1. Introduction

1.1 This privacy Policy (“Policy”) describes how FC Red Bull Salzburg GmbH, in the form of the company specified in the legal notice on this Website (hereinafter also referred to as “Red Bull Salzburg GmbH”, “we”, “us”, “our”), collects and processes personal data about you when your visit our Website (“Website”), use our mobile applications and games (“Apps”) or visit or take part in one of our games or events. By continuing to use this Website, you confirm that you have read this Policy.

1.2 Should we make important changes to this Policy (what kind of data we collect, how or why we use this data), we will refer to these changes at the beginning of the Policy for a period of 30 days after the changes have been made and also before they come into effect and insert a corresponding link to them at an easily visible place.

2. Data that we collect

2.1 Data that you share with us. When you visit our Website, correspond with us, take part in one of our competitions or one of our promotional campaigns, answer our surveys, post on our Websites, subscribe to one of our newsletters, purchase our goods or services, book events through the Website, create an account, use our Apps or communicate with or about us through one of our social media platforms, for example using our chatbot tools, then it is possible that you will share data about yourself with us. This may also include data that can be used to identify you (“personal data”). When we ask you to provide specific data, we collect the data that is contained in the relevant forms or on the relevant web pages. In addition, you may provide us with further information at your own request when you get in contact or otherwise interact with us.

2.2 If you are a regular visitor to our Website or Apps, you can set up a user account (“My RBS Account”) with us on request. The data that you give us when setting up the My RBS Account includes your name, your e-mail address and user name, your gender, your country of residence, your telephone number and, where appropriate, your date of birth. If you register in order to set up a user account with us, you will also create your own individual password enabling you to access your account. We also record data about your preferred contents on our Apps and Websites (such as videos that you like) as well as data about the contents that you have selected to access offline (such as videos on our Apps that you download to watch later).

2.3 If you decide to purchase games, Apps (including in-App purchases) or other goods or services on our Website, we additionally collect your delivery address, your billing address and payment information. Please note that we do not store your payment details; this is done by an external payment service provider.

2.4 If you should decide to subscribe to one of our newsletters or to receive other forms of direct communication from us, you may be asked to provide us with your name, your e-mail address, your gender, your date of birth and information about your interests.

2.5 When you visit our Website or use our Apps, we may possibly use your personal data in order to enhance your user experience through recommendations that are specially designed for you. This may include us recommending particular contents to you based on your search history or your Facebook likes/interests. We do not record your user name or your password for Facebook, Twitter or Google+. We may, however, record certain information from these Websites that shows whether you logged in to the App through a Facebook, Twitter or Google+ account. This data is used to access or obtain specific data about you from your Facebook, Twitter or Google+ profile and thus to enhance your user experience and provide you with contents that are important for you. This can be data that you post in your profile. We do not access your personal page settings.

2.6 With your consent, GPS tracking may be used by our Apps in order to provide you with functions relating to your location. The Apps may access the photos and videos that you store on your mobile devices in order to enable you to upload videos and photos to use within these Apps. The Apps may use push notifications, for example to be able to inform you when another player has beaten your high score. When you use an App for the first time, you will be asked whether you would like to use these functions in your settings menu. If you decide not to use these functions or to enable them at a later date, you may not be able to use the full scope of services.

2.7 Data that is collected automatically When you visit our Website or use our Apps, we can automatically collect the following data: your IP address, log-in data, location, browser type and version, browser plug-in types and versions, operating system and platform, information about your visit, including the URL clickstream (sequence of page views) to, through and from our Website, your ID for advertising purposes (if this is supported by your device, for example an Apple or Google product), products that you view and that you have looked for, videos that you have opened, download errors, time that you spend on certain pages and interactions between the pages and Apps, media downloads for offline use, screen resolution, processing and storage capacity of the device, playback errors and buffering problems, user behaviour, such as how long the Apps are used for, as well as device IDs (for example an IMEI address – an identification number assigned to a mobile telephone that is used by GSM networks to enable them to identify valid mobile devices). The data is collected automatically using various technologies, including “cookies” and “web beacons”.

2.8 We may also collect data about you through our security systems if you visit our offices or attend our events.

2.9 Data that we obtain from other sources. We may possibly receive data about you from other sources when you use one of the other services that we offer on our Website or our Apps or when you have provided data to other Red Bull Salzburg GmbH companies or companies affiliated with Red Bull Salzburg AG. We also work closely together with third parties (including business and sponsorship partners, subcontractors for technical services payment services and delivery services, advertising networks, analysis service providers, search engine operators, credit reference agencies, for example) and may receive personal data about you from them (including publicly available data).

3. Why we use your data

3.1 We use the data we have collected in order to give you the best possible user experience when you visit our Website or use our Apps and when you get in contact with us, including when you use our services and products. This includes using your data for the following purposes:

• (a) To provide and improve our products and services: We use your data to provide you with the products and services that you have requested through the Website, including when you make purchases or book an event and when we send you a confirmation e-mail or contact you concerning your account. We use your data to improve and adapt our Website, Apps, products and services so that they are better suited to the behaviour and the technical capabilities of our users.

• (b) To set up and administer your My RBS Account: We use your data to set up your account and manage our relationship with you. We also use your data to communicate with you about your account and our services.

• (c) To administer the Website and Apps: We use your data to administer our Website and Apps for internal activities, including for troubleshooting purposes, and to be able to better understand any errors that you may encounter when you use our Website and Apps.

• (d) To improve the use and the content of our pages and Apps: We use your data to improve the content of our web pages and Apps and to ensure that the contents are presented as effectively as possible for you and your end devices.

• (e) To ensure protection and security: We use data collected on our Website and our Apps in the course of our efforts to guarantee the protection and security of our Website and Apps and to improve the administration of our IT systems. We use the data recorded by our security systems to be able to offer better protection and greater security for the premises and the visitors to our events.

• (f) Marketing: We use your data to communicate with you and to keep you informed about our activities and events as well as the activities and events of third parties that you may be interested in and to offer you suggestions and recommendations on our Website and Apps about goods and services that might be of interest to you. You will receive this information from us by e-mail (subject to your prior consent if this is stipulated by law), in the form of push notifications on our Apps, individual announcements on our Websites, targeted advertisements on our Website, our Apps and external platforms, text messages, via social media or by telephone.

• (g) Online marketing: We use your data to measure and understand the effectiveness of the advertising that we deliver to you and others and to deliver relevant advertising to you. We also use your data when we communicate with you on social media in order to develop and maintain our social media brands.

• (h) To improve and individually tailor the user experience: If permitted by law, we may combine data from external sources, including social media Websites, with the data you have provided and the data we have collected, including data acquired using cookies and web beacons. We can use this data and the combined data to learn more about your preferences as our customer, to improve your user experience on our Website and our Apps and to provide you with information, content and offers that are tailored to you.

• (i) To enable a consistent experience on all devices and platforms: We match the data that we have collected from you and have received from you on one device or platform with the date that we have collected or received from you on other devices or platforms.

• (j) To perform customer services and to process complaints and enquires: We can use your data to offer you more efficient customer services and to process your complaints and enquiries.

• (k) To make necessary disclosures and to enforce rights: We can use your data in order to make the disclosures that are necessary in response to requests for information that we receive from law enforcement and regulatory authorities, supervisory agencies or inspection authorities or in the context of defending legal claims and that we have to comply with by virtue of the law and furthermore in order to enforce our terms and conditions of business and/or this Policy.

• (l) To execute the sale, transfer or restructuring of one of our business units.

4. Legal basis for using your data

4.1 Your personal data is processed on a broad legal basis that includes:

• (a) When you have granted your consent: for example, we require your consent to process your personal data for direct marketing activities, when we use cookie technologies or when we process special categories of personal data, such as your dietary needs,

• (b) When the processing is necessary for the performance of a contract: for example, so that we can carry out the booking for an event or in order to deliver goods that you have ordered in our online shop or to enable an in-App purchase,

• (c) When we have to comply with a legal obligation: for example, we have to disclose your data to a law enforcement authority or to you or our authorised representative who is acting for us in a lawsuit,

• (d) When the processing is necessary for the purposes of our legitimate interests; this includes for example: (1) providing our products and services for you; (2) ensuring that your account is appropriately protected and our Website, Apps, network and information technology are secure and are used properly; (3) gaining a better understanding of how you use our products, services, Apps and Website and implementing improvements; (4) conducting research and analysis on the products and services you want; (5) tailoring our content, marketing, advertising and offers to your specific interests; (6) maintaining a profile in traditional media and on social media; (7) communicating efficiently and conducting social analytics and content performance on social media; (8) ensuring the security of our business operations and those of our business partners as well as monitoring the areas in and around our business premises in order to protect our employees, customers and the general protect against misconduct or criminal activities; (9) developing and maintaining relationships with suppliers, partners and other companies as well as interacting with people working for them; (10) maintaining our knowledge of current market practice in order to ensure that we offer a service that is competitive and meets the expectations of our customers; and (11) determining the effectiveness of the advertising on our Website and Apps and on Websites of partners. In some countries, this type of data processing requires Appropriate consent. We will obtain your consent when we are required to do so by law.

5. Transferring and disclosing data

5.1 We can transfer your data for the purposes specified in section 3 of this Policy to companies affiliated with Red Bull Salzburg GmbH and to third parties, including to external online platforms, social media platforms, establishments that perform a service for us or act as our authorised representatives, which include subcontractors (including their authorised representatives) and specialist consultants, advertising agencies, advertising networks, IT suppliers, database suppliers, backup and disaster recovery specialists, e-mail providers and other service providers that are required in order to improve and products and services.

5.2 * (a) We transfer aggregated, anonymised and other non-personal data to advertising partners, advertising networks and social networks that require this data in order to be able to offer you and other people selected relevant advertisements. We also use aggregated data to help advertising partners reach the type of public that they would like to address.

* (b) We use the personal data that we have collected from you in order to help our advertising partners show their advertisements to a target public and to present our marketing messages to you. This means that you are shown advertisements that are of greater interest to you based on the personal data that we have collected from you.

* (c) We transfer your personal data to parties and access the data of analysis services and search engine providers that provide us with support in improving and optimising the Website and Apps in order to better tailor contents and advertising to individuals.

5.3 Our supplies and service providers are required to comply with our data processing and security standards. The data that we supply to them, including your personal data, is provided only in connection with the performance of their tasks. They are not authorised to use your personal data for purposes other than those specified in this Policy.

6. Opting in or opting out of direct marketing

6.1 We and selected third parties can use the data that you give us on our Website and our Apps for the purposes of direct marketing in order to send you updates, newsletters, event notifications or other messages that we think might be of interest to you.

6.2 If this is required by law, your consent will be obtained before we send direct marketing material to you. In any event, we will give you the possibility in every message that is sent of opting out by unsubscribing.

6.3 You can object to receiving direct marketing material from us by contacting us by e-mail using the e-mail address specified in section 17 or by registering to opt out using the possibilities provided in our e-mail communications.

7. Analysis and advertising tools

7.1 In order to ensure that our online advertising is tailored and of interest to you, we analyse your behaviour on our Websites, partner Websites and Apps as well as your interactions with us. For example, we track your behaviour when you click on articles or our advertisements (that are placed on our Websites or external Websites), when you interact with us on social media (by mentioning us or our products), when you communicate directly with us (including via our chatbot tools that are used on social media), when you buy tickets for one of our events, when you purchase products from us, when you attend our events, when you open and interact with our marketing communications, and we also track where you have come from when you visit our Website or download our Apps.

8 Cookies and other technologies

8.1 We collect data automatically by using “cookies”. Cookies can be placed by us or by third parties. A cookie is a text file containing a small amount of data that a Website can send to your browser and that is then stored as an anonymous tag on your computer to identify your computer, but not you. Some of the pages on our Website use cookies to offer you better services when you return to the Website. You can set in our cookie settings which cookies we may enable.

8.2 We also use web beacons, which are generally also known as one-pixel GIFs, clear GIFs or tags. Web beacons are small graphic files that may be contained on our Website. Web beacons allows us to optimise our products and services and to deliver analysis data to third-party partners, for example on how many visitors our Website has. We may also use web beacons in our e-mail correspondence in order to determine whether you open an e-mail or carry out other actions. We also work together with other organisations in order to place our web beacons on their Websites or in their advertisements. We do this so that we can generate statistics on how often clicking on an advertisement on a Website of Red Bull Salzburg GmbH or of an advertising partner leads to a sale or another interaction on an advertising partner’s Website.

8.3 We collect data automatically by using device IDs (“IDs”) for our Apps. An ID here is a specific sequence of numbers and letters (character string) that is assigned to your device, but that does not identify you. The ID allows us and third parties that we have selected to record your behaviour when you use the App. Virtually every App uses ID technology. IDs serve a variety of purposes: for example, they remember your preferences and generally ensure a better user experience. IDs can tell us for example whether you have used our App once before or whether you are using it for the first time. They can thus ensure that advertisements that you see on the App are tailored to you and your interests. Because of this function, IDs are extremely useful for enhancing your user experience.

9. Links to other Websites and social media

9.1 Links to other Websites are provided for information purposes only. We do not have any control over other Websites and they are not covered by this Policy. When you visit other Websites by clicking on the indicated links, data about you may possibly be collected by the operators of these Websites, which can then be used by the operators in accordance with their own privacy Policy in a way that may be different from our Policy.

9.2 Some pages of our Website may provide contents, Applications or plug-ins from third-party providers that track and/or optimise your use of contents, Applications or plug-ins. For example, if you share an article with others using a share button for social media (e.g. Facebook, Twitter or Google Plus) on our Website, this procedure will be recorded by the social network that has created the button.

10. Data retention

10.1 We will not retain your data for any longer than is required for our business purposes or on the basis of legal and regulatory requirements.

10.2 We will retain your data as long as you maintain a My RBS Account at Red Bull Salzburg GmbH and will continue to do so if this is necessary in order to fulfil our legal obligations, for example our obligations to retain the data for tax and accounting purposes. Your data is retained in accordance with our internal regulations on data retention.

10.3 If you object to or have opted out of receiving direct marketing material, we will remove your contact details and your consent and agreement to marketing campaigns in order to ensure that you no longer receive any advertising messages from us in the future. Personal data is not erased by us if it is required for examination and investigation purposes or in the context of a legal dispute. In this event, the data is stored until the matter is completely resolved.

10.4 We will continue in all cases to protect your personal data in accordance with the provisions contained in this Policy. We will also routinely update our data in order to ensure that it always reflects the latest situation.

11. Your rights

11.1 Depending on the applicable law, you have or, in particular circumstances, may have the following rights concerning your personal data:

• (a) Right to access your personal data. If you would like a copy of the personal data that we have stored about you, please contact us using the e-mail address specified below. Before we respond to your request, we may ask you to verify your identity and to provide further details about your request. We will endeavour to process your request within a reasonable time frame, but within the period stipulated by law in any event.

• (b) Right to rectification, erasure or restriction of the processing of your personal data. Please contact us using the e-mail address specified below if you would like to rectify, erase or restrict the processing of your personal data. It is your responsibility to ensure that you provide true, correct and complete information and always keep it up to date.

* (c) Right to withdraw consent. If you have given your consent to the processing of your data, you can withdraw this consent at any time by contacting us using the e-mail address specified below in section 17.

* (d) Right to data portability. You can ask us to help you to transfer some of your data to other companies. In this connection, you are entitled to request us to transmit your data to another company in an easily readable format. You can submit your request by sending an e-mail to the e-mail address specified below.

* (e) Right to object. You can object to way in which we process your personal data or to direct marketing based on profiling if there is a legitimate interest in this by submitting your request by e-mail to the e-mail address specified below.

* (f) Right not to be subject to a decision based solely on automated processing. (Please see section 17 below for more details on this.)

* (g) Right to lodge a complaint with a supervisory authority You can contact your local supervisory authority if you have a complaint about the way in which we handle your personal data.

11.2 If you have set up a user account, you can use it to access the personal data that we have about you and to receive a copy of the data as well as to make corrections or additions to data that is incorrect or to erase this data. You can also close your My RBS Account at any time.

11.3 Please contact us using the e-mail address specified in section 17 below if you would like to exercise any of your rights that are listed above.

12. Profiling

12.1 We can use your data to attempt to learn more about you so that we can better predict, where appropriate, which products and services you might be interested in.

12.2 On the e-commerce Website, which is operated by a third party, service providers that use automated decision-making processes are engaged to check your address and your credit rating. It can be ensured in this way that the correct address details are used and the risk that products and services will not be paid for is assessed.

13. Security of the data

13.1 We use physical, technical and administrative measures to protect your personal data that we store against unauthorised access, collection, use, publication, reproduction, amendment or erasure. All data that your provide to us is stored on secure servers.

13.2 If you have a password for accessing our Website or App, you are responsible for keeping the password secure and confidential.

14. International transfer

14.1 Because the Internet offers a global environment, collecting and processing personal data via the Internet necessarily means that data is transferred internationally. We normally store personal data that we collect about you via our Website in your region (for example in the European Economic Area in the case of visitors from Europe), but it is possible that your personal data will also be transferred to parties outside your region (where other data protection legislation applies, e.g. in the US), including to affiliated companies of Red Bull Salzburg GmbH.

14.2 We have implemented safeguards and data protection solutions when this happens in order to ensure that your data is appropriately protected in third countries, for example by using standard contractual clauses. Please contact us using the e-mail address provided in section 17 if you would like more information on this.

15. Use of the Website or our Apps by minors

15.1 By using this Website or App, you confirm that you are aged over 16. If you are 16 years old or younger, you must first get the consent of your parents/guardian before you can send us data through our Website or Apps. Providing data is prohibited without this consent. If you nevertheless send us data, we will stop processing it as soon as we become aware of the situation.

16. Amendments to the Policy

16.1 This Policy was last updated on 11 April 2022. Every time that material amendments are made to this Policy, notification of the amendments will be published on our Website for a period of 30 days. By continuing to use our Website, you agree to accept the amendments in question.

17. Questions, concerns and complaints concerning the Policy, contact details of the data protection officer

17.1 Should you have any questions, concerns or complaints relating to this Policy or how we handle your data, please send us an enquiry to: datenschutz@redbullsalzburg.com

The original version of the Rules is in German. Any translated version is for your convenience and information only. In case of disputes the German text shall prevail.

Version: 11 April 2022

Privacy Policy