Below you find information about how CW Sports Management Pte. Ltd. and VfB Stuttgart 1893 AG (”CW Sports”, “VfB Stuttgart” ”we”, ”our”, ”us”) processes your personal data when you interact with and purchase digital collectibles, access and use he VfB Fan Engagement Platform, access the website and use its digital means of contact and communications such as email, and website (collectively the “Services”) Your privacy is important to us. This privacy notice describes how we process your personal data. If you have any questions related to the notice or our processing of personal data, please contact us at our contact details below.

CW Sports and VfB Stuttgart are joint data controllers in relation to our processing of your personal data, which means that CW Sports and VfB Stuttgart are responsible for processing your data in compliance with the General Data Protection Regulation, GDPR. You can contact us as follows:

VfB Stuttgart 1893 AG

Mercedesstraße 109, 70372

Stuttgart, Germany

datenschutz-ag@vfb-stuttgart.de

CW Sports Management Pte. Ltd.

#02-01, 68 Circular Road,

Singapore 049422

info@chromaway.com

When you interact with us through our web applications, we collect the information that you provide to us. If you choose to use our Services, we also collect the information that is required for setting up a user account with us. Additionally, when you make a purchase with us, we collect information related to your transaction.

Inquiries via web or mobile applications

If you contact us through our web or mobile applications, we process the data that you provide to us and which we need to be able to handle your request. In general, this is basic information such as your email address and wallet public address.

Data processed within the Services

If you choose to use our services, we will need to process the following categories of personal data to be able to set up an account: Name, VfB Stuttgart customer ID (optional), email, wallet public address. We also process information created in connection with your use of the Service, such as IP number, browser type, domain names, access times, referring website addresses, and other information related to your hardware or software.

For the delivery of prizes

If you receive a prize in the form of a physical item with the purchase of a Collectible or as part of a raffle, we must process the following categories of personal data in order to be able to send the prize to you: Title, first name, surname, delivery address.

Inquiries via web or mobile applications

When you contact us through our web or mobile applications, we process the data that you provide to be able to handle the inquiry or request that you send to us. The data may also be used to communicate with you about offers, news, and our Services. The legal basis for our processing of your personal data is our legitimate interest.

Data processed within the Services

To be able to provide the Services to you we need to process certain data about you, this processing is made with the contract between you and us as legal basis. We also process your data to develop and customize the Services and its functionalities. The data may also form the basis for product and customer analysis, statistics, and business and product development. Furthermore, data may be processed for the purpose of ensuring that we have performed the Services correctly and to communicate with you about offers, news, and our Services. These processing activities are made with our legitimate interest as the legal basis. Finally, some of your data may be processed for the purpose of our compliance with applicable regulations, such as regulations on accounting and tax. The legal basis for these processing activities is our legal obligation.

In general, we retain your data as long as it is needed for the purposes for which the data was collected. The data is thereafter deleted or anonymized.

Data provided in questions and inquiries that you submit to us through our web and mobile applications are deleted (or anonymized) within 12 months from when we have closed the matter to which the data relates to.

If you use our Services, your data will be deleted (or anonymized) within 12 months from when you no longer are registered with us as an active user. Data that we must retain according to applicable law is kept for as long as the law provides for (which, for example, means that information that we must keep due to accounting legislation is retained for 7 years).

As a general rule, we do not share your personal data with third parties, which means that your data is secure with us. However, to the extent disclosure is necessary for our provision of the Services, for example, to help us deliver and/or develop the Service, perform statistical analysis, send you emails, or provide customer support, we may disclose a limited amount of data to business partners. Furthermore, your data may be disclosed if required by mandatory law, or if such disclosure is necessary to protect our or a third party's legal interests.

We use third parties who provide products and services on our behalf and may share your information with them, for example banks, insurance companies or technology suppliers who may have access to your personal information when providing software support. We may disclose research and statistical analysis (on an anonymized basis) derived from your personal information to third parties (see more in the Statistics section below).

Your personal data is processed by our personal data processor located within the EU. Some of your data will however be transferred to our server and will be further processed outside of the EU.

As a data subject, you have certain rights in relation to our processing of your personal data. If you would like to exercise any of your rights, please contact us.

• Right of access: You have the right to get informed about the personal data we process about you, including the purpose of and legal basis for the processing.
• Right to rectification: If you believe that we are processing inaccurate personal data about you, you can ask us to correct it.
• Right to restrict processing: You can request that we restrict the processing of your personal data. As an example, this can be relevant if we have incorrect data about you and you do not want the processing to continue until we have corrected the data.
• Right to erasure/right to be forgotten: You can request that we delete your personal data. Although we will comply with such a request to the extent required by applicable law, please note that we, despite your request, may continue to process certain data (such as data that we need to retain in order to protect our legal interests or that we are required to retain pursuant to legal obligations).
• Right to object: In connection with the processing of personal data based on our legitimate interest, you have the right to object to the processing of your personal data. If your privacy interests outweigh our interests in processing certain data, we will stop processing such data.
• Right to data portability: You may have the right to receive personal data that you have provided to us in a structured, generally accepted and machine-readable format, and you may also have a right to transfer this data to another data controller.

Our website, platform, and/or application may, from time to time, contain services provided by or links to and from the websites of our partner networks, advertisers, and affiliates (“Third Party Services”). Please note that the Third Party Services that may be accessible through our services have their own privacy policies. We do not accept any responsibility or liability for the policies or for any personal data that may be collected through the Third Party Services. Please check their policies before you submit any personal data to such websites or use their services.

Your relationship with these third parties and their services and tools is independent of your relationship with us. These third parties may allow you to permit/restrict the information that is collected. It may be in your interest to individually restrict or enable such data collections.

The place of processing information depends on each third-party service provider and you should check the privacy policy of each of the service providers to identify the data shared and its purpose. You will be subject to a third party’s privacy policy if you opt in to receive communications from third parties. We will not be responsible for the privacy standards and practices of third parties.

To enhance our platform and improve user experience, we employ various tracking tools that collect information about user interactions; Google Analytics, Hojtar and Mixpanel.

We use these tools to analyze website interactions, enhance functionalities, and understand user behavior for service improvement. The data collected may include IP addresses, device information, and browsing behavior. The handling of this data is in accordance with our privacy policy.

You can manage your preferences for these tracking tools through your browser settings or opt-out mechanisms provided by the tools.

We may use and publish non-personal aggregate statistics and group data about those people who access or make use of any of the website, the application, the platform, or services and their usage of any of the website, the application, the platform, or services.

We collect data by way of ‘cookies’. Cookies are small data files which are sent to your browser from the Website and are stored on your computer or device (hard drive). The cookies shall not provide access to data in your computer or device such as email addresses or any other data that can be traced to you personally. The data collected by way of cookies will allow us to administer the Website and provide you with a tailored and user-friendly service. The cookies shall enable you to access certain features of the Website. Most web browsers and devices can be set to notify when you receive a cookie or prevent cookies from being sent. If you do prevent cookies from being sent, it may limit the functionality that we can provide when you visit the Website.

Additionally, you may encounter cookies or other similar devices on certain pages of the Website that are placed by third parties. We do not control the use of cookies by third parties. If you send us personal correspondence, such as emails or letters, or if other users or third parties send us correspondence about your activities or postings on the Website, we may collect such information into a file specific to you.

We will take reasonable steps to keep your personal information safe from loss, unauthorized activity or other misuse. We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks inherent in processing personal information.

Unfortunately, no data transmission over the Internet can be guaranteed as totally secure. You can play an important role in keeping your personal data secure by maintaining the confidentiality of any password and accounts used in relation to the website, the platform, the application, and services, including using a unique password that you do not use on any third-party websites or related services. Please do not disclose your user account password to third parties. Please notify us immediately if there is any unauthorized use of your account or any other breach of security. While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk. If you post your personal information on the website’s and/or application’s public pages, you acknowledge that the information you post is publicly available.

If you follow a link on the website, the platform, or the application to another website, the owner of that website will have its own privacy policy relating to your personal information that you should review before you provide any personal information.

If you have any inquiries regarding our processing of your personal data, do not hesitate to contact us.

If you are not happy with how we process your personal data, please contact us at info@chromaway.com or datenschutz-ag@vfb-stuttgart.de. You may also contact the Baden-Württemberg Authority for Privacy Protection (Landesbeauftragte für Datenschutz & Informationssicherheit) or Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, www.imy.se, imy@imy.se).

This privacy policy applies from November 22, 2023