1. DEFINITIONS Data Subjects (or “you”)

Means an identified or identifiable natural person

Personal Data

Means all information about an identified or identifiable natural person

Legislation Personal Data

Means (i) the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC as from 25 May 2018, (ii) the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of Personal Data and (iii) every other current or future applicable legislation concerning or having an impact on the privacy and on the processing of Personal Data.

2. IDENTITY AND CONTACT REFERENCES OF THE CONTROLLER

2.1. We attach great importance to the protection of your privacy and Personal Data. This Privacy Policy describes on how we will process your Personal Data.

2.2. SCRL Royale Union Saint-Gilloise (“We”, “Us” , “Our” or the “Club”) is a Belgian enterprise established in Chaussée de Bruxelles 223 at Forest (1190) and registered in the Crossroads Bank for Enterprises with number 0417144936. For questions regarding our Privacy Policy, please send an e-mail to rusg@rusg.be . Our (remaining) contact references are available on our website.

2.3. We qualify as a controller, as defined in the Legislation Personal Data, regarding the processing of your Personal Data for the purposes as stated in this Privacy Policy.

3. PERSONAL DATA

We will process the following categories of Personal Data:

− Personal data and contact details: name, postal address, e-mail address, physical characteristics, sex, social media account information, date of birth, ethnicity, religion, disability status, marital and family status and phone number.

− Transactional data: IP-address, account number, ticketing data and company details.

− Preferences: marketing preferences, food preferences, language preferences and/or contact preferences.

4. PURPOSES OF PROCESSING

4.1. We will process your Personal Data for the following purposes and the corresponding legal grounds:

4.2 We will inform you beforehand if we intend to process your Personal Data for other purposes than the purposes indicated in this Privacy Policy.

4.3 For certain purposes, as stated above, you give your consent to us by explicitly agreeing to a certain processing (e.g. by ticking a box when registering and / or purchasing tickets with further information about a certain processing).

4.4 You have the right to withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing based on the consent prior to the withdrawal thereof.

4.5 With regard to the aforementioned processing, which consists of profiling, which we carry out based on e.g. your Personal Data, you have the right to object to this processing free of charge and at any time. You can send an e-mail stating that you do not wish your personal data to be processed in this way to privacy@rusg.be .

4.6 We can use your Personal Data to send you information. Sending direct marketing via e-mail, for example, is permitted in some cases without permission because we have obtained your electronic contact details directly from you in the context of the sale of products or services and because our commercial messages relate to our own similar products or services (“Soft-opt-in”). You can object at any time to continue receiving our direct marketing messages by clicking on “UNSUBSCRIBE”. The unsubscribe option is provided in every direct marketing email. You can also send your intention to unsubscribe to privacy@rusg.be .

4.7 As stated above, some cases of processing of Personal Data will occur based on the legal ground “execution of the agreement”. Based on this legal ground, the processing of your Personal Data is necessary in order to conclude and execute an agreement with you. The execution of an agreement will in that case qualify as a legal ground for the processing of Personal Data (as opposed to your permission). In such a case, we cannot execute the agreement if you object to the processing of your Personal Data.

4.8 Certain processing of the Personal Data of the Fan will be processed by the Club, inter alia, based on the Law of 21 December 1988 concerning the safety and security at football games, which serves as a legal ground for such processing. In these cases, the Club processes the Personal Data for the performance of its legal assignment regarding safety and security at football matches.

5. RECIPIENTS OF PERSONAL DATA

5.1. We may pass on your Personal Data to affiliated companies, suppliers, service providers, solely in connection with the purposes stated in article 4 of this Privacy Policy, such as but not limited to sponsors, direct marketing service providers etc. We may pass on your Personal

Data to the Pro League, insofar you have given your explicit permission for this (see further in article 9.1).

5.2. Our service providers include, but are not limited to; IT service providers, marketing agencies, etc.

5.3. We may also pass on your Personal Data to third parties if we are required to do so on the basis of legal provisions or decisions of courts.

5.4. In the event of a total or partial reorganization or transfer of our organization, we may also pass on your Personal Data to (un) related third parties.

6. TRANSFER OF PERSONAL DATA

We will only process your Personal Data within the European Economic Area.

7. PERIOD IN WHICH WE WILL STORE PERSONAL DATA

We will review abovementioned retention periods for your Personal Data at regular intervals and will in any case delete your Personal Data after a period of five (5) years after the expiry of the last of abovementioned periods.

8. YOUR RIGHTS

8.1. In accordance with the provisions of the Legislation Personal Data you have the right to (a) request access to, correction or deletion of your Personal Data, (b) request the limitation of the processing of your Personal Data or to oppose the processing of your Personal Data or make objections to it, (c) obtain your Personal Data in a structured, current and machine-readable form and have the right to have it transferred to another controller, (d) to file a complaint with the supervisory authority (in Belgium the Data Protection Authority, https://www.gegevensbeschermingsautoriteit.be) or any other government that replaces the Belgian Data Protection Authority.

8.2. You can exercise the abovementioned rights by sending a request to privacy@rusg.be , or via a similar technical solution implanted on the website.

9. JOINT CONTROLLERS

9.1. To the extent that you have agreed that we will pass your Personal Data to the Pro League for its direct marketing purposes, you note that we, together with the Pro League, will act as ‘joint controllers’ for this specific processing. This processing consists of the joint controllers sending your Personal Data to each other, if you have explicitly consented (via an opt-in box), via the same CRM-database.

9.2. Regarding the rights that you can exercise under the GDPR with regard to this processing (including under articles 13 and 14 GDPR), you can address this to us (see contact details in article 8.2).

10. MODIFICATIONS TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time. We will announce any modified version of this Privacy Policy and, where appropriate, request your consent in accordance with the provisions of Article 4 of this Privacy Policy.

Last modification of Our Privacy Policy: 22.05.2020