

The full text of the GDPR can be found at https://dsgvo-gesetz.de/.

The protection and handling of your personal data is of utmost importance to Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, BVB Foundation, besttravel Dortmund GmbH, BVB Football Academy GmbH, BVB Asia Pacific Pte. Ltd.) as well as BV. Borussia 09 e.V. Dortmund. We process your data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR) in conjunction with the German Federal Data Protection Act (BDSG).

These provisions apply in addition to the regulations for private users (https://www.bvb.de/ger/Datenschutz/Webseite-bvb.de) and the provisions for business users for the websites and apps of Borussia Dortmund GmbH & Co. KGaA and its affiliated companies.

On this page, you will find our information on technical data protection (A), the privacy policies for our presence on various social media platforms (B), and our app (C).

A. Technical Data Protection

I. Provision of the Website and Creation of Log Files

Each time our website is accessed, our system automatically collects data and information from your computer system. The following data is collected:

1. Information about the browser type and version used
2. Your operating system
3. Your IP address
4. Date and time of access
5. Websites from which your system reaches our website
6. Websites accessed by your system via our website

This data is stored in the log files of our system. There is no storage of this data together with other personal data. It is necessary for our system to temporarily store your IP address to deliver the website to your computer. For the duration of your use of the website, your IP address must remain stored. The storage in log files ensures the functionality of the website. Additionally, we use this data to optimize our website and safeguard our information technology systems. This data is not used for marketing purposes. The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

The data is stored as long as it is necessary to achieve the purpose for which it was collected. If the data is required to provide the website, it is no longer necessary once the session ends. Your data is then automatically deleted. If the data is stored in log files, this is done at the latest after seven days. If the data is stored further, your IP address will be anonymized or altered in such a way that the calling internet connection can no longer be assigned. The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website.

We collaborate with Microsoft Clarity and Microsoft Advertising to analyze how you use and interact with our website, utilizing behavioral metrics, heatmaps, and session recordings to improve and market our products and services. Microsoft Clarity collects data on the behavior of website users, which may include personal data such as IP addresses, click paths, mouse movements, etc. Data on website usage is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud/security purposes, and advertising. For more information on how Microsoft collects and uses your data, please refer to the Microsoft Privacy Statement: https://privacy.microsoft.com/en-US/privacystatement.

II. Use of Cookies

We use so-called “cookies” on our website. These are text files that are stored on or by your internet browser on your computer system. When you visit our website, a cookie may be stored on your system.

This facilitates navigation and provides a high level of user-friendliness. Cookies also help us identify particularly popular areas of our online offerings. These are text files that are stored on or by your internet browser on your computer system. When you visit our website, a cookie may be stored on your system. These contain an individual string that allows information to be retained for a specific period of time and enables the identification of your device. In the following sections, 1 ("Necessary Cookies"), 2 ("Statistics Technologies"), and 3 ("Marketing Technologies"), we provide detailed explanations of the types of cookies we use and the data processed therein. Unless otherwise stated in the following explanations, the following applies to the storage duration regardless of the type and purpose of the cookies:

You have full control over the use of cookies. These are stored on your computer and the data is transmitted from it to our site. Most browsers are initially set to accept cookies, but the transmission of cookies can be disabled or restricted by changing the browser settings. Cookies that have already been stored can be deleted at any time. This can also be done automatically through your browser settings. If cookies are generally disabled for our website, some functions of the website may no longer be fully usable. When you visit our website, you will be informed about the aforementioned use of cookies through an information banner and referred to this privacy policy. We ask for your consent to the use of cookies, which you can give by clicking the “I agree” button. You can revoke your consent to the use of cookies at any time. This can be done either by not agreeing to the use of cookies in the displayed banner or by changing your browser settings accordingly.

1. Necessary Cookies

These services, technologies, and cookies are necessary to ensure core functions of the portal as well as the fulfillment of contracts with customers and partners. The following data is stored and transmitted in the cookies:

(1) Session ID

(2) Login ID

(3) Shopping Cart ID

We require cookies for the following applications for technical reasons:

(1) Personalized user addressing

(2) Shopping cart contents are retained across multiple browser sessions. The data collected through technically necessary cookies is not used to create user profiles.

These are used based on the legal grounds of Art. 6(1)(1) lit. b) (contract initiation or fulfillment), lit. c) (if legal obligations exist), and/or lit. f) of the GDPR (legitimate interests). The latter interests include monitoring the technical performance of the website as well as our interest in the economic use of partner sales channels. These cookies cannot be disabled via our consent management system or by you as a website user. If you object to the use of these cookies or configure your browser accordingly, our website will not recognize your browser, and certain content may become inaccessible or data (e.g., from an input form) may be lost. For the storage duration of technically required cookies, please refer to Section II.

1.1 Tag Management System

The processes within this category manage the deployment of services, technologies, and cookies without storing the data collected through these services. Similarly, no data is collected or stored by the tag management systems themselves. The system is used to technically implement your choice regarding privacy settings. The following technologies and service providers are used:

• Google Tag Manager
• Easy Marketing Tag Manager

1.2 Technically Required Website Technologies

The processes within this category are used to ensure the smooth use of the website and its functions. Without their use, functions such as shopping cart assembly would not be possible. The following technologies and service providers are used:

• Proprietary website cookies

1.3 Consent Management Platform (CMP)

We have integrated the consent management tool “consentmanager” (www.consentmanager.net) from consentmanager AB (Håltgelvågen 1b, 72348 Västerås, Sweden, [email protected]) on our website to obtain consent for data processing or the use of cookies or similar functions. With "consentmanager", you have the option to give or deny your consent for certain functionalities of our website, such as embedding external elements, streaming content, statistical analysis, audience measurement, and personalized advertising. You can use “consentmanager” to give or deny consent for all functions or for specific purposes or individual functions. The settings you make can be changed later as well. The purpose of integrating “consentmanager” is to provide users of our website with the ability to make decisions about the aforementioned matters and, during further use of our website, to offer the possibility of changing previously made settings. In the course of using “consentmanager”, personal data and information from the devices used (IP address, language, browser, etc.) are processed and transmitted to consentmanager AB. Information about the settings you have made is also stored on your device.

The legal basis for the processing is Art. 6(1)(1) lit. c) GDPR in conjunction with Art. 7(1) GDPR, insofar as the processing is used to fulfill the legally prescribed proof obligations for obtaining consent. In addition, Art. 6(1)(1) lit. f) GDPR serves as the relevant legal basis. Our legitimate interests in processing lie in storing user preferences regarding the use of cookies and evaluating consent rates. A re-query of consent will take place at the latest twenty-four months after the settings are made. The settings you make will then be stored again for this period unless you delete the information yourself on the storage device.

You may object to the processing insofar as it is based on Art. 6(1)(1) lit. f) GDPR. Your right to object is based on reasons arising from your particular situation. To object, please contact us via email at [email protected].

1.4 Billing with Cooperation / Affiliate Partners

The processes within this category enable communication with cooperation partners for billing and compensation purposes. Statistical transaction data is collected and processed. The following technologies and service providers are used:

• e.g., AWIN, The Reach Group (https://www.awin.com/en/legal/privacy-policy)

1.5 Basic Web Analysis (excluding customer IDs)

The processes within this category are used for the following purposes: non-personal traffic analysis, incident monitoring & alerting, fraud detection, IT management, audience measurement, product development and improvement, and navigation tracking. The following technologies and service providers are used:

• Google Analytics – https://policies.google.com/technologies/partner-sites?hl=en
• Easy Marketing – https://easy-m.de/datenschutz

2. Statistical Technologies

We also use cookies on our website that allow for an analysis of your browsing behavior. The data collected in this context is pseudonymized through technical precautions. As a result, the data can no longer be traced back to you. This data is not stored together with your other personal data. The following data can be transmitted in this way:

(1) Frequency of page views

(2) Usage of website functions

The use of analytics cookies is intended to improve the quality of our website and its content. By analyzing these cookies, we learn how the website is used and can continuously optimize our offerings. This purpose also represents our legitimate interest in processing personal data according to Art. 6(1)(f) GDPR. If you object to the use of these cookies or configure your browser accordingly, this will not cause any disadvantages for you. All functions of the website will still be available. Regarding the retention period of cookies for analyzing browsing behavior, the provisions under Section II apply.

2.1 Website Statistics and Analysis

In addition to basic web analytics, pseudonymous user profiles are also collected in the enhanced web analytics after you give your consent. "Pseudonymous user profiles" refer to profiles anonymized through IP anonymization, which can be linked to personally identifiable information through online transaction data from the online shop.

2.1.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: "Google"). This service uses cookies. The information generated by the cookie about your use of the online offering is generally transmitted to and stored on a Google server in the USA.

Google will use this information on our behalf to evaluate your use of our online offering, compile reports on website activity, and provide other services related to the use of the online offering and the internet. Pseudonymous user profiles may be created from the processed data.

We use Google Analytics with IP anonymization enabled. This means that your IP address is shortened by Google within member states of the European Union or other signatory states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser is not merged with other Google data.

You can prevent the storage of cookies by adjusting your browser settings accordingly; you can also prevent the collection of the data generated by the cookie and related to your use of the online offering from being sent to Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

Further information on Google's data usage for advertising purposes, as well as settings and opt-out options, can be found on the following Google web pages: https://www.google.com/intl/en/policies/privacy/partners/ (“How Google uses data when you use our partners' sites or apps”), http://www.google.com/policies/technologies/ads (“How Google uses cookies in advertising”), http://www.google.com/settings/ads (“Control the information Google uses to show you ads”), and http://www.google.com/ads/preferences/ (“Control which ads Google shows you”).

Alternatively, you can prevent Google Analytics from collecting data within this website by clicking on this link. An opt-out cookie will be placed on your device, preventing your data from being collected by Google Analytics. If you delete your stored cookies, you must click this link again.

For the retention period of cookies, the provisions in Section II apply.

2.1.2 Easy Marketing

We use the tracking technology of easy Marketing GmbH, Asselner Hellweg 124, 44319 Dortmund, on this website to measure and visualize insights into partnerships and advertising channels. This function measures the efficiency of the respective advertising efforts. Additionally, the information enables us to attribute advertising success to the appropriate advertising partners for billing purposes. When you click on an advertising integration, cookies are placed in your browser, which are read in the event of a transaction. At each touchpoint, your browser sends an HTTP request (request) to the easy Marketing server, transmitting certain information. This includes the URL of the web page where the advertisement is placed (referrer URL), the user agent of your device (including information about the device type and operating system), the IP address of the device (this IP address is anonymized and hashed before storage), HTTP headers (data packages automatically transmitted by your browser with various technical information), the time of the request, and, if previously stored, the cookie and its contents. A cookie is a small data package exchanged between your browser and the server. This data package can store and transmit information relevant to the web application, e.g., the contents of a virtual shopping cart.

The tracking technology stores cookies on your device to document actions. A 24-character, anonymous ID is stored in the cookie. The data linked to this ID is encrypted in our database on the server. This includes information about the last touchpoints (i.e., when a particular advertisement was displayed or clicked on by a device). The stored touchpoints can, if necessary, be combined into a sequence chain (user journey). During an action request, the order number and the shopping cart value of your order are usually also transmitted and stored by us. Additionally, the following values may be transmitted and stored: your customer number, new customer status, your age and gender, as well as information you provided during a customer survey.

The cookies stored by easy Marketing are deleted after a maximum of 30 days. The information transmitted to us and the cookies are solely for the purpose of correctly attributing the success of an advertisement and billing the appropriate partner, which is justified by our legitimate interests according to Art. 6(1)(f) GDPR.

If you do not wish to store cookies in your browser, you can adjust the settings accordingly. In your browser, you can disable the storage of cookies under Tools/Internet Options, restrict it to certain websites, or set your browser to notify you when a cookie is sent. Please note, however, that this may lead to a limited display of the online offering and restricted user guidance. You can also delete cookies at any time. In that case, the information stored in them will be removed from your device.

The collection and processing of tracking data can also be deactivated by clicking this tracking opt-out link:

https://trck.easy-m.de/privacy-optout.do

View your data:

https://trck.easy-m.de/privacy-mydata.do

Details of which cookies are used by our tracking technology can be found in the following overview:

• TRS: Unique 24-character identifier (ID) for tracking partnerships. This cookie is stored in the client browser and identifies database records containing touchpoint data.
• TRSCJ: Fallback cookie with rudimentary touchpoint data for tracking partnerships. This cookie stores all touchpoint data encrypted in the client browser.
• trs_db_optout: When clicking on the tracking opt-out link, a special cookie is written that deactivates tracking in the current browser of the device. Tracking is reactivated once you delete the tracking opt-out cookie.

2.1.3 Microsoft Clarity

We work with Microsoft Clarity and Microsoft Advertising to understand how you use and interact with our website using behavioral metrics, heatmaps, and session recordings, to improve and market our products and services. Microsoft Clarity collects data on user behavior, which may include personally identifiable information, such as IP addresses, click paths, mouse movements, etc. Data about website usage is collected using first- and third-party cookies and other tracking technologies to evaluate the popularity of products/services and online activities. We also use this information to optimize the website, for fraud/security purposes, and for advertising. Further information about how Microsoft collects and uses your data can be found in Microsoft's privacy statement at https://privacy.microsoft.com/en-us/privacystatement.

3. Marketing Technologies

We use third-party cookies to learn more about your browsing behavior (web tracking), so that we can display only advertisements that are relevant to you. The processing of your data is based on legitimate interest according to Art. 6(1)(f) GDPR. When you visit our website, a banner will be displayed asking for your consent. In this case, the additional legal basis is Art. 6(1)(a) GDPR.

3.1 Redirecting to Social Media Services

On our website, you will find links to the social media services of Facebook, Twitter, Google+, YouTube, Pinterest, and Instagram. You can recognize these links by the respective company logos. By following these links, you will reach Borussia Dortmund’s company page on the respective social media service. When you click on a link to a social media service, a connection to the servers of the social media service is established. In doing so, the servers of the social media service are informed that you have visited our website. In addition, further data is transmitted to the provider of the social media service. This may include:

• Address of the website where the activated link is located
• Date and time the website was accessed or the link was activated
• Information about the browser and operating system used
• IP address

If you are logged into the social media service at the time of activating the link, the provider may be able to identify your username or even your real name from the transmitted data and associate this information with your personal user account on the social media service. You can prevent this association by logging out of your user account beforehand. The servers of social media services are located in the USA and other countries outside the European Union. Therefore, the data may be processed by the provider in countries outside the European Union. Please note that companies in these countries may be subject to data protection laws that do not provide the same level of protection for personal data as in EU member states. Please also note that we have no influence over the scope, nature, or purpose of the data processing by the provider of the social media service. For more information about how your data is used by the social media services embedded on our website, please refer to the privacy policy of the respective social media service.

Here is the English translation of the provided text:

3.2 Google AdWords

We use Google AdWords on our website, an online advertising tool by Google that enables "remarketing." This allows tailored advertising based on your browsing habits on other websites within the Google Display Network (Google, also known as "Google Ads" and other websites). Your browsing behavior on our website is analyzed to display relevant ads that match your interests on other websites. To do this, Google uses cookies to identify your browser on a specific computer—however, not a person or user. Personal data is not stored. We only use Google AdWords with IP anonymization enabled. This means your IP address is shortened by Google within member states of the European Union or other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser is not merged with other Google data. You can prevent the storage of cookies through a corresponding setting in your browser software. Additionally, you can prevent Google from collecting the data generated by the cookie and related to your use of the online offering, as well as prevent the processing of this data by Google by downloading and installing the browser plug-in available via the following link:

https://policies.google.com/technologies/ads?hl=en

We also use "conversion tracking," which is another part of Google AdWords. When you click on an ad placed by Google, a corresponding cookie is stored on your system. No personal data or other information that could identify a specific user or person is processed. The cookie is used to generate a statistic about "conversion rates," which simply put, represents the ratio between visits to a page and the utilization of the services offered. Cookies for Google AdWords conversion tracking become inactive after 30 days. To learn how to disable personalized advertising and conversion tracking by Google, visit:

https://support.google.com/ads/answer/2662922?hl=en

3.3 Facebook Retargeting Pixel

On our website, we use the "Custom Audiences Pixel" from Facebook Inc., 1 Hacker Way, 94025 Menlo Park, USA, or if you are located in the EU, Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"), due to our legitimate interest in analyzing, optimizing, and operating our online offering economically. This serves the purpose of showing visitors to our website interest-based advertisements during their visit to the social network Facebook. For this, a pixel from Facebook has been implemented on our website. Through this pixel, a direct connection to Facebook's servers is established when visiting our website. Facebook is informed that you have visited our website, and this information is assigned to your personal Facebook user account. Further information on the collection and use of data by Facebook, as well as your rights and options for protecting your privacy, can be found in Facebook's privacy policy at https://www.facebook.com/about/privacy/. You can object to interest-based advertising on Facebook at https://www.facebook.com/settings/?tab=ads#_=. For this, you must be logged into Facebook.

3.4 Outbrain

This website uses technology from Outbrain Inc. ("Outbrain"). Outbrain offers recommendations within its publisher network, which may be paid for by an advertiser. With your consent, Outbrain provides recommendations based on how you interact with content where Outbrain is installed. These recommendations and advertisements appear only on Outbrain ad spaces, either on Outbrain Engage ad spaces or in the Outbrain Extended Network. If you would like to see what information Outbrain has about your interests, you can view and edit your interest profile (such as withdrawing your consent). You can also visit the Network Advertising Alliance or YourOnlineChoices to learn more about other organizations that track your online interactions and opt-out or withdraw your consent for such tracking.

Outbrain's privacy policy also describes how Outbrain collects, uses, and shares your personal information. Outbrain may forward some of your personal information to third-party companies to serve ads that are more likely to match your interests. Visit your interest profile to withdraw your consent for behavioral advertising and/or prevent Outbrain from sharing your personal information with third parties.

3.5 Adition

Adition is responsible for serving ads on our own platforms, websites, and apps as our ad server.

3.5.1 What data is collected?

Adition collects various types of data, including:

• IP addresses: Used to determine the user's geographic location and optimize ad placement.
• Cookie data: Cookies are used to track users' browsing behavior and display relevant ads.
• Device information: Information about the device used (e.g., device type, operating system, browser type) is collected to improve ad delivery.
• User interactions: We collect data on user interactions with ads to measure and optimize performance.

3.5.2 How is the data used?

The collected data is used to:

• Display relevant ads that match users' interests.
• Measure and optimize ad performance.
• Detect and prevent fraud.
• Ensure the security and integrity of our services.

3.5.3 How is the data protected?

We take appropriate security measures to protect the collected data, including:

• Encryption of data transmissions.
• Access restrictions for authorized personnel.
• Regular review of our security measures.

3.5.4 Data sharing

We do not share personal data with third parties unless required by law or necessary to provide our services. In such cases, we ensure that appropriate data protection measures are in place.

3.5.5 Your rights

If you are affected by the processing of your personal data, you have rights under data protection regulations regarding the data controller. Detailed information can be found at https://www.adition.com/datenschutz/.

You can object to the processing of cookies for advertising purposes via the following link: Opt-Out.

After deleting the Opt-Out cookie, you would need to object again. If an Opt-Out cookie is set in your browser, you can also undo it via the following link: Opt-In.

3.6 LinkedIn Ads

We use the LinkedIn Insight Tag conversion tracking tool on our website. The service provider is the American company LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. For data protection-related aspects in the European Economic Area (EEA), the EU, and Switzerland, LinkedIn Ireland Unlimited (Wilton Place, Dublin 2, Ireland) is responsible.

LinkedIn processes data from you, among other places, in the USA. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This may entail various risks for the legality and security of data processing.

As a basis for data processing for recipients located in third countries (outside the European Union, Iceland, Liechtenstein, Norway, and particularly in the USA) or data transfer to such countries, LinkedIn uses so-called standard contractual clauses (SCCs), which are template contracts provided by the EU Commission. These clauses are intended to ensure that your data complies with European data protection standards, even if transferred and stored in these third countries (such as the USA). Through these clauses, LinkedIn commits to maintaining European data protection standards when processing your relevant data, even when stored, processed, and managed in the USA. These clauses are based on a decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

More information on LinkedIn’s standard contractual clauses can be found at https://de.linkedin.com/legal/l/dpa or https://www.linkedin.com/legal/l/eu-sccs.

For more details about the LinkedIn Insight Tag, visit https://www.linkedin.com/help/linkedin/answer/a427660. Further information about the data processed by the use of LinkedIn Insight Tag can be found in the privacy policy at https://www.linkedin.com/legal/privacy-policy.

III. Podigee Podcast Hosting

We use the podcast hosting service Podigee, provided by Podigee UG, Am Walde 2, 56249 Herschbach, Germany. Podcasts are either loaded from or streamed through Podigee. Usage is based on our legitimate interests, i.e., interest in secure and efficient provision, analysis, and optimization of our podcast offerings according to Art. 6(1)(f) GDPR, which also meets your interest in the optimal use of the podcast service. We chose Podigee because it ensures not only the technical and operational know-how but also secure and privacy-friendly handling of your personal data. Podigee processes IP addresses and device information to enable podcast downloads/streaming and collect statistical data such as access numbers. This data is anonymized or pseudonymized before being stored in Podigee's database unless it is necessary for the provision of podcasts. Further information and opt-out options can be found in Podigee's privacy policy: https://www.podigee.com/en/about/privacy.

IV. Log-In/Registration
Large portions of our website can be accessed without registration and without providing your personal details. We offer you the option to voluntarily register for the login area to gain access to exclusive content and information. For this, you must enter your data into a designated input form. The data will be transmitted to us and stored. The data will not be shared with third parties. The following data is collected during the registration process:

(1) Personal details (name, address, date of birth)

(2) Email address

At the time of registration, the following additional data will be stored:

(1) Your IP address

(2) Date and time of registration

You will also register for:

• the BVB FanShop, available at www.shop.bvb.de, operated by BVB Merchandising GmbH, Rheinlanddamm 207-209, 44137 Dortmund, Germany, Phone: +49 231 90200, Fax: +49 231 9020-3500, Email: [email protected] (see the FanShop's privacy policy at: https://shop.bvb.de/datenschutz)
• the BVB TicketShop, available at https://www.eventimsports.de/ols/bvb/, operated by CTS EVENTIM Sports GmbH, Hohe Bleichen 11, 20354 Hamburg, Germany, Fax: +49 40 380 788-598, Email: [email protected] (see the BVB TicketShop's privacy policy at: https://www.eventimsports.de/ols/bvb/de/bundesliga/channel/shop/index/privacy)
• BVB total!, available at www.bvbtotal.de, operated by Sports & Bytes GmbH, Rheinlanddamm 207-209, 44137 Dortmund (see BVB total!'s privacy policy at www.bvbtotal.de under the "Privacy" section)

Borussia Dortmund is perceived by its fans and customers as a unified entity, not as individual legal entities. Therefore, Borussia Dortmund offers a unified registration for all services. From a fan’s perspective, it is impractical to create multiple different accounts solely due to the club and corporate structure. If you choose not to provide the aforementioned data during registration, we will not be able to:

• Grant you access to the exclusive content in the login area of the website www.BVB.de
• Automatically transfer your data for future purchases in the Ticket or FanShop, send you tailored offers
• Inform you about promotions and discounts

Your data will be deleted as soon as it is no longer necessary for the purpose of its collection. For data collected during the registration process, this is generally the case when you cancel the registration or delete your account. However, if the data is required for fulfilling a contract or pre-contractual measures, early deletion can only occur if contractual or legal obligations allow it. We may be required by contract or law to retain data after the contract has ended (e.g., for tax purposes). The applicable retention periods must be determined individually for each contract and contractual party.

V. Contact Form and Email Communication
You can contact us via various contact forms on our website or by email. If you enter data into the input form of the contact form, this data will be transmitted to us and processed. This includes the following data:

(1) Subject/reason for contact
(2) Your name
(3) Email address
(4) Message

Once your message is sent, the following additional data will be stored:

(1) Your IP address
(2) Date and time of transmission

For processing the data for correspondence purposes, we ask for your consent before you send the message and refer to this privacy policy. The legal basis for data processing is Art. 6 (1) lit. a of the GDPR.

The processing of additional data (e.g., connection data) during the transmission process helps prevent misuse of the contact form and ensures the security of our information systems. The legal basis is Art. 6 (1) lit. f of the GDPR.
If contact is made via the provided email address, the personal data transmitted with the email will be stored. The legal basis for processing your data is Art. 6 (1) lit. f of the GDPR, as we have a legitimate interest in processing it. If the contact is related to the conclusion of a contract, Art. 6 (1) lit. b of the GDPR also serves as the legal basis.

We process personal data from the input form or emails exclusively for handling your inquiry. No data will be passed on to third parties.
We delete your data as soon as it is no longer required for the purpose it was collected. For personal data from the contact form and emails, this occurs once the correspondence with you is completed, i.e., when it is clear from the circumstances that the matter has been fully resolved.

Personal data collected during the submission process will be deleted after seven days at the latest.
You can withdraw your consent to the processing of personal data at any time. In the case of contact via email, you can object to the storage of your personal data at any time by sending an informal message to the contact details provided on page 1.
In these cases, we will no longer be able to process your message. If the data is required for fulfilling a contract or pre-contractual measures, early deletion can only occur if contractual or legal obligations allow it. The applicable retention periods must be determined individually for each contract and contractual party.

VI. Newsletter
You can subscribe to our free newsletter. To do so, enter your data into the designated input form, which will be transmitted to us. When signing up, your email address will be collected. Once you send the form, the following additional data will be stored:

(1) Your IP address
(2) Date and time of registration

Before submitting your data, we ask for your consent to this data processing and refer to this privacy policy. The processing of your data is based on your consent. Therefore, Art. 6 (1) lit. a of the GDPR serves as the legal basis.
After signing up, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent the use of someone else’s email address. Newsletter sign-ups are logged to demonstrate the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as your IP address.

Since processing the data is also necessary to deliver the ordered newsletter, Art. 6 (1) lit. b and Art. 6 (1) lit. f of the GDPR also serve as the legal basis.
You can unsubscribe from the newsletter at any time or object to receiving future newsletters. Each newsletter contains a link to the unsubscribe form, allowing you to withdraw your consent to the storage of your data. You may also withdraw your consent by sending an informal message to the contact details provided on page 1.
We delete your data as soon as it is no longer required for the purpose it was collected. Your email address will be stored as long as the newsletter subscription exists. The personal data collected during the registration process will generally be deleted seven days after collection.
If the data is required for fulfilling a contract or pre-contractual measures, early deletion can only occur if contractual or legal obligations allow it. The applicable retention periods must be determined individually for each contract and contractual party.

VII. Internal Data Sharing
If you provide your consent, we will also collect and process address and order data for our own marketing purposes and for those of the following group companies: BVB Merchandising GmbH, Sports & Bytes GmbH, BVB Event & Catering GmbH, BVB Foundation, Football Academy GmbH, besttravel Dortmund GmbH (all based at Rheinlanddamm 207-209, 44137 Dortmund), and Ballspielverein Borussia 09 e.V. Dortmund (Strobelallee 50, 44139 Dortmund). This is based on Art. 6 (1) lit. a of the GDPR.
In certain circumstances, we may also process your data within the group based on legitimate interests. The legal basis for this is Art. 6 (1) lit. f of the GDPR.
You can object to data processing based on legitimate interests or withdraw your consent to data processing at any time by sending an informal message to the contact details provided in Section I.
We delete your data as soon as it is no longer necessary for the purpose it was collected.

Facebook Page
I. Controller under the GDPR
Borussia Dortmund GmbH & Co. KGaA, Rheinlanddamm 207-209, D-44137 Dortmund, Germany, Email: [email protected] ("BVB", "we", or "us") uses the technical platform and services of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook") for the information service offered here. Both BVB and Facebook are considered controllers under the GDPR.

II. Contact Details of the Data Protection Officer
You can reach the data protection officer at:

Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
Phone: +49 231 90200
Email: [email protected]
Website: www.bvb.de

III. General Information
Fanpages are user accounts that can be set up by private individuals or companies on Facebook. We use the Facebook platform to present ourselves to you and other users of this social network and to contribute to the media and opinion market.

IV. Data Processing by BVB If you have a Facebook account, are logged in, and choose to follow our page, you will be displayed to us as a "Follower." In such cases, we process the personal data contained in your profile name and profile picture.

We process the same data when you like, comment on, or share a post from us, even if you do not follow our page. Additionally, we process the same data if you send us a message via the contact function. In such cases, we also process any data you voluntarily provide in your messages. Furthermore, through the "Facebook Insight" feature, which is an indispensable service from Facebook, we receive anonymized statistical data about the users of these pages. This data is collected using cookies that Facebook stores on your system. These cookies each contain a unique user code that remains active for two years and may also be linked to your profile on the platform.

The legal basis for this processing by us is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. For more information on data processing by Facebook and the cookies used by Facebook, please refer to Section V.

We do not conduct any further evaluation of your data. We store your data as long as you follow our page. If you unfollow our page, we no longer process your data. We delete data from messages once the correspondence with you has concluded. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

V. Data Processing by Facebook When you visit our Facebook page, Facebook collects, among other things, your IP address and additional information stored on your PC in the form of cookies. This information is used to provide us, as operators of the Facebook pages, with anonymized statistical data regarding the use of the Facebook page. Facebook provides more detailed information on this at the following link: http://de-de.facebook.com/help/pages/insights.

The data collected about you in this context is processed by Facebook Ltd. and may be transferred to countries outside the European Union. The information Facebook receives and how it is used is described in general terms in Facebook's Data Use Policy. There you will also find information about how to contact Facebook and about settings for advertisements. The Data Use Policy is available at the following link: http://de-de.facebook.com/about/privacy.

The full data policy of Facebook can be found here: https://de-de.facebook.com/full_data_use_policy.

Facebook does not provide conclusive and clear details on how it uses the data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are assigned to individual users, how long Facebook stores this data, and whether data from a visit to the Facebook page is shared with third parties. This is unknown to us. Likewise, we do not know to what extent your data is used for other Facebook products (such as Instagram, Messenger, or other services offered by Facebook).

When you access a Facebook page, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymized (for "German" IP addresses) and deleted after 90 days. Facebook also stores information about its users' devices (e.g., as part of the "login notification" function); Facebook may be able to assign IP addresses to individual users.

If you are currently logged into Facebook as a user, a cookie with your Facebook ID is stored on your device. This allows Facebook to track that you have visited this page and how you used it. This applies to all other Facebook pages as well. Through Facebook buttons embedded in websites, Facebook can record your visits to these websites and associate them with your Facebook profile. Based on this data, content or advertisements can be tailored to you.

If you wish to avoid this, you should log out of Facebook or disable the "stay logged in" function, delete the cookies stored on your device, and restart your browser. This will delete Facebook information that can directly identify you. You can then use our Facebook page without revealing your Facebook ID. If you access interactive features of the page (like, comment, share, message, etc.), a Facebook login screen will appear. After any login, you will again be recognizable to Facebook as a specific user.

For information on how to manage or delete data about you, please refer to the following Facebook Support pages: https://de-de.facebook.com/about/privacy#.

VI. Your Rights Below, we summarize your rights under the General Data Protection Regulation (GDPR).

1. Right to withdraw consent (Art. 7(3) GDPR)

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You will be informed of this prior to giving your consent.

1. Right of access (Art. 15 GDPR)

In accordance with Art. 15 GDPR, you have the right to request confirmation from us as to whether we process personal data concerning you. If this is the case, you have the right to access this personal data and the following information:

• The purposes for which we process the data;
• The categories of personal data being processed;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly if such recipients are located in third countries or are international organizations;
• Where possible, the planned duration for which the personal data will be stored, or, if not possible, the criteria used to determine that duration;
• The existence of a right to rectify or erase personal data, restrict the processing of data, or object to such processing;
• The existence of a right to lodge a complaint with a supervisory authority;
• Where the personal data is not collected from you, all available information about the source of the data;
• Whether automated decision-making, including profiling, takes place according to Art. 22(1) and (4) GDPR, and if so, meaningful information about the logic involved, as well as the significance and intended consequences of such processing for you.

If personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards that ensure compliance with the GDPR by the recipient.

1. Right to rectification (Art. 16 GDPR)

You have the right to request the immediate correction of incorrect personal data concerning you. Additionally, considering the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

1. Right to erasure or "right to be forgotten" (Art. 17 GDPR)

You have the right to request the immediate erasure of your data if any of the following reasons apply:

• The data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent, and there is no other legal basis for the processing;
• You object to the processing based on your particular situation, and there are no overriding legitimate grounds for the processing;
• You object to the processing for direct marketing purposes;
• The data has been unlawfully processed;
• The erasure of the data is necessary to fulfill a legal obligation under European or German law;
• The data was collected in relation to the provision of information society services pursuant to Art. 8(1) GDPR.

If we have made your data public and are obliged to erase it, we will take reasonable steps, considering available technology and the cost of implementation, to inform other controllers that you have requested the deletion of such data.

1. Right to restrict processing (Art. 18 GDPR)

According to Art. 18 GDPR, we may only process data to a limited extent under the following circumstances:

• You dispute the accuracy of your data, and we need time to verify it;
• The processing is unlawful, but you oppose the erasure of your data and request the restriction of its use instead;
• We no longer need the data for processing purposes, but you require it to assert, exercise, or defend legal claims;
• You object to the processing, and it is unclear whether our legitimate interests outweigh yours.

If the processing is restricted, we may only store the data. Further processing is permitted only with your consent, for legal claims, to protect the rights of others, or for important public interests. You may withdraw your consent at any time. You will be notified before the restriction is lifted.

1. Notification obligation (Art. 19 GDPR)

We are required to inform all recipients to whom your data has been disclosed about any corrections, erasures, or restrictions on processing unless this proves impossible or involves disproportionate effort. We will inform you about these recipients if you request it.

1. Right to data portability (Art. 20 GDPR)

You have the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transfer this data to a third party, provided that:

• The processing is based on your consent or a contract, and
• The processing is carried out by automated means.

You may request that we transfer your data directly to the third party where technically feasible. This right must not infringe on the rights and freedoms of others.

1. Automated individual decision-making, including profiling (Art. 22 GDPR)

We do not subject your personal data to decisions based solely on automated processing, including profiling.

1. Right to object (Art. 21 GDPR)

If we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing if the reasons for your objection arise from your particular situation. This also applies to profiling based on these provisions. In such cases, we will no longer process your data unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

You have the right to object to the processing of your data for direct marketing purposes at any time without providing any reason. This includes profiling to the extent that it relates to such direct marketing.

You may object by contacting us directly using the contact information provided at the beginning of this document.

1. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, your workplace, or the location of the alleged infringement, if you believe that the processing of your personal data violates the General Data Protection Regulation. Other administrative or judicial remedies to which you may be entitled remain unaffected by this.

Instagram Page

I. Data Controller in Accordance with the GDPR

Borussia Dortmund GmbH & Co. KGaA, Rheinlanddamm 207-209, D-44137 Dortmund, Email: [email protected] (hereinafter referred to as “BVB,” “we,” or “us”), uses the technical platform and services of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as “Instagram”) for the information service offered here. Both BVB and Instagram are considered data controllers in accordance with the GDPR.

II. Contact Details of the Data Protection Officer

You can reach the Data Protection Officer at:

Attorney Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
Phone: +49 231 - 90 20 0
Email: [email protected]
Website: www.bvb.de

III. General Information

Instagram profiles are user accounts that can be set up on Instagram by private individuals or businesses. We use the platform maintained by Instagram to present ourselves to you and other users of this social network, as well as visitors to our page, and to contribute various types of statements to the media and opinion market.

IV. Data Processing by BVB

If you have an Instagram account, are logged in, and decide to follow our page, you will be displayed to us as a "subscriber." In this context, we process the personal data included in your profile name and profile picture. We also process the same data if you like, comment on, or share a post from us, even if you are not following our page.

Furthermore, we process the same data if you send us a message using the contact function. In this case, we also process any additional data you voluntarily provide in your messages.

In addition, we receive anonymized statistical data about the users of these pages from Instagram. These data are collected using "cookies" that Instagram stores on your system. Each of these cookies contains a unique user code, which remains active for two years and may potentially be linked to your profile on the platform.

The legal basis for this processing by us is our legitimate interest in accordance with Article 6(1)(f) of the GDPR. For more information on data processing by Instagram and the cookies used by Instagram, please refer to Section V. We do not perform any further evaluation of your data. We store your data as long as you follow our page. If you stop following our page, we will no longer process your data.

We delete data from messages once the correspondence with you is concluded. This is the case when it is clear from the circumstances that the matter has been fully resolved.

V. Data Processing by Instagram

When you visit our Instagram page, Instagram collects your IP address, among other information, as well as additional data stored in cookies on your computer. This information is used to provide us, as operators of the Instagram pages, with anonymized statistical data regarding the use of our Instagram page.

The data collected about you in this context is processed by Instagram and may be transferred to countries outside the European Union. Instagram describes what information it collects and how it uses it in its Data Use Policy. There you will also find information on how to contact Instagram and the options for managing your advertising settings.

You can find Instagram’s full data policies here:
https://help.instagram.com/519522125107875/?helpref=hc_fnav&bc[0]=368390626577968&bc[1]=285881641526716
You can find information on how to manage or delete information Instagram has about you here:
https://www.instagram.com/accounts/privacy_and_security/

The extent to which Instagram uses data collected from your visit to Instagram pages for its own purposes, the degree to which activities on the Instagram page are linked to individual users, how long Instagram stores this data, and whether data from a visit to the Instagram page is shared with third parties are not clearly specified by Instagram and are not known to us. We are also not aware of the extent to which your data is used by Instagram for other Facebook products (such as Facebook, Messenger, and other products and features offered by Facebook).

When you access an Instagram page, the IP address assigned to your device is transmitted to Instagram. According to Instagram, this IP address is anonymized (for “German” IP addresses) and deleted after 90 days. Instagram also stores information about the devices its users use (e.g., as part of the “login notification” function), potentially allowing Instagram to link IP addresses to individual users.

If you are currently logged in to Instagram as a user, a cookie with your Instagram ID is stored on your device. This allows Instagram to track that you have visited this page and how you have used it. This also applies to all other Instagram pages. Through Instagram buttons embedded on websites, Instagram can track your visits to these websites and associate them with your Instagram profile. Based on this data, tailored content or advertisements may be offered to you.

If you wish to avoid this, you should log out of Instagram or disable the "stay logged in" function, delete the cookies on your device, and close and restart your browser. In this way, Instagram information that can directly identify you will be deleted, allowing you to use our Instagram page without your Instagram ID being disclosed. If you access interactive features on the page (e.g., "like," comment, share, message), an Instagram login screen will appear. After logging in, Instagram will again recognize you as a specific user.

VI. Your Rights

Below is a summary of your rights under the General Data Protection Regulation.

1.   Right to Withdraw Consent (Article 7(3) GDPR)
You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You will be informed of this before giving your consent.

2.   Right of Access (Article 15 GDPR)
In accordance with Article 15 of the GDPR, you have the right to request confirmation from us as to whether we process personal data concerning you. If this is the case, you have the right to access the personal data and the following information:

1.  
   • the purposes of the processing;
   • the categories of personal data processed;
   • the recipients to whom the personal data have been disclosed or will be disclosed, particularly if they are recipients in third countries or international organizations;
   • where possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration;
   • the existence of a right to rectification or erasure of your personal data, the right to restrict processing by us, or the right to object to such processing;
   • the existence of a right to lodge a complaint with a supervisory authority;
   • where the personal data is not collected from you, any available information about its source;
   • the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) GDPR and, where applicable, meaningful information about the logic involved and the significance and expected consequences of such processing for you. If personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards that ensure compliance with the provisions of the GDPR for such recipients.

3.   Right to Rectification (Article 16 GDPR)
You have the right to demand the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of a supplementary statement.

4.   Right to Erasure or "Right to be Forgotten" (Article 17 GDPR)
You have the right to have your data erased without undue delay if one of the following reasons applies:

1.  
   • The data is no longer necessary for the purposes for which it was collected or otherwise processed.
   • You withdraw your consent on which the processing was based, and there is no other legal ground for the processing.
   • You object to the processing on grounds relating to your particular situation pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing.
   • You object to the processing for direct marketing purposes pursuant to Article 21(2) GDPR.
   • The data has been processed unlawfully.
   • The erasure of the data is necessary to comply with a legal obligation under European or national law.
   • The data was collected in relation to the offering of information society services pursuant to Article 8(1) GDPR. If we have made your data public and are obliged to erase it, we will, taking into account available technology and implementation costs, take reasonable steps to inform other controllers that you have requested the erasure of your data.

1. Right to Restriction of Processing (Art. 18 GDPR)

According to Art. 18 GDPR, we may only process data in a limited manner in the following cases. This is the case if:

• You dispute the accuracy of your data, for the period allowing us to verify the accuracy of the data;
• The processing is unlawful, and you oppose the erasure of the data, requesting instead the restriction of the use of your personal data;
• We no longer need the data for processing purposes, but you require them for the establishment, exercise, or defense of legal claims; or
• You have objected to the processing pursuant to Art. 21(1) GDPR on grounds related to your particular situation, pending verification of whether our legitimate grounds for processing override your interests.

If processing has been restricted, we are only allowed to store the data. Further processing is only permitted with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

You may withdraw your consent given in this context at any time. We will notify you before the restriction is lifted.

1. Notification Obligation (Art. 19 GDPR)

We are obliged to inform all recipients to whom your data has been disclosed about any rectification or erasure of your data or restriction of processing, unless this proves impossible or involves disproportionate effort. We will inform you about these recipients if you request it.

1. Right to Data Portability (Art. 20 GDPR)

You have the right to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit these data to a third party, provided that

• The processing is based on your consent or a contract, and
• The processing is carried out by automated means.

You can also request that we transmit your data directly to the third party, where technically feasible. This right must not adversely affect the rights and freedoms of others.

1. Automated Decision-Making, Including Profiling (Art. 22 GDPR)

We do not subject your personal data to decisions based solely on automated processing, including profiling.

1. Right to Object (Art. 21 GDPR)

If we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing on grounds relating to your particular situation. This also applies to profiling based on these provisions. In such a case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves to establish, exercise, or defend legal claims.

If we process your data for direct marketing purposes, you have the right to object to the processing of your data for such marketing. This also applies to profiling insofar as it is related to direct marketing.

After your objection, your data will no longer be processed for these purposes. To object, simply send an informal message to the contact details listed on page 1.

1. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, place of work, or place of the alleged infringement, if you believe that the processing of your data violates the GDPR. Any additional administrative or judicial remedies available to you remain unaffected.

Twitter
V. Data Processing by Twitter
When you view Twitter content or products, Twitter collects data about your visit, including the respective page, IP address, browser type, operating system, and cookie information. Twitter uses this information to improve its products and services, for example, through personalized suggestions and ads. You can read about what information Twitter collects and how it is protected in Twitter's privacy policy and its article on cookie usage:

Privacy Policy: https://twitter.com/de/privacy
Cookie Usage: https://help.twitter.com/de/rules-and-policies/twitter-cookies

To protect your privacy, Twitter never links your browsing history with your name, email address, phone number, or Twitter username. Twitter deletes, masks, or aggregates the data after a maximum of 30 days, as described in our privacy policy. Your browsing history is not saved for websites where this collection has been disabled (as described below) or for specific domains like .mil and .gov. You and the operators of the websites you visit can also determine whether Twitter may store and use this data.

To control whether Twitter stores information about other websites where you have viewed Twitter content, you can modify the setting "Track where you see Twitter content across the web" in your "Personalization and Data" settings. If you have disabled this setting or are located in the European Union or EFTA states, Twitter does not store or use these website visits to improve your future use of Twitter. If your browsing history has previously been saved, your Twitter experience may still be personalized based on that data.

If you do not want Twitter to show personalized, interest-based ads on or off Twitter, you can disable this feature in various ways:

• In the Twitter settings, adjust the "Personalized ads" option in your "Personalization and Data" settings.
• If you are using a browser, you can disable interest-based advertising on Twitter through a tool provided by the Digital Advertising Alliance at optout.aboutads.info.
• If you are using a mobile device, you can enable the "Limit Ad Tracking" (iOS) or "Opt-out of Personalized Ads" (Android) settings on your device.
• To manage personalization across devices on Twitter, adjust the "Personalize across all your devices" setting in your "Personalization and Data" settings. This setting determines whether Twitter links your account to browsers or devices other than the ones you are logged in with (or if logged out, whether Twitter links the current browser or device to others).

To control interest-based advertising from specific third-party advertising partners, visit optout.aboutads.info and www.networkadvertising.org/choices for more information. On the web, you can also opt out of Google Analytics by installing the browser add-on for disabling Google Analytics. You can opt out of Google interest-based ads in Google settings.

For cookies, you can adjust settings in most browsers to accept or reject all cookies or to prompt you every time a website wants to place a cookie on your computer. Although cookies are not required for all Twitter services, some functions may not work properly if you disable all cookies. For example, you cannot log into twitter.com or pscp.tv if all cookies are disabled.

VI. Your Rights
Below, we summarize your rights under the General Data Protection Regulation (GDPR).

1.   Right to Withdraw Consent (Art. 7(3) GDPR)
You have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of the processing carried out based on the consent before its withdrawal. You will be informed of this before giving your consent.

2.   Right of Access (Art. 15 GDPR)

According to Art. 15 GDPR, you have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have the right to access this personal data and to the following information:

• The purposes for which we process the data;
• The categories of personal data that we process;
• The recipients or categories of recipients to whom this personal data has been or will be disclosed, especially recipients in third countries or international organizations;
• If possible, the planned storage period for the personal data, or if not possible, the criteria for determining this period;
• The existence of a right to rectification or erasure of the personal data, to restrict processing, or to object to processing;
• The existence of a right to lodge a complaint with a supervisory authority;
• If the personal data is not collected from you, any available information regarding the source of the data;
• Whether automated decision-making, including profiling, takes place according to Art. 22(1) and (4) GDPR, and if so, meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for you.

If personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards in place to ensure compliance with the GDPR at these recipients.

1. Right to Rectification (Art. 16 GDPR)

You may request the rectification of inaccurate personal data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

1. Right to Restriction of Processing (Art. 18 GDPR)

According to Art. 18 GDPR, we are only allowed to process data in a restricted manner under certain circumstances. This is the case when:

• You dispute the accuracy of your data, for as long as we need to verify the accuracy of the data.
• The processing is unlawful, and you oppose the deletion of your data, requesting instead the restriction of its use.
• We no longer need the data for the purposes of processing, but you need it to establish, exercise, or defend legal claims.
• You have objected to processing pursuant to Art. 21(1) GDPR, pending verification of whether our legitimate grounds override your interests.

If processing is restricted, we are only permitted to store this data. Further processing is only allowed with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. You can withdraw any consent given in this regard at any time. We will inform you before the restriction is lifted.

1. Obligation to Notify (Art. 19 GDPR)

We are obligated to inform all recipients to whom your data has been disclosed about any rectification, deletion, or restriction of processing of your data. This does not apply if it proves impossible or involves a disproportionate effort. Upon request, we will inform you of these recipients.

1. Right to Data Portability (Art. 20 GDPR)

You have the right to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to have us transfer this data to a third party, provided that:

• The processing is based on your consent or on a contract, and
• The processing is carried out by automated means.

You may request that we transfer your data directly to the third party, where technically feasible. This right must not adversely affect the rights and freedoms of others.

1. Automated Individual Decision-Making, Including Profiling (Art. 22 GDPR)

We do not subject your personal data to decisions based solely on automated processing, including profiling.

1. Right to Object (Art. 21 GDPR)

If we process your data based on a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing if the reasons for doing so arise from your particular situation. This also applies to profiling based on these provisions. In this case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

If we process your data for direct marketing purposes, you have the right to object to this processing, including profiling related to such direct marketing. Once you object, your data will no longer be processed for these purposes. You can file an objection simply by sending an informal message to the contact details provided on page 1.

1. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, your workplace, or the place of the alleged infringement, if you believe that the processing of your data violates the General Data Protection Regulation. Any other administrative or judicial remedies to which you may be entitled remain unaffected.

YouTube Channel

I. Controller within the meaning of the GDPR Borussia Dortmund GmbH & Co. KGaA, Rheinlanddamm 207-209, D-44137 Dortmund, email: [email protected] (“hereinafter: “BVB,” “we” or “us”), utilizes the technical platform and services of YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, represented by Sundar Pichai (Chief Executive Officer) (hereinafter: “YouTube/Google”).

Both BVB and YouTube/Google are controllers within the meaning of the GDPR.

II. Contact Information for the Data Protection Officer You can reach the Data Protection Officer at:

Attorney Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
Tel.: +49 231 - 90 20 0
Email: [email protected]
Website: www.bvb.de

III. General Information YouTube/Google channels are user accounts created on YouTube/Google by individuals or companies. We use the platform operated by YouTube/Google to present ourselves to you and other users of this social network and visitors of our page, as well as to contribute to the media and opinion market.

IV. Data Processing by BVB If you have a YouTube/Google account, are logged in, and decide to follow our page, you will be displayed to us as a "subscriber." We therefore process the personal data contained in your profile name and profile. We process the same data if you like, comment on, or share one of our posts, even if you do not subscribe to our page.

Additionally, we process the same data if you send us a message via the contact function. In such cases, we also process any data you voluntarily provide in your messages.

Furthermore, we receive anonymized statistical data from YouTube/Google about users of our page. These data are collected using "cookies" and "pixels" that YouTube/Google stores on your system or integrates into web pages. These tools allow YouTube/Google to identify your browser with a unique user code, which may also be linked to your profile on the platform.

The legal basis for this processing is our legitimate interest under Art. 6(1)(f) GDPR. For more information about data processing by YouTube/Google and the cookies used, please refer to section V. We do not perform any further evaluation of your data. We store your data as long as you follow our page. If you unfollow us, we will no longer process your data. Data from messages will be deleted once the correspondence is concluded. This is the case when the relevant matter is evidently resolved.

V. Data Processing by YouTube/Google When visiting our YouTube/Google page, YouTube/Google collects data to provide better services to all our users—ranging from basic information like your IP address and language, to more complex insights like ads you find most useful, the people you interact with online the most, or YouTube videos you find interesting. The type of data YouTube/Google collects and how it is used depends on how you use these services and how you manage your privacy settings.

If you are not signed into a YouTube/Google account, YouTube/Google stores data with unique identifiers linked to the browser, app, or device you are using. This allows YouTube/Google to maintain your language settings across different browsing sessions.

If you are signed into a Google account, YouTube/Google also collects data that the company stores in your YouTube/Google account. When you create a YouTube/Google account, you provide YouTube/Google with personal information, such as your name and a password. You may also add a phone number or payment information to your account. Even if you are not signed into a Google account, you may provide YouTube/Google with information, such as an email address, to receive notifications about their services.

YouTube/Google also collects content that you create, upload, or receive from others while using our services. This includes emails you write and receive, photos and videos you store, documents and spreadsheets you create, and comments you make on YouTube videos.

Further information on what data YouTube/Google processes for what purposes can be found here:
https://policies.google.com/privacy?hl=en&gl=us
A privacy check can be found here:
https://myaccount.google.com/privacycheckup?utm_source=pp&hl=en

YouTube/Google uses the collected data to personalize the services offered. This includes providing recommendations, personalized content, and personalized search results. For example, during the security check, you will receive security tips tailored to your personal use of Google products. Google Play uses data, such as information about the apps you have installed and the videos you have watched on YouTube, to recommend new apps that you might like.

YouTube/Google also provides a place where you can review the data stored in your Google account and control its storage. Your Google account includes:
https://myaccount.google.com/?hl=en

Privacy settings:
Activity settings
Here, you can choose what types of activities should be saved to your account. For example, you can enable Location History if you want to receive traffic updates for your daily commute, or save your YouTube watch history to receive better video recommendations:
https://myaccount.google.com/activitycontrols?utm_source=pp&hl=en

Ads settings
Here, you can manage your ad preferences for ads served by Google, both on Google’s own platforms and on websites and apps that partner with Google. You can modify your interests, choose whether your personal data should be used to show you more relevant ads, and activate or deactivate specific ad services:
https://adssettings.google.com/?utm_source=pp&hl=en

About me
Here, you can control what others see about you in Google services:
https://aboutme.google.com/?utm_source=pp&hl=en

Social endorsements
Here, you can decide whether your name and photo should appear next to your activities like reviews and recommendations in ads:
https://myaccount.google.com/shared-endorsements?utm_source=pp&hl=en

Information you share with others
Through your Google+ account, you can decide with whom you want to share data:
https://plus.google.com/settings?utm_source=pp&hl=en

If you are logged out, you can still manage data linked to your browser or device, such as:

·        Personalized Search: Here, you can choose whether to receive more relevant results and recommendations based on your search activity:
https://www.google.com/history/optout?utm_source=pp&hl=en

·        YouTube settings: Here, you can pause and delete your YouTube search history:
https://www.youtube.com/feed/history/search_history?utm_source=pp&hl=en

·        YouTube settings: Here, you can pause and delete your YouTube watch history:
https://www.youtube.com/feed/history?utm_source=pp&hl=en

·        Ads settings: Here, you can manage your ad preferences for ads served to you on Google and across websites and apps that partner with Google:
https://adssettings.google.com/?utm_source=pp&hl=en

VI. Your Rights
Below, we summarize your rights under the General Data Protection Regulation (GDPR).

1.   Right to withdraw consent to data processing (Art. 7(3) GDPR)
You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal. You will be informed of this prior to giving your consent.

2.   Right of access (Art. 15 GDPR)
According to Art. 15 GDPR, you have the right to request confirmation from us as to whether we are processing personal data concerning you. If so, you have the right to access this personal data and the following information:

1.  
   • the purposes for which we are processing this data;
   • the categories of personal data being processed;
   • the recipients or categories of recipients to whom the personal data has been or will be disclosed, especially if they are located in third countries or international organizations;
   • if possible, the planned retention period for the personal data, or, if not possible, the criteria for determining this period;
   • the existence of a right to rectify or delete personal data, or restrict processing, or object to the processing;
   • the existence of a right to lodge a complaint with a supervisory authority;
   • if the data is not collected from you, any available information about its source;
   • the existence of automated decision-making, including profiling, as outlined in Article 22(1) and (4) GDPR, and, if applicable, meaningful information about the logic involved, as well as the significance and the anticipated consequences of such processing for you.

If personal data is transferred to a third country or international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR.

3.   Right to rectification (Art. 16 GDPR)
You can request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

4.   Right to erasure or “right to be forgotten” (Art. 17 GDPR)
You have the right to request the immediate deletion of your data if one of the following reasons applies:

1.  
   • The data is no longer necessary for the purposes for which it was collected or otherwise processed.
   • You withdraw your consent, and there is no other legal basis for processing.
   • You object to the processing under Article 21(1) GDPR due to reasons relating to your particular situation, and there are no overriding legitimate grounds for the processing.
   • You object to the processing for direct marketing purposes in accordance with Article 21(2) GDPR.
   • The data has been unlawfully processed.
   • Deletion is necessary to fulfill a legal obligation under EU or German law.
   • The data was collected in relation to the offer of information society services according to Article 8(1) GDPR.

If we have made your data public and are obliged to delete it, we will take reasonable steps, considering available technology and the cost of implementation, to inform the relevant data controllers that you have requested the deletion of your data.

5.   Right to restriction of processing (Art. 18 GDPR)
Under Art. 18 GDPR, we may only process your data in limited circumstances, such as:

1.  
   • You contest the accuracy of your data, and we are verifying it.
   • The processing is unlawful, but you oppose the deletion of the data and instead request the restriction of its use.
   • We no longer need the data for processing purposes, but you need it for the establishment, exercise, or defense of legal claims.
   • You object to processing under Article 21(1) GDPR, and it is still being determined whether our legitimate grounds override yours.

If processing is restricted, we may only store your data. Further processing is only allowed with your consent, for the establishment, exercise, or defense of legal claims, to protect the rights of another person, or for important reasons of public interest. You can withdraw your consent to restricted processing at any time. We will notify you before the restriction is lifted.

6.   Notification obligation (Art. 19 GDPR)
We are obliged to inform all recipients to whom your data has been disclosed of any rectification or erasure of the data, or the restriction of processing, unless this proves impossible or involves disproportionate effort. We will inform you about these recipients if you request it.

7.   Right to data portability (Art. 20 GDPR)
You have the right to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data directly to another party, provided:

1.  
   • The processing is based on your consent or a contract, and
   • The processing is carried out by automated means.

You may also request that we transmit your data directly to another party, if technically feasible. This right must not affect the rights and freedoms of others.

8.   Automated decision-making, including profiling (Art. 22 GDPR)
We do not subject your personal data to any decision based solely on automated processing, including profiling.

9.   Right to object (Art. 21 GDPR)
If we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to the processing if it is based on reasons related to your particular situation. This also applies to profiling based on these provisions. In such cases, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If we process your data for direct marketing purposes, you may object to such processing at any time. This also applies to profiling related to direct marketing.

After your objection, your data will no longer be processed for these purposes.

To object, simply send an informal notification to the contact details provided on page 1.

10. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, workplace, or the location of the alleged infringement, if you believe that the processing of data concerning you violates the General Data Protection Regulation. This does not affect any other administrative or judicial remedies that you may be entitled to.

App

I. Controller within the meaning of the GDPR

The controller within the meaning of the European General Data Protection Regulation is Borussia Dortmund GmbH & Co. KGaA (hereinafter referred to as: BVB)
Rheinlanddamm 207-209
44137 Dortmund
Germany
Tel.: +49 231 - 90 20 0
Email: [email protected]
Website: www.bvb.de

II. Contact details of the Data Protection Officer

You can contact the Data Protection Officer at:
Attorney Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209
44137 Dortmund
Tel.: +49 231 - 90 20 0
Email: [email protected]
Website: www.bvb.de

III. General Information

This Privacy Policy provides information about the handling of your personal data when using the app. You can use the app effectively without logging in. Most functionalities are available without collecting personal data. When you simply install and use the app without logging in or accessing webview content, we only process a minimal amount of technical information from you. Some of this information could theoretically identify you and is therefore considered "personal data" from a legal perspective. However, we only use this information to provide you with the app and its functionalities. We do not process this information in a way that would allow us to associate it with your name or email address.

The general data privacy policy for Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, besttravel Dortmund GmbH, Fußballakademie GmbH, BVB Asia Pacific Pte. Ltd.), as well as BV Borussia 09 e.V. Dortmund, can be found at the following link: https://www.bvb.de/Datenschutz/Webseite-bvb.de.

The general handling of newsletters, social media, or other IT contacts, as well as data processing during the COVID-19 pandemic, is also extensively explained at https://www.bvb.de/Datenschutz/Webseite-bvb.de, with additional notices provided for each contact.

IV. Legal Basis

We process personal data primarily to fulfill the purposes of the BVB-STIFTUNG "LEUCHTE AUF" and to provide free support from Borussia Dortmund GmbH & Co. KGaA in accordance with Art. 6(1)(1)(b) GDPR or based on our legitimate interest according to Art. 6(1)(1)(f) GDPR, or with your consent under Art. 6(1)(1)(a) GDPR.

1. Fulfillment of a Legal Obligation

The legal basis for processing your personal data by the responsible party is usually Article 6(1)(1)(c) GDPR (fulfillment of legal obligations under foundation law). Your personal data may be processed if and to the extent necessary to fulfill our legal obligations, such as verifying and documenting free support provided.

1. Contract

Another legal basis for processing your personal data by the responsible party is Article 6(1)(1)(b) GDPR (performance of a contract). Your personal data may be processed if and to the extent necessary to fulfill our contractual obligations towards you. This also applies to any processing necessary to carry out pre-contractual measures upon your request.

1. Legitimate Interest

In certain circumstances, we may share your data within Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, besttravel Dortmund GmbH, Fußballakademie GmbH, BVB Asia Pacific Pte. Ltd.), as well as BV Borussia 09 e.V. Dortmund and BVB-STIFTUNG "LEUCHTE AUF", based on our legitimate interest. The legal basis for this is our legitimate interest under Art. 6(1)(1)(f) GDPR, provided your opposing interests do not outweigh our own.

1. Consent

The publication of personal data on the internet or in local, regional, or national print media occurs either as part of a contract or with your consent in accordance with Art. 6(1)(1)(a) GDPR. Contact details for marketing purposes of Borussia Dortmund GmbH & Co. KGaA and its affiliated companies (BVB Merchandising GmbH, BVB Stadionmanagement GmbH, BVB Event & Catering GmbH, besttravel Dortmund GmbH, Fußballakademie GmbH, BVB Asia Pacific Pte. Ltd.), as well as BV Borussia 09 e.V. Dortmund, will only be shared with your consent. If data processing is based on your consent (Article 6(1)(1)(a) GDPR), you can revoke this consent at any time with future effect.

V. Data Processing by BVB

1. Usage without Login

When you simply install and use the app without logging in or accessing webview content, we only process a minimal amount of technical information from you. Some of this information could theoretically identify you and is therefore considered "personal data" from a legal perspective. However, we only use this information to provide you with the app and its functionalities. We do not process this information in a way that would allow us to associate it with your name or email address.

a) Cookies and Similar Technologies

When you use this app, we process technical data that could theoretically identify you, using the cookies/technologies employed in the app. The following software development kits (SDKs) are used for iOS and Android:

iOS:

• Salesforce Marketing Cloud Notifications
• Appcenter Tracking
• Firebase Performance
• Bugsnag Crashlytics
• Smart Ad
• Firebase Crashlytics
• Salesforce Analytics
• Firebase Analytics
• Appcenter Crash Reports

Android:

• Salesforce Marketing Cloud Notifications SDK
• Play Services Measurement SDK
• Firebase Performance
• Smart Ad
• Firebase Crashlytics
• Firebase Analytics

When opening our app for the first time, and anytime thereafter, you can review the functions of the SDKs in our cookie consent solution (under the "Cookie Settings" menu in the app) and set your cookie preferences by checking or unchecking each cookie and then clicking "Save Settings." Your settings will be saved on your mobile device. Therefore, you will need to set them again if you delete the app data, reset the app, or use a different device. More information about the processing of personal data through cookies and similar technologies, as well as how to configure them, can be found in the app's "Cookie Settings" menu (most of the cookies you find under the link in the cookie consent solution are used in connection with webview content on our website).

b) App Permissions on Your Device

To function, the app requires certain permissions to communicate with your device. These permissions are primarily technical in nature, such as enabling a connection to the internet. We do not receive any personal data from you via these permissions, and the permissions are stored only locally on your device. The following app permissions are relevant under data protection law:

• Access to your camera, allowing you to use the "BVB Camera" function in the app;
• Access to your device storage to save images from the "BVB Camera" or other functionalities in the app, to retrieve them, or to enable downloads;
• Display of notifications to deliver push messages via the app.

You can adjust these permissions in your device settings. The app will still function if you disable these options, but some features may not be available.

1. Push Notifications

If you wish, you can receive news via push notifications directly on your device. You can choose the topics for which you want to receive news, such as live tickers for matches (with additional options), news (with additional options), BVB.tv, competitions & voting, fan shop. We process your push message ID and your push notification settings for delivering notifications, as well as your push notification history (i.e., the notifications you have received from us). Push notifications can only be received with your consent. You provide this consent through the "Notifications" setting in the app. The legal basis for this processing is Art. 6(1)(a) GDPR. You can unsubscribe from push notifications at any time in the app settings. We process your personal data for this purpose until you withdraw your consent, i.e., disable push notifications in the app settings. Beyond this, we store your personal data only as long as legally permissible and necessary, for example, to assert or defend against legal claims or as long as legal storage obligations exist.

1. Other App Features, such as Login, Fan Shop, Videos, Tickets

For app features that go beyond the functionalities directly in the app and viewing the content in the app, you will be redirected to our website. This is the case for login, BVB fan shop, videos, tickets, all of which are webview content. For these webview content features, our website privacy policy also applies, which you can find here.

VI. Your Rights
Below, we summarize your rights under the General Data Protection Regulation (GDPR).

1. Right to Withdraw Consent (Art. 7(3) GDPR)

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the legality of processing carried out based on the consent before its withdrawal. You will be informed of this before giving your consent.

1. Right of Access (Art. 15 GDPR)

Pursuant to Art. 15 GDPR, you have the right to request confirmation from us as to whether we process personal data concerning you. If this is the case, you have the right to access this personal data and to the following information:

• the purposes for which we process the data;
• the categories of personal data that we process;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly if disclosed to recipients in third countries or international organizations;
• where possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria used to determine this duration;
• the existence of a right to rectification or erasure of the personal data, or to restrict processing by us, or to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• if the personal data is not collected from you, any available information regarding its source;
• whether automated decision-making, including profiling, as referred to in Art. 22(1) and (4) GDPR, is taking place and, if so, meaningful information about the logic involved and the significance and expected consequences of such processing for you.

If personal data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

1. Right to Rectification (Art. 16 GDPR)

You have the right to request the immediate correction of inaccurate personal data concerning you. Considering the purposes of the processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

1. Right to Erasure or “Right to be Forgotten” (Art. 17 GDPR)

You have the right to request the erasure of your data without undue delay if one of the following reasons applies:

• The data is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based, and there is no other legal basis for the processing.
• You object to the processing pursuant to Art. 21(1) GDPR based on your particular situation, and there are no overriding legitimate grounds for the processing.
• You object to the processing pursuant to Art. 21(2) GDPR for direct marketing purposes.
• The data has been unlawfully processed.
• The erasure of the data is necessary to comply with a legal obligation under European Union or national law.
• The data has been collected in relation to the offer of information society services in accordance with Art. 8(1) GDPR.

If we have made the personal data public and are obliged to erase it, we will take reasonable steps, considering the available technology and the cost of implementation, to inform other data controllers that you have requested the erasure.

1. Right to Restriction of Processing (Art. 18 GDPR)

Under Art. 18 GDPR, we may only process your data in a limited way under certain conditions. This applies if:

• You contest the accuracy of your data, in which case the processing will be restricted until the accuracy is verified.
• The processing is unlawful, but you oppose the erasure of the data and request the restriction of its use instead.
• We no longer need the data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims.
• You have objected to processing under Art. 21(1) GDPR based on your particular situation, pending verification of whether our legitimate grounds override yours.

If processing is restricted, we may only store the data. Any further processing will require your consent or be permitted only for the establishment, exercise, or defense of legal claims, or to protect the rights of another person, or for reasons of public interest. You may withdraw your consent at any time. We will inform you before lifting the restriction.

1. Notification Obligation (Art. 19 GDPR)

We are obligated to inform all recipients to whom your data has been disclosed of any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. Upon request, we will inform you about these recipients.

1. Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data to a third party, provided that:

• the processing is based on your consent or a contract, and
• the processing is carried out by automated means.

You can also request that we transmit your data directly to the third party where technically feasible. This right must not adversely affect the rights and freedoms of others.

1. Automated Individual Decision-Making, Including Profiling (Art. 22 GDPR)

We do not make decisions based solely on automated processing, including profiling, that would significantly affect you.

1. Right to Object (Art. 21 GDPR)

If we process your data based on a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing for reasons arising from your particular situation. This also applies to profiling based on these provisions. In such cases, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If we process your data for direct marketing purposes, you may object to this at any time. This includes profiling related to direct marketing. After your objection, we will no longer process your data for such purposes. You can submit your objection informally to the contact details listed on page 1.

10. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in the member state of your residence, your place of work, or the location of the alleged infringement, if you believe that the processing of your personal data violates the General Data Protection Regulation (GDPR). This does not affect any other administrative or judicial remedies that you may have available.

We comply with all these rights at all times. If you require further information, we will be happy to provide it. Please contact our Data Protection Officer mentioned above.

The full text of the GDPR can be found at https://dsgvo-gesetz.de/.