Data protection and the private sphere of the users are very important to OneFootball GmbH (hereinafter referred to as "OneFootball"). The gathering and use of your personal data takes place exclusively within the framework of the statutory provisions of applicable data protection laws. By means of this data privacy policy, OneFootball is providing information concerning the processing of personal data on the OneFootball websites and in the web applications (hereinafter referred to jointly as "websites").

1 Point of contact

The contact and so-called responsible body for the legality of the processing of your personal data under data protection laws is OneFootball GmbH Greifswalder Str. 212 D-10405 Berlin

Should you have any questions relating to data protection, you can get in touch with our company's data protection officer at any time. The data protection officer can be contacted at the postal address above, as well as by email at privacy@OneFootball.com. The data protection officer is also available should you have any queries concerning the transfer of data to third countries and can provide copies or guarantees in the form of standard data protection clauses. Should you have any general concerns or queries, you can also contact OneFootball by email at feedback@OneFootball.com.

2 Area of applicability

This data privacy policy applies to all OneFootball websites with all online offers, content, functions and services, even if these only contain seasonal, short term or event related services (for example European Championships or World Cup, special features). If you are interested in data protection of our apps, please read the Data Privacy Policy (apps) of the OneFootball apps.

3 Processing of personal data

Personal data is processed, if you simply access our website (information related use) and if you enter data or click on buttons (use with interaction). Personal data is information relating to factual or personal relationships of a defined or definable natural person. Above all, this includes information which allows your identity to be traced, for example name, address or email address or also favourite team.

Statistical data, which we gather during a visit to our apps for example and which cannot be connected to you, does not come under the definition of personal data.

3.1 Information related use

In case of simple information related use of the website, i.e. if you have not logged in and do not transfer other information to us, we do not gather any personal data, with the exception of the data which your browser transfers in order to allow you to visit the websites. These include:

IP address Date and time of the access Time zone difference to GMT Content of the request (concrete page) Access status / HTTP status code Respective data quantity transferred Website from which the request originates Browser Operating system and its interface Language and version of the browser

The IP addresses are deleted after the end of the use or are anonymised after a maximum of seven days. In case of anonymisation, the IP addresses are altered in such a way that the individual information concerning personal or factual circumstances can no longer be assigned to a person or only with a disproportionately high degree of expense in terms of time, costs and manpower. The data in so-called log files is evaluated by us in anonymised form in order to continually improve our apps and make them more user friendly, as well as in order to find and correct errors more quickly. In addition, this is used in order to manage server capacities, in order to be able to make corresponding data volumes available, when required.

The data processing is necessary so that you can find out about the content of OneFootball. The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of OneFootball in informing users of our content. The processing of the named data is necessary in order to provide the content. Otherwise, it is not possible for you to use the website as requested.

3.2 Use with interaction

In contrast to our apps, there is not much scope for interaction on our websites. You can currently participate primarily in surveys. The data is only saved by using cookies (see number 6 below), is not assigned to your person and is deleted once the survey is removed from the respective website (which can differ depending on the survey).

3.3 Processing when using the feedback option

If you chose to give us feedback using the relevant features on the website, we will use Usabilla, a product from Surveymonkey (SurveyMonkey Europe UC, 2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland). SurveyMonkey enables us to learn more about your enquiry and direct you to relevant articles in our FAQs. If there is yet to be a relevant answer listed then Surveymonkey allows us to categorise your enquiry, helping us process it more quickly. If you use the feedback option on the website, only your email address, IP address and the information you provided will be processed. The information you provide (excluding your IP address) will be transferred to our service provider Zendesk (an offer from Zendesk Inc., 1019 Market St, San Francisco, CA 94103, USA). Also, should you contact us by email your email address will only be processed by Zendesk. In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. With Surveymonkey, we have also agreed so-called "standard contract clauses". Zendesk is also one of the few software providers in the world that introduced company-wide “Binding corporate rules”, that have been approved by the EU Commission, Article 47 GDPR. Further information on data protection can be found in the privacy statements of Zendesk and Surveymonkey. All data collected will be deleted by Zendesk within 6 months. For Surveymonkey we delete the data after one month.

The legal basis for the processing operations regarding Usabilla/Surveymonkey described above is Art. 6 Para. 1, a) GDPR, your consent. Art. 6 Para. 1f.) GDPR, our legitimate interest in improving our product and being accessible for our users, is the legal basis for the use of Zendesk.

3.4. OneFootball uses YouBora, a service provided by NicePeopleAtWork S.L. "NPAW", C/ Roc Boronat 23, 08005 Barcelona, Spain, to analyze video errors. With the help of Youbora, OneFootball can detect and analyze reasons for errors during video playing.

The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of OneFootball in providing error-free video and picture contents.

In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU.

3.5 Processing when using OneFootball with registration

You can use OneFootball both with and without registration. You can register with your account of a social network, in order to further personalize OneFootball. In addition, there is the option of uploading a profile picture and selecting a username. This takes place solely on a voluntary basis.

The OneFootball apps therefore provide extended personalization functions in order to

a) Via incorporated social media services, this personalization can be carried out by the user in the apps. For this purpose, OneFootball uses the systems "Facebook Sign In" (a service of Facebook Inc, 1601 Willow Road, Menlo Park, California, 94025, USA) and "Google+ Sign In" (a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. A connection between the apps and the Facebook or Google account takes place. From Facebook, we save and process the email address, the URL of the profile picture, the name, the public profile and the token. From Google, we save and process the standard entitlements set by Google. These are the profile, JWT (token) and Google ID. We transfer our app ID to both services. These extended personalization functions are optional and you can remove the personalization and connection with the social media services in the app at any time. The purpose and scope of the data collecting and the subsequent processing and use of the data by the social media providers, as well as your rights and settings options in this respect concerning the protection of your private sphere can be found in the data protection notices of Facebook or Google.

b) You can register and sign in to our apps with "Sign in with Apple". "Sign in with Apple" is a service of Apple Inc. One Apple Park Way, Cupertino, California, USA, 95014. This will link your Apple ID and the OneFootball apps together. You have the option to share or hide your email address in your iPhone settings. If you choose "share email address", we will receive the email address and name associated with your Apple ID. With hide e-mail address, Apple's email relay service, you can create a unique, random email address that forwards email to your home email address. This allows you to receive messages from the app without sharing your home email address with us.

We do not share any information with Apple; through your connection to Apple, your IP address is transferred to Apple. Responsible for the processing of personal data for individuals, within the European Economic Area, is Apple Distribution International ltd., Hollyhill Industrial Estate, Hollyhill Cork, Republic of Ireland. In the event that personal data is processed outside of the European Union, the provider has undertaken to comply with EU data protection standards. For more information about any data processing by Apple, please refer to the Apple Privacy Policy.

The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of OneFootball in providing extended functions for a more personal use experience. This is also the legal basis for the general processing when using the apps with registration, based on the legitimate interest in creating synchronization options between end devices and providing functions with social interaction options. Should you not wish to use the registration, the described functions cannot be used, however basic use of the apps is possible.

c) You can register using your email address. When you register by email, we collect the following data:

E-mail address

Name

The legal basis for this data processing is Art. 6 para. 1 b) GDPR.

We use Firebase. Firebase authenticates users with their email addresses and passwords. The Firebase Authentication SDK provides methods to create and manage users logging in with their email addresses and passwords. Firebase is a service provider of the company Google Inc. responsible for Google services in the European area in Google Ireland Limited.

If data is processed outside the European Union, Iceland, Liechtenstein and Norway, in so-called, third countries, Google uses so-called standard contractual clauses, Art 64 (2) & (3) DSGVO, which are based on the implementing decision of the EU Commission: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de Google Privacy Policy: https://policies.google.com/privacy?hl=en-US and the Google Ads Data Dissemination Terms: https://business.safety.google/adsprocessorterms/

3.6 Surveys

Through AirShip, we regularly send out opportunities within the app to participate in surveys (via in app message). We conduct these surveys using Surveymonkey (SurveyMonkey Europe UC, 2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland). You can access the surveys via a link directly to Surveymonkey. Participation is voluntary. These surveys are mostly anonymous, which means that no personal data is processed. For statistical purposes, we sometimes collect data such as gender, age, place of residence, etc.. For some surveys, we ask for your email address in case you want to participate in further surveys and/or interviews. If you participate in interviews, you will receive a separate privacy notice. SurveyMonkey may process information about the device and application you use to take the survey, among other things. This includes IP address, version of your operating system, device type, and system and performance information and browser type. If you participate in the survey through a mobile device, SurveyMonkey also collects the device's UUID. SurveyMonkey also uses so-called third-party tracking services, which in turn use cookies and page tags to collect usage data and user statistics. OneFootball has no control over the data collected by SurveyMonkey. In the event that personal data is processed outside the European Union area, SurveyMonkey has committed to comply with EU data protection standards. With Surveymonkey, we have additionally agreed to so-called ""standard contractual clauses"". For more information on data protection, please see Surveymonkey's privacy policy. The legal basis for these processing operations for the use of Surveymonkey is your consent according to Art. 6 para. 1, a.) of the GDPR.

3.7 Newsletter

If you give us your consent to send you news, products and promotions, the data in the form will be transmitted to us.For the registration to the newsletter we use a double-opt-in-process. After registration, you will receive an e-mail. By clicking on the link in the e-mail, you confirm that we may send you e-mails. When you register for the newsletter, your IP address and the date and time of registration are stored. This prevents misuse of the services or the email address of the data subject. We use this data only for sending news, products and promotions so the data. You can withdraw your consent to the storage of personal data at any time, there is a corresponding link in each newsletter. The legal basis for the processing of the data after registration for the newsletter by the user is, if the user has given his consent, Art. 6 para. 1 lit. a) GDPR. The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 (3) Act against Unfair Competition.

4 Facebook Fanpages

We operate fanpages on Facebook to get in touch with our fans, to inform you about our content and to keep you up to date in general. When you use our Facebook Fanpages, your data is processed. Besides data processing that takes place when you comment on our contributions or communicate with us, there is more data processing taking place on the fanpages: overviews and insights into the use of our Facebook pages are created (more information can be found here). The usage behaviour of fanpage users is evaluated in order to place advertisements inside and outside Facebook. Facebook Ireland Limited (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) and OneFootball GmbH are jointly responsible for this data processing (see Agreement on Joint Processing). In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. Data processing for the purposes mentioned above is based on our legitimate interest in contacting and communicating with you as a user, as well as on our legitimate interest in financing our services with advertisements, Art. 6 lit f) GDPR.

Further information can be found on the Facebook data protection pages. You can opt-out from this data processing here. With regard to your rights such as access, deletion, and correction, related to the collected data about your usage behaviour, we recommend that you contact Facebook directly because the processing takes place there.

Disclosure of personal data

In principle OneFootball does not pass your personal data on to third parties. The data gathered by us is only passed on to third parties, if this is necessary to provide the technical functionality of the websites or another legal basis for the disclosure of data exists. Personal data may only be used by our service providers in order to fulfil their tasks. These were carefully selected by us and engaged in writing. They are subject to our instructions and are regularly monitored by us. Other use of the information is not permitted and is not carried out by any of the service providers used by us.

Alongside the service providers listed separately in this data privacy policy, data may be disclosed to individual categories of recipients, i.e. to companies in order to support promotions and special campaigns, as well as to external advisors and enforcement authorities.

6 Privacy Settings and Cookies

6.1 Privacy Settings

In your first sessions on our website, you will be presented with a Privacy Screen where you can choose whether you would like to consent to advertising or analysis technologies or not. The apps can be used without your consent to this data processing. You may refuse disclosure to all or some partners by clicking on “Info & Settings” in the Privacy Screen and then choosing “Disagree to all”. Your consent therefore is voluntary and may be revoked at any time by deactivating the relevant processing or all the processing in the Privacy Screen accessible via Privacy Settings in the footer of the website. In order to review the individual processes, please review our partners and processes in the Privacy Settings. There you will find detailed information about our partners with the links to their respective Privacy Policies and a list of purposes for your data is processed. In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. In case that personal data is transferred to other countries which do not have a reasonable level of data protection in accordance with the opinion of the European Commission, similarly the so-called "standard contractual clauses" have been agreed with the partner.

In order to manage consent, we use the service of Didomi, a company based in 10 rue Vaudetard, 92130 (Issy-les-Moulineaux), France. We will ask you for your consent via a Privacy Screen to disclose information with certain partners and/or for specific uses. Your choice will be saved on your device and communicated to all partners. The legal basis of this data processing is your consent under Article 6 Paragraph 1 a) GDPR.

6.2 Cookies

Cookies are small files which are saved on your data carrier and which save certain settings and data for the exchange with our system via your browser. Cookies cannot start any programmes or transfer viruses to your computer. The purpose of cookies is to make the Internet service more user friendly and effective overall. As a rule, there are two types of cookies, so-called session cookies which are deleted once you close your browser (= end of the session) and temporary/permanent cookies, which are saved on your data carrier for a longer period of time or permanently. This saving helps us design our website and makes the use of it easier for you, as certain information is saved which means you do not need to constantly repeat the process (for example, saving the language in which the websites were viewed). Analysis procedures are also based on cookies (see Number 7 Analysis). You can delete the cookies in the security settings of your browser at any time and configure your browser setting to your wishes (for example, the acceptance of third party cookies or the rejection of all cookies). As a rule, you will be informed how to reject new cookies and delete existing cookies in the menu list of your web browser via the help function. However, we wish to point out that in such a case, you may not be able to use all functions of our websites.

7 Analysis

In order to improve our website www.OneFootball.com, we use Localytics (a service of Localytics, Inc., 8th Floor, 101 Arch St, Boston, MA 02110, USA) helps us to understand the user’s problems as well as gives us insight on how many we users we have, we look at this data in an aggregated form and not at a single user behavior. This procedure takes anonymously or on the basis of pseudonyms. As shown above, you can configure your browser in such a way that it rejects cookies. As described under 6.2.

8 Inclusion of videos

We have included videos in our websites which are saved with YouTube and which can be played directly from our websites. YouTube is a group company of Google and a multimedia service of YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. We include the videos using the extended privacy mode.

By means of the visit to our websites, YouTube is informed that you have accessed the corresponding sub-page of our websites. This takes place regardless of whether you are logged into YouTube or not. Should you be logged in to YouTube, your data is however assigned directly to your account. Should you not wish for this to take place, you need to log out before viewing the video.

YouTube saves your data as usage profiles and uses these for the purposes of advertising, market research and designing its website in line with customer requirements. Such an evaluation takes place even for users who are not logged in. As shown above, you can configure your browser in such a way that it rejects cookies or you can prevent the recording and processing by Google of the data generated by the cookies which relates to your use of this website by deactivating the "Personalised advertising on the web" button in the Google advertising settings. In this case, Google will only continue to display general advertising which was not selected on the basis of the information relating to you which was recorded.

In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of OneFootball in providing video and picture contents.

The purpose and scope of the data gathering by YouTube, as well as the further processing and use of your data there and your rights and settings options for the protection of your private sphere in this respect can be found in the Data privacy policy of Google.

9 Your rights

You have the right to information about the processing of your personal data by us at any time. In this context we will explain the data processing to you and provide you with an overview of the data stored about you. If data stored by us is incorrect or no longer current, you have the right to have this data corrected. You can also request the deletion of your data. If, in exceptional cases, deletion is not possible due to other legal regulations, the data will be blocked - provided the necessary conditions are met - so that it is only available for this legal purpose. You can also have the processing of your personal data restricted if, for example, you doubt the accuracy of the data. Under certain conditions, you also have the right to data transferability, i.e. that we send you upon request a digital copy of the personal data you have provided us with. In order to assert your rights described here, you can contact us at any time using the contact details given above. This also applies if you wish to receive copies of guarantees to prove an adequate level of data protection.

Your inquiries regarding the assertion of data protection rights and our answers to them will be kept for documentation purposes for a period of three years and in individual cases for the assertion, exercise or defense of legal claims even beyond this period. The legal basis is Art. 6 Paragraph 1, f.) GDPR, based on our interest in defending against any civil law claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR and fulfilling our accountability under Art. 5 GDPR.

You have the right to revoke a consent previously provided to us at any time. The consequence of this is that we will no longer process your data in relation to that consent in the future. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation. If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time for on grounds relating to your particular situation. If you object to data processing for direct marketing purposes, you have a general right of objection, which we will implement without requiring you to state your reasons for objecting. If you wish to exercise your right of revocation or objection, simply send an informal message to the contact details listed above.

Finally, you have the right to complain to the regulatory authority responsible for data. You can exercise this right at the regulatory authority in the member country of your place of residence, your place of work, or the place in which the violation allegedly took place. In Berlin, where the registered office of OneFootball is located, the regulatory authority is: the Berlin Data Protection and Freedom of Information Officer, Friedrichstrasse 219, 10969 Berlin.

10 Changes to the data privacy policy

We reserve the right to alter this data privacy policy. The current version can be accessed via our apps.

As of: August 2021