PROFESSIONAL FOOTBALL CLUB LUDOGORETS 1945 AD, UIC: 201280347, is a personal data controller (hereinafter ‘controller’) with the following registered office and management address: city of Razgrad 7200 68a Aprilsko Vastanie St. 7th fl. You can contact the Company at the address provided, as well as via the following e-mail: [email protected].

On matters related to the processing of personal data by the Company, you can contact our Data Protection Officer via the following e-mail: [email protected], as well as via the following phone number: +359879580777.

Data subjects have the following rights with regard to the processing of their personal data:

• right to access — you have the right to receive information from us as to whether personal data pertaining to you is being processed; you have the right to access the data and information related to the processing;

• right to rectification — you have the right to request that we rectify any inaccurate personal data concerning you and to provide additional data, including by submitting a declaration for the correction of inaccurate or incomplete personal data;

• right to erasure — you have the right to request the erasure of your data and you have the right to have the relevant data erased; the data may not be erased despite your request when there is a legal basis for its processing, with each case being considered separately and data subjects being informed of the decision made;

• right to restriction of processing — you can exercise this right in the following situations: a) when you are contesting the accuracy of the personal data, for a period enabling the Company to verify the accuracy of the personal data; b) when the processing is unlawful but you don't want to have the personal data erased and instead request the restriction of its use; c) when the Company no longer needs the personal data for the purposes of the processing but you require it for the establishment, exercise or defence of legal claims; d) when you objected to the processing pending the verification whether the legitimate grounds of the Company override your interests;

• right to objection against the processing — you have the right to object to the processing of personal data concerning you which is based on the legitimate interests of the Company;

• right to data portability — you have the right to have the data that we store about you and that you have provided to us transferred to you or to another controller in cases where it is processed by automated means and on the basis of your consent or of a contract;

• right to withdrawal of consent — you have the right to withdraw your consent to the processing of personal data at any time (when the basis for the processing of the personal data is consent); the withdrawal of consent shall take effect going forward and shall not affect the consent given prior to the withdrawal;

• rights pertaining to automated decision-making, including profiling — you have the right to not to be the subject of a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;

• right to lodge a complaint with the Commission for Personal Data Protection and/or with the relevant competent court — if you believe that we are processing your personal data in an unlawful manner, you have the right to lodge a complaint with the Commission for Personal Data Protection, whose contact details are available on its website: https://www.cpdp.bg/, address: city of Sofia 1592, No 2 Prof. Tsvetan Lazarov Blvd., e-mail: [email protected], and/or with the relevant competent court; please contact us prior to that so we can take immediate action.

You can exercise your rights under the General Data Protection Regulation in any of the following ways:

• You can contact our Data Protection Officer electronically via the following e-mail: [email protected]; or

• You can contact our Data Protection Officer electronically via the following e-mail: [email protected]; or

• by submitting a written request to PFC LUDOGORETS in person or by post to the following address: city of Razgrad 7200 68a Aprilsko Vastanie St. 7th floor

For your convenience, we have prepared an application form.

PFC LUDOGORETS shall issue a decision on the data subject's request within 1 month of its receipt. That period may be extended by a further 2 (two) months where necessary, due to the complexity or number of the requests.

In the course of data processing PFC LUDOGORETS shall implement appropriate and robust technical and organisational measures to ensure its protection.

Information about our processing of personal data in the various relationships we participate in can be found in the following links.

Your personal data is not collected arbitrarily and indiscriminately. PFC LUDOGORETS strictly observes regulatory requirements for the processing and protection of personal data, does not share or disclose personal data and information in any unauthorised manner, ensures the security of the personal data and information provided, and ensures transparent information, communication and conditions for the exercise of the data subject's rights, complying with the fundamental principles introduced as mandatory in the applicable legislation on the processing of personal data, namely: legality, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

The Company processes personal data of customers, including online store users and service users or their representatives, for the following purposes:

• managing relationships for the provision of products and services, including purchases from our online store;

• preparing individual offers;

• issuing documents;

• performing risk assessments;

• administering legal relationships;

• providing assistance with claims;

• preventing fraud and/or other criminal offences;

• complying with regulatory requirements;

• exercising the Company’s legal rights —for example to receive payments and fulfil contracts;

• pursuing legitimate interests — for example protecting the Company's assets at its premises by using video surveillance for security purposes;

• fulfilling obligations under contracts with counterparties;

• making contact when necessary;

• reviewing complaints, appeals, applications, requests and/or other inquiries;

• other lawful purposes.

With regard to organising and conducting sporting events, including football matches, as well as to ticket sales and exercising control over stadium access and other security measures, the Company processes personal data for the following purposes:

• the sale, booking and administration of tickets for football matches and other events, including through electronic channels;

• the identification of spectators and access control to sports facilities;

• ensuring order, security and safety during sporting events, including through video surveillance;

• fulfilling legal obligations related to the holding of mass events and sporting events;

• preventing and detecting violations, fraud and/or criminal acts during events;

• managing legal relationships pertaining to stadium visits, including reviewing incidents, complaints and reports;

• communicating with spectators and ticket holders regarding changes, cancellations or the organisation of events;

• pursuing the Company’s lawful and legitimate interests related to the management and protection of facilities, staff and visitors;

• other lawful purposes related to organising and conducting sporting events.

Regarding our customers, including of our online store, or users of services related to purchases, we may collect and process personal data as follows:

• identification data — full names, ID, address(es), gender, nationality and/or citizenship, other data, including from identity documents, if and when necessary;

• contact data — administrative address(es), telephone number(s), e-mail(s); 

• bank details — IBAN, payment data;

• information necessary for the purchase of products and services;

• video surveillance data from our facilities;

• data from the use of our website — in accordance with the information published on it.

Regarding visitors to sporting events, spectators, ticket holders and/or users of services related to the organising and conducting of sporting events, including football matches, the Company may collect and process the following categories of personal data:

• identification data — full names, date of birth, ID, address(es), gender, nationality and/or citizenship, as well as other data, including from identity documents, when required by law or necessary for access control and security purposes;

• contact data — correspondence address(es), telephone number(s), e-mail(s);

• tickets and visits data — information related to tickets purchased (type, price, seat, date and time of the event), stadium access and entry data, including electronic identifiers and QR codes;

• payment data — data on payments made, including payment methods used (without storing full payment card details);

• video surveillance data — images and video recordings from video surveillance systems at sports facilities for the purposes of ensuring security and order;

• data pertaining to security and incidents — information related to disturbances, incidents or measures imposed during sporting events or in connection with specific behaviours at such events, as applicable;

• data related to using electronic platforms and websites — in line with the information published on the relevant web pages and in the applicable policies;

• other data voluntarily provided by individuals or lawfully collected in connection with the organising and conducting of sporting events.

Data may be collected directly from individuals or from other sources — public and other legitimate registers, competent authorities and third parties.

We process personal data on the following grounds:

• Article 6, Paragraph 1, let. (b) of the General Data Protection Regulation — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; 

• Article 6, Paragraph 1, let. (b) of the General Data Protection Regulation — processing is necessary for compliance with a legal obligation to which the Company is subject, such as under the Measures Against Money Laundering Act, the Protection of Public Order During Sporting Events Act, the applicable and relevant rules of organisations regulating and administering football (FIFA, UEFA, BFU, etc.) which are mandatory for the Company, etc.;

• Article 6, Paragraph 1, let. (f) of the General Data Protection Regulation — processing is necessary for the purposes of the legitimate interests of the Company or of a third party (such as video surveillance, the fulfilment of agreements and legal requirements, the enforcement of legal claims); 

• Article 6, Paragraph 1, let. (a) of the General Data Protection Regulation — processing is done with the consent of data subjects, if and when applicable.

When processing data the Company does not make decisions based solely on automated processing, including profiling.

The provision of personal data is voluntary but if such data is not provided the Company may be unable to fulfil applicable requirements or contractual or other commitments. The specific consequences of not providing data will be communicated to the individual in each specific case.

The Company may disclose and provide personal data to the following categories of parties: insurers, banks, companies within its group, subcontractors — processors, service providers (accounting, IT and/or others), external consultants (lawyers, auditors, accountants, damage assessors, experts and other professionals), competent state, administrative and judicial authorities, sports federations, organisations and other similar entities, as well as other individuals and/or legal entities to whom it may assign the processing of the personal data collected. The data may be provided to such recipients in connection with the performance of our contractual obligations, as well as for the purpose of complying with regulatory obligations.

The Company does not intend to transfer personal data to third countries or international organisations, except as provided by law or regulations (e.g., FIFA and UEFA, based in Switzerland), if applicable. In the event of such a transfer, it will be carried out in compliance with applicable law, ensuring the appropriate level of protection. If necessary, the transfer of personal data, including yours, by PFC LUDOGORETS to third countries (outside the European Economic Area (EEA)), shall always done in compliance with all the requirements under Regulation (EU) 2016/679, including references to an adequate level of protection in the relevant country, as determined by the European Commission (EC) at the time of transfer, or the application of standard contractual clauses. In rare cases it is possible to use the derogations envisaged in the Regulation for the transfer of your personal data — for example, when the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the data subject’s request in accordance with Article 49(1)(b) of Regulation (EU) 2016/679, or when the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person in accordance with Article 49(1)(c) of Regulation (EU) 2016/679, as well as when any of the other grounds for derogation envisaged in Article 49(1) of Regulation (EU) 2016/679 apply, in strict compliance with all applicable regulatory requirements. It is possible that applications or data processing services may be used in the processing in order to facilitate organisational processes that may be established in countries outside the EEA, provided that in such processing and possible transfer of personal data outside the EEA full compliance with the requirements of the General Data Protection Regulation will be ensured, as well as transparency for data subjects.

Personal data is stored by the Company until the expiry of the following periods:

1. no more than 10 (ten) years after the termination of the contractual relationship for which the data was processed;

2. within the statutory deadlines applicable to the regulations on the organisation of sporting events;

3. after the expiry of the statutory period — only if necessary (e.g. legal claims) or if there is a legal basis for that.

After the expiry of the periods, the data shall be securely erased/destroyed.

PFC LUDOGORETS is a legal entity and an employer. In the course of its activities, for the fulfilment of its regulatory obligations and for its own needs, the Company mainly works with legal entities (companies providing services to PFC LUDOGORETS, banks and financial institutions, insurers, employers, sports organisations (including sports clubs), federations, suppliers, etc.), represented in these relationships by natural persons, whose personal data is being processed. The personal data of such individuals and entities is processed for the following non-exhaustive purposes:

• in connection with the conclusion, performance and termination of contracts, for the receipt of services, for payments under contracts, for contacts on operational and other matters;

• for the management of contractual relationships;

• for the provision and receipt of services;

• in order to improve processes related to the performance of contracts;

• in order to fulfil the Company's regulatory obligations;

• in order to provide benefits to the Company's employees;

• in connection with the implementation of measures against money laundering and terrorist financing, as applicable;

• in connection with the implementation of measures for the lawful organisation of sporting events;

• in order to utilise the services of subcontractors;

• for the exercise of claims, complaints, etc.

The legal grounds for data processing are ensuring compliance with legal obligations applicable to the Company (Article 6, Paragraph 1, let. (c) of the General Data Protection Regulation) and the legitimate interest of the controller (Article 6, Paragraph 1, let. (f) of the General Data Protection Regulation) related to the performance of its activities as a legal entity, football club and employer, including for the receipt of services that support its activities. The grounds stem from the current legislation, such as the Law on the Protection of Public Order During Sporting Events Act and other regulations concerning the services provided by PFC LUDOGORETS, the Obligations and Contracts Act, the Commercial Act, the Tax and Social Insurance Procedure Code, the Accounting Act, the Measures Against Money Laundering Act, the Measures Against the Terrorist Financing Act, the Electronic Communications Act, the Consumer Protection Act, the Physical Education and Sports Act, and other acts and relevant secondary regulations, as well as the rules (statutes, regulations, ordinances, etc.) of organisations regulating and administering football (FIFA, UEFA, BFU, etc.) which are mandatory for the Company due to the specific nature of its activities.

PFC LUDOGORETS processes the personal data of representatives of counterparties on a case-by-case basis and as necessary. The data that may be processed includes names, personal identification number (in specific cases under service contracts where employees of the counterparty provide certain services or where such data is specified in powers of attorney), correspondence address, telephone number, e-mail, other contact details, place of work and employer details. The information that such persons share when communicating with us (during meetings, exchange of letters and e-mails, telephone conversations, chats, sending short text messages, e-mails, etc.), which could contain personal data, may be processed if it is relevant to the relationship between the parties.

The data will be obtained from our counterparties or from the data subjects themselves. If necessary, public sources may be used, such as the counterparty's website, the Commercial Register, and the Register of Non-Profit Legal Entities, etc.

If personal data is requested from data subjects and they do not provide it voluntarily, other lawful means and methods may be used to obtain this data, including contacting counterparties. In each specific case, the persons are informed of the consequences of not providing data.

The data is processed by employees of the Company who are bound by legal obligations to protect the confidentiality of the information that has become known to them in the performance of their official duties and who have received this information specifically in connection with the duties they perform in the Company. In line with effective legislation and in the cases envisaged by law, data may be provided to competent administrative and judicial authorities and institutions. Data may also be provided to processors and their subcontractors (providing services necessary for the activities of PFC LUDOGORETS) with whom contracts have been concluded that provide for the relevant personal data protection. Data may be provided to operators of postal services related to these services, as well as to banks, IT service providers, auditors, consultants, regulatory and other administrative bodies, etc., where the provision to third parties is only made after a need assessment of each specific case.

PFC LUDOGORETS shall not provide personal data to representatives of its counterparties in countries or organisations outside the European Economic Area (EEA), except as provided by law or regulations (e.g., FIFA and UEFA, based in Switzerland), if applicable. Data may be processed outside the EEA when using communication platforms, in compliance with the requirements of the General Data Protection Regulation and ensuring transparency. In the event that other operations involving the transfer of personal data processed by the Company to third countries or international organisations become necessary in the future, compliance with the provisions of the General Data Protection Regulation shall be ensured, including in the event of any subsequent transfer of personal data from the third country or international organisation to another third country or organisation.

The personal data of natural persons acting as representatives of legal entities who are counterparties will be processed by PFC LUDOGORETS for a period no longer than what is necessary to achieve the relevant purpose for which the data was collected or until the expiry of the statutory period (e.g. the Accounting Act, etc.). After the expiry of the periods, the data shall be securely erased/destroyed.

PFC LUDOGORETS does not profile its counterparties' representatives and does not make automated decisions that have legal consequences for those persons.

PFC LUDOGORETS is an employer. In this regard the Company processes the personal data of job applicants. This section concerns the processing of data by the administration of PFC LUDOGORETS.

In staff selection procedures PFC LUDOGORETS receives the personal data of job applicants directly from them, via job application platforms or via recruitment agencies, if it uses such services. In the second and third cases before the data is obtained by PFC LUDOGORETS it is processed by the relevant recruitment platform/agency without PFC LUDOGORETS having any involvement in this processing. Public information in the applicant's profile on the professional network LinkedIn and/or any other professional network used for this purpose may also be processed.

The following categories of personal data is processed in the course of job selection procedures: identification data, data on educational qualifications and additional qualifications, data on work experience and expertise, telephone number and e-mail address for contact purposes, data from skill and integrity tests for certain job positions, data exchanged during interviews.

The personal data of job applicants is processed pursuant to Article 6, Paragraph 1, let. (b) of the General Data Protection Regulation — in order to take steps at the request of the applicant prior to entering into a contract (pre-contractual relationship between the applicant and the Company), Article 6, Paragraph 1, let. (f) of the General Data Protection Regulation — the legitimate interests of PFC LUDOGORETS related to the selection of employees who meet the requirements for the position they are applying for, Article 6, Paragraph 1, let. (c) of the General Data Protection Regulation — in order to ensure compliance with legal obligations applicable to the Company, as envisaged in the employment legislation, such as the Labour Code, Article 6, Paragraph 1, let. (a) of the General Data Protection Regulation — consent, if applicable.

The processing is done with the following purposes: selection of suitable applicants for vacant positions at PFC LUDOGORETS, as well as in order to prepare the documents for the appointment of the approved applicants.

In the first stage of the selection procedure, the Company processes the personal data of job applicants provided in their CVs, as well as any data in the applicant's LinkedIn profile and in forms filled out on the Company's website and sent to PFC LUDOGORETS by the applicants, if applicable. Data contained in cover letters, recommendations and/or other documents, if sent by the applicants, is also processed.

PFC LUDOGORETS has not adopted a specific CV format and does not restrict applicants to using a specific one. CVs may be submitted in any format chosen by the applicant but must contain information in line with the requirements announced by the Company for the vacant position. Using standard European CV formats, applicants could provide the following personal data: full names, address, contact details (telephone number, fax, e-mail), nationality, citizenship, date of birth, employment history, education, qualifications and training, information about personal, social, organisational, technical and other competencies. A recent photograph is to be included with standard CVs. Applicants may include other information in their CVs at their own discretion. The data in the CV submitted by the applicant will be processed in its entirety when reviewing the application.

When submitting an application via PFC LUDOGORETS's platform on the Company's website, if applicable, the data specified therein will be processed.

The data in the CVs sent by applicants or submitted online is processed by the Company's employees performing personnel selection functions or by a data processor acting on behalf and on account of the Company, as well as by persons in management positions within the Company, such as the head of the department with the vacant position. Applicant data may also be disclosed to public authorities if there is a legal basis for that.

After reviewing the CVs received, PFC LUDOGORETS contacts the applicants who have passed the first stage of the selection process and invites them to participate in the second stage — an interview. This second stage involves an interview based on the information provided in the first stage and aims to further analyse the applicant's potential to perform the job for which they are applying, as well as their suitability in terms of the requirements and criteria set. Interviews are conducted by a team of Company’s employees who are competent to assess the applicant's ability to perform the job, as well as by the department with the vacant position. Additional tests may be applied for some positions involving access to sensitive information about the Company and its customers, such as for special knowledge and skills, professional orientation, integrity, etc., depending on the position applied for. Interviews may be conducted both before and after the relevant tests.

If at any stage of the selection process job applicants do not provide PFC LUDOGORETS with information on the basis of which the suitability of their application can be assessed, they cannot not be invited to participate in the next stage. It is also possible that applicants formally meet the requirements but are not invited to continue the selection process because other applicants are more suitable for the specific position.

After completion of the second stage of the selection process, the Company contacts the relevant persons to inform them whether they have been approved to start working at PFC LUDOGORETS. Approved applicants will be asked to provide additional information necessary for the conclusion of the contract, in accordance with the requirements of employment and other applicable legislative acts and the specifics of the position for which they are applying.

The personal data of job applicants at PFC LUDOGORETS shall not be disclosed to countries or legal entities outside the European Economic Area, nor to international organisations. If such a transfer takes place or such processing is otherwise carried out (for example utilising platforms that process data in third countries), the requirements of the General Data Protection Regulation shall be strictly observed and the necessary level of transparency shall be ensured.

PFC LUDOGORETS does not perform automated decision-making. It is possible that some profiling would be carried out at certain stages of the selection process, based on information provided in advance by the applicant, but the decision on whether the applicant meets the employer's requirements for the vacant position is always made after a detailed analysis of all data by people, in a non-automated manner, taking into account all relevant factors.

Personal data is stored by PFC LUDOGORETS until the expiry of the following periods:

• Upon the approval of the application and the conclusion of an employment contract, the necessary data shall be stored for the duration of the employment contract, and after that period — only if necessary (e.g., legal claims) or if there is a legal basis for that.

• For rejected applicants, the data submitted during the application process is stored for up to 6 (six) months since the end of the selection procedure, unless the applicant has agreed to its storage for a longer period.

After the expiry of the periods, the data shall be securely erased/destroyed.

‘Information when using the website’ could include data on online activity which in most cases does not identify a natural person (does not constitute personal data), such as browser type, operating system, most frequently visited page sections and links on the website, entry and exit points, number of completed forms, time spent on the page, most popular keywords used outside the site that lead users to the website, information collected through cookies, depending on which ones are active, and other device events, such as system activity. Personal data and information when using the website could be linked in certain cases. Different types of usage data could also be linked together and, once linked, could lead to the identification of a specific individual. Furthermore, some usage data could be treated as personal data under applicable law.

PFC LUDOGORETS collects certain information that website users provide, as well as data from the use of the website and the services we offer through it. The information we collect and the way we process it depends on how you use the website and the relevant settings you have enabled. Some data may be collected automatically through the use of cookies and other similar collection tools applicable to data over which data subjects have control.

PFC LUDOGORETS implements special mechanisms enabling website users to manage cookies and other applicable technologies. The browsers used also provide such capabilities.

PFC LUDOGORETS collects personal information and data about the use of the website when a user creates a request for any of our services, contacts us, otherwise provides personal information or uses other services. We collect information and content that you send us when you enter data in the contact forms on our website, request additional information about a service, as well as when we engage in other types of communication.

Information we may collect using automated methods

While you are browsing and using our website, we may use automatic data collection technologies to process certain information about devices, searches, and trends, including:

• details on visits to our website, including traffic data, location data, logs, and other communication data and resources that users access and use on the website;

• information about the device used and the Internet connection, including IP address, operating system and browser type.