Below you will find information about how VfB Stuttgart 1893 AG (hereinafter "VfB Stuttgart") processes your personal data when you interact with the VfB Fan Engagement Platform and purchase digital collectibles, access and use the Website, as well as use the digital means of contact and communication such as email and the Website (collectively, the "Services").

Your privacy is important to us. This Privacy Notice describes how we process your personal data. If you have any questions about this notice or our processing of personal data, please contact us using our contact details below.

VfB Stuttgart 1893 AG is responsible for the processing of your personal data in accordance with the General Data Protection Regulation ("GDPR"). You can contact us as follows:

VfB Stuttgart 1893 AG

Mercedesstraße 109, 70372

Stuttgart, Germany

datenschutz-ag@vfb-stuttgart.de

When you interact with us through our web applications, we collect the information you provide to us. If you choose to use our services, we will also collect the information necessary to create a user account with us. When you make a purchase from us, we also collect information about your transaction.

Requests via web or mobile applications

If you contact us through our web or mobile applications, we will process the data you provide to us that we need to process your request. Usually, this is basic information such as your email address and the public address of your wallet.

Data processed in the context of the Services

If you choose to use our services, we need to process the following categories of personal data in order to be able to create an account: name, VfB Stuttgart customer account ID (optional), email, public address of the wallet. We also process information generated in connection with your use of the Service, such as IP number, browser type, domain names, access times, referring website addresses, and other information related to your hardware or software.

For sending prizes

If you receive a prize in the form of a physical item with the purchase of a Collectible or as part of a raffle, we need to process the following categories of personal data in order to be able to send the prize to you: title, first name, last name, delivery address.

Requests via web or mobile applications

If you contact us through our web or mobile applications, we will process the data you provide in order to be able to process the request or request you make to us. The data may also be used to communicate with you about offers, news and our services. The legal basis for processing your personal data is our legitimate interest.

Data processed in the context of the Services

In order to provide you with the Services, we need to process certain data about you. This processing is carried out on the basis of the contract between you and us.

We also process your data in order to develop and adapt the Services and their functionalities. The data can also form the basis for product and customer analysis, statistics, and business and product development. In addition, the data may be processed to ensure that we have performed the Services correctly and to communicate with you about offers, news and our Services. This processing is carried out on the basis of our legitimate interest as a legal basis.

Finally, some of your data may be processed so that we can comply with applicable regulations, such as accounting and tax regulations. The legal basis for these processing activities is our legal obligation.

In general, we will keep your information for as long as it is needed for the purposes for which it was collected. After that, the data will be deleted or anonymized.

Data in questions and requests that you submit to us via our web and mobile applications will be deleted (or anonymised) within 12 months after we have closed the matter to which the data relates.

If you use our services, your data will be deleted (or anonymised) within 12 months if you are no longer registered with us as an active user. Data that we are required to retain under applicable law will be retained for as long as required by law (this means, for example, that information that we are required to retain under accounting laws will be retained for 7 years).

As a general rule, we do not share your personal data with third parties, i.e. Your data is safe with us. However, to the extent that the sharing is necessary for the provision of the Services, such as to assist us in providing and/or developing the Services, perform statistical analysis, send you emails, or provide customer support, we may share a limited amount of information with business partners. In addition, your information may be disclosed if required to do so by law or if such disclosure is necessary to protect our legal interests or those of a third party.

We work with third parties who provide products and services on our behalf and may share your information with them, such as banks, insurance companies, or technology suppliers, who may have access to your personal information when providing software support. We may share research and statistical analysis (on an anonymised basis) derived from your personal data with third parties (see the "Statistics" section below).

Your personal data is processed by our personal data processor located within the EU. Some of your data will however be transferred to our server and will be further processed outside of the EU.

As a data subject, you have certain rights in relation to the processing of your personal data by us. If you wish to exercise any of your rights, please contact us.

• Information in accordance with Art. 15 GDPR about the data stored about you in the form of meaningful information on the details of the processing as well as a copy of your data;

• Correction in accordance with Art. 16 GDPR of incorrect or incomplete data stored by us;

• Deletion in accordance with Art. 17 GDPR of the data stored by us, insofar as the processing is not necessary for the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims

• Restriction of processing in accordance with Art. 18 GDPR if the accuracy of the data is disputed, the processing is unlawful, we no longer need the data and you reject its deletion because you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 GDPR.

• Data portability in accordance with Art. 20 GDPR, insofar as you have provided us with personal data within the framework of consent in accordance with Art. 6 (1) (a) GDPR or on the basis of a contract in accordance with Art. 6 (1) (b) GDPR and these have been processed by us using automated processes. You will receive your data in a structured, commonly used and machine-readable format or we will transmit the data directly to another controller, insofar as this is technically feasible.

• Objection pursuant to Art. 21 GDPR to the processing of your personal data, insofar as this is carried out on the basis of Art. 6 para. 1 lit. e, f GDPR and there are reasons for this that arise from your particular situation or the objection is directed against direct marketing. The right to object does not exist if overriding compelling legitimate grounds for the processing are proven or if the processing is carried out for the assertion, exercise or defence of legal claims. If the right to object does not exist in the case of individual processing operations, this is stated there.

Our website, platform and/or application may, from time to time, contain services provided by or contain links to the websites of our partner networks, advertisers and affiliates ("Third-Party Services"). Please note that the third-party services accessible through our services have their own privacy policies. We do not accept any responsibility or liability for these Terms or for any personal information that may be collected through the Services by third parties. Please check their policies before submitting any personal information to such websites or using their services.

Your relationship with these third-party service providers and their services and tools is independent of your relationship with us. These third parties may provide you with the ability to allow/restrict the collection of information. It may be in your interest to restrict or permit such data collections on an individual basis.

The location of data processing depends on each third party, and you should check each provider's privacy policy to determine the data being shared and its purpose. You will be subject to a third-party privacy policy if you choose to receive communications from third parties. We are not responsible for the privacy standards and practices of third parties.

To enhance our platform and improve the user experience, we use various tracking tools that collect information about user interactions: Google Analytics, Hojtar, and Mixpanel.

We use these tools to analyze interactions on the Site, improve features, and understand user behavior in order to improve our Service. The data collected may include IP addresses, device information, and browsing behavior. The handling of this data is carried out in accordance with our privacy policy.

You can manage your preferences for these tracking tools through your browser settings or the opt-out mechanisms provided by the tools.

We may use and publish non-personal aggregate statistics and group data about those people who access or make use of any of the website, the application, the platform, or services and their usage of any of the website, the application, the platform, or services.

We collect data using "cookies". Cookies are small data files that are sent to your browser by the website and stored on your computer or device (hard drive). The cookies do not provide access to data on your computer or device, such as email addresses or other data that can be traced back to you personally. The data collected with the help of cookies allows us to manage the website and provide you with a tailor-made and user-friendly service. The cookies allow you to access certain features of the website. Most web browsers and devices can be set to notify you when you receive a cookie or to prevent cookies from being sent. If you prevent cookies from being sent, this may result in a limitation of the features we can provide to you when you visit the website.

In addition, on certain pages of the website, you may encounter cookies or similar devices placed by third parties. We have no control over the use of cookies by third parties. If you send us personal correspondence, such as emails or letters, or if other users or third parties send us correspondence about your activities or posts on the Site, we may collect that information in a file specific to you.

We take reasonable steps to protect your personal information from loss, unauthorized activity, or other misuse. We use appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with the processing of personal data.

Unfortunately, no data transmission over the Internet can be guaranteed to be completely secure. You can make an important contribution to the security of your personal information by maintaining the confidentiality of all passwords and accounts you use in connection with the Site, Platform, Application, and Services, including the use of a unique password that you do not use on third-party websites or related services. Please do not share your account password with anyone. Please notify us immediately if your account has been used without authorization or if there is any other breach of security. Although we take reasonable steps to maintain secure internet connections, any transmission of personal data via the internet is at your own risk. If you publish your personal data on the public pages of the Website and/or the Application, you acknowledge that the information you publish is publicly available.

If you follow a link on the website, platform or application to another website, the owner of that website has its own privacy policy in relation to your personal data, which you should read before providing any personal data.

If you have any inquiries regarding our processing of your personal data, do not hesitate to contact us.

If you are not satisfied with the way we process your personal data, please contact datenschutz-ag@vfb-stuttgart.de. You can also contact the Baden-Württemberg Authority for Data Protection (State Commissioner for Data Protection & Information Security).

This privacy policy is valid from 12.02.2026.