Privacy Notice

We are committed to protecting your privacy and your right to informational self-determination. We kindly ask you to take a moment and read this Privacy Notice. The information provided here will help you understand how we process your personal data. Depending on the specific case it is possible that other privacy policies of ours may apply additionally, in which case we will inform you about this additional application (e.g. by referring to such privacy notice). If you have any questions regarding our use of your personal data, please feel free to contact us over the channels provided below.

When we refer to “you” in this Privacy Notice, we refer to you as data subject. If you are interacting with us on behalf of others (e.g. you are a team manager or other personnel associated with a team and you are signing up others), please make sure all affected people receive the information stated in this Privacy Notice.

I. Who Are We?
If we speak of “we” or “us” in this Privacy Notice, we refer to ourselves as controller as defined below. Our contact details are:

ESL Gaming GmbH
Managing Directors: Ralf Reichert, Stefan Beitz
Schanzenstrasse 23
51063 Köln
Germany

Recorded at local court of Cologne (AG Köln) under number HRB 36678
USt-ID: DE216144739
https://about.eslgaming.com/

Our email address for all privacy matters is: privacy@eslgaming.com

Our data protection officer (“DPO”) is:

Dr. Christian Rauda
GRAEF Rechtsanwälte Digital PartG mbB
Jungfrauenthal 8
20149 Hamburg
email: dpo@eslgaming.com


II. Joint Controllerships

1. ESL Subsidiaries

What does joint controllership mean?
We and our daughter companies (each of them a “Subsidiary” and together “Subsidiaries”) cooperate closely together regarding the provision of our products and services. This means that we and our respective Subsidiaries may jointly determine if and how personal data of yours is processed. Since we and our Subsidiaries each are controllers of your data when doing so, the working relationship is called a joint controllership. Our Subsidiaries are:

ESL GAMING POLSKA SP. Z O.O.
ZELIWNA 38 STREET, 40-599
Katowice, Poland

ESL Gaming France S.A.S.
Le HQ, 1 impasse du Palais
37000 TOURS, France

ESL Gaming UK Ltd.
2nd Floor
64 Mansfield Street
Leicester
LE1 3DL
UK

ESL GAMING AUSTRALIA PTY LTD
Unit 4 / 199 Parramatta Rd,
Auburn, NSW, 2144
Australia

ESL SEA Pte Ltd.
56A Boat Quay
Singapore 049845

ESL Gaming America Inc.
1212 Chestnut St, Burbank
CA 91506
USA

NY office:
286 Fifth Ave, 5th Floor, New York
NY, 10001
USA

ESL Gaming Online Inc.
1212 Chestnut St, Burbank
CA 91506
USA

ESL Gaming España S.L.U.
C/Vereda de los Barros 2B Bis 209-210
Pol. Ventorro del Cano. 
28925 Alcorcon, Madrid,
Spain

Dreamhack AB

Telefonvagen 30, SE-126 26, Hagersten, Sweden

Dreamhack Inc.
1944 Pacific Avenue, Tacoma, WA 98402
USA

Dreamhack Canada Inc.
78 Boulevard Brunswick, Dollard-des-Ormeaux, QC, H9B 2C5
Canada

Implicator Holding AB
Telefonvägen 30, SE-126 26, Hagersten, Sweden

ESL Gaming Malaysia SDN. BHD.
Suite A­23­9, Level 23, Mena-ra Uoa Bangsar, No. 5, Jalan, Bangsar Utama 1, 59000, Kuala Lumpur W.P., Kuala Lumpur, Malaysia.

Is there a contract between us and our Subsidiaries?
Yes. We and our Subsidiaries have concluded an Intercompany Data Protection Agreement that legitimizes any data flows between us and our Subsidiaries or between our Subsidiaries. It contains rules for joint controllerships between us as well as the Standard Contractual Clauses provided by the European Commission to legitimize data flows from us and Subsidiaries established within the EU to Subsidiaries established outside of the EU or the EEA.

Who processes data and why?
We cooperate with our Subsidiaries and jointly process personal data jointly with them in the following cases:

• We and ESL Gaming America Inc. jointly administer HR matters and process personal data related to this (e.g. regarding job applications);

• Depending on the specific case, we and the following Subsidiaries may jointly plan, administer and execute ESL owned and operated esports tournaments as well as esports tournaments which we conduct jointly with third party partners of ours (all together “Tournaments”). The Subsidiaries are: ESL Gaming España S.L.U.; ESL GAMING POLSKA SP. Z O.O.; ESL Gaming France S.A.S.; ESL Gaming UK Ltd.; ESL GAMING AUSTRALIA PTY LTD; ESL SEA Pte Ltd.; ESL Gaming America Inc.; ESL Gaming Online Inc., Dreamhack AB, Dreamhack Inc., Dreamhack Canada Inc., Implicator Holding AB.

For this we and those Subsidiaries can jointly process personal data such as:
o account data (ESL ID) required for providing the ESL Play platform for the execution of a Tournament;
o personal data of freelancers involved in the Tournament (e.g. names and travel information);
o personal data of participants of the Tournament (e.g. names, nicknames, platform IDs, birth dates, email addresses, addresses, photos, videos and financial data, travel data, game data);
o personal data of visitors of the venue where a live Tournament takes place (e.g. image and spoken word captured on photos and videos);
o personal data (e.g. email addresses and names) of employees of partners involved in the Tournament (e.g. brand partners);
o marketing data (e.g. analytical data from a website of a Tournament, personal data of users from a social media page).

• We and all our Subsidiaries globally share certain IT services that are provided and administered by ESL Gaming GmbH and through this process personal data such as personal data of consumers that interact with ESL products and services as well as personal data of employees of partners who are involved in cooperations with us and/or our Subsidiaries.

• We and our Subsidiaries jointly market ESL products and services. For this purpose, we and these Subsidiaries may process personal data, such as user data (e.g. e-mail addresses for sending newsletters), as joint controllers. Such data is managed separately. However, we and our Subsidiaries may jointly decide whether and how personal data is used for marketing purposes.

• We and our Subsidiaries share the services of ESL Gaming GmbH’s legal department for any legal questions and for administering and cooperating in intercompany matters. Through this we and our Subsidiaries jointly process personal data such as names and other personal data provided in connection with a legal assessment or proceeding.

You can find further details on how we and our Subsidiaries jointly process your data in the respective section below (see Sections VII. and VIII. that inform about the specific processing activities).

Who is responsible for what?
If not expressly stated otherwise in this Section, we (ESL Gaming GmbH) are responsible for safeguarding the rights of yours set out in this Privacy Notice, when processing your personal data. In such case, we are your primary contact point for all requests you may have relating to data protection. You can at any time of course also contact the respective Subsidiary of ours to exercise your data subject rights. Our Subsidiaries and we can assist each other to comply with our obligations set out in the GDPR we may have towards you and will inform each other about matters of significance to a joint controllership. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, with the assistance of the respective Subsidiary and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or – where required by article 34 GDPR – our Subsidiary will inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights against us or if you have any questions for us regarding the processing, you can contact us via email: privacy@eslgaming.com

Depending on your request, it is possible that our Subsidiary or we will forward your request to one another, should this be necessary to help each other out to answer your request or to get directly in touch with you for this purpose. In case of a forward of your request, we and our Subsidiary inform each other about the matter to the extent necessary for answering your request.

2. Partner Companies

To provide our products and services (e.g. esports tournaments) we cooperate with partners of ours. E.g. a company may commission us to organize and run an esports tournament for it that is hosted under its company name. It is possible that we and our partner jointly determine if and how personal data of yours is processed when we cooperate with each another. In such case we and our partner each are controllers of your data when doing so. Such a working relationship is called a joint controllership. In the following you can find all additional information on joint controllerships between us and our partners.

2.11
2.12
2.1. Warsteiner Music Contest
What does joint controllership mean?
To conduct the Warsteiner Music Contest, we (“we” stands in this privacy policy for ESL Gaming GmbH) cooperate with the following partners of ours:
Warsteiner Brauerei Haus Cramer KG
Domring 4-10,
59581 Warstein, Germany
(“Warsteiner”)
And Universal Music GmbH
Amtsgericht Charlottenburg HRB 158632 B
Stralauer Allee 1
10245 Berlin, Germany
(“Enter Records”)
and Label Radar Inc.
PO Box 164, South Easton, MA 02375
(“Label Radar”)
(jointly: “Partners”)

We and/or our Partner jointly determine if and how personal data of yours (“you” means you as a participant and data subject) is processed, when you participate in the Warsteiner Music Contest. Since we and our Partners each are controllers of your data when doing so, the working relationship is called a joint controllership.

Who processes which data and why?

For the joint goal of picking a winner, we, Warsteiner and Enter Records will receive the personal data submitted by you, including but not limited to your name and email address. This data is processed by us to review the information handed in by a participant (e.g. who handed in which song) and to choose a winner and publish who won. The legal basis for processing this information by us and Warsteiner is Art. 6 para. 1 let. b) GDPR to conclude and perform a contract with you and Art. 6 para. 1 let. f) GDPR since we have a legitimate interest in publishing the name of the winner of the Warsteiner Music Contest that outweighs a potential opposing interest of yours to not have your name made public when you freely participate in this public contest. Enter Records has a legitimate interest in processing the personal data to make an appropriate judgement of the material that has been handed since it is officially announced as supporter and judge that potentially provides a prize (legal basis: Art. 6 para. 1 let. f) GDPR). This interest outweighs a potential opposing interest of yours when you freely participate in the contest in which Enter Records forms part of the jury and potentially offers a prize.

Label Radar provides the platform with which you can upload your song. Label Radar processes personal data required to use its platform, so to conclude or perform a contract with the signing up participants (Art. 6 para. 1 let. b) GDPR), to which the participants’ songs are uploaded and shares the personal data required for conducting the Warsteiner Music Contest with us, Warsteiner and Enter Records. Further information on how Label Rader processes personal data can be found in its privacy policy at: https://www.labelradar.com/privacy-policy

We store your personal data that is processed by us in connection with the contest for the duration of the contract and as long as our legitimate interest in processing the data remains, which is determined by the such criteria as the reception and impact of the Warsteiner Music Contest with the audience (e.g. we may display your name as a winner on the dedicated ESL website should it still be relevant for the public who won the contest). Apart from this, your data is stored according to applicable legal obligation of ours.

Who is responsible for what?

Under the GDPR you have certain rights, namely:
● Right of information: You have the right to be provided information regarding the processing of your personal data by us, in accordance with Art. 13 and 14 GDPR.
● Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data, in accordance with Art. 15 GDPR.
● Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you, in accordance with Art. 16 GDPR.
● Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you, in accordance with Art. 17 GDPR.
● Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing, in accordance with Art. 18 GDPR.
● Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, in accordance with Art. 20 GDPR.
● Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you, in accordance with Art. 21 GDPR. This includes but is not limited to the right to object in cases in which we process your personal data on the legal basis of Art. 6 para. 1 let. f) GDPR.
● Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).
● Right to withdraw consent: If a processing of your personal data is based on your consent as set out in Art. 6 para. 1 let. a) GDPR or Art. 9 para. 2 let. a) GDPR, you have the right to withdraw your consent at any time, in accordance with Art. 7 para. 3 GDPR. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
● Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, as set out in Art. 22 para 1 GDPR.

We (ESL Gaming GmbH) are your primary contact point to exercise these rights of yours when processing your personal data in connection with the joint controllership. We and our Partners assist each other to comply with our obligations towards you and inform each other about matters of significance to this joint controllership. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?

We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?

In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of our Partners and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or – where required by article 34 GDPR – our respective Partner will inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights against us or if you have any questions for us regarding the processing, you can contact us via email: privacy@eslgaming.com

Depending on your request, it is possible that our Partners or we will forward your request to one another, should this be necessary to help each other out to answer your request or to get directly in touch with you for this purpose. The legal basis for this is Art. 6 para. 1 lit. b) DSGVO as well as Art. 6 para. 1 lit. f) DSGVO, as we each have a legitimate interest in answering your inquiry effectively and satisfactorily for you. In case of a forward of your request, we and our respective Partner inform each other about the matter to the extent necessary for answering your request.

2.2. Porsche Forza Challenge

What does joint controllership mean?
The Porsche Forza Challenge is an esports tournament hosted by Porsche Cars Great Britain Limited, Bath Road, Calcot, Reading, Berkshire, RG31 7SE (“Porsche”). ESL Gaming UK Ltd., 2nd Floor 64 Mansfield Street Leicester LE1 3DL (“we”, “us” or “ESL”) and Porsche plan and conduct the Porsche Forza Challenge together. This means that we and/or Porsche jointly determine if and how certain personal data of yours is processed when you participate in the tournament. Since we and Porsche each are controllers of your data when doing so, the working relationship is called a joint controllership. We and Porsche have come to an agreement that defines the respective responsibilities of ours and Porsche for compliance with the GDPR. In summary, ESL is responsible for giving you notice and for being the primary point of contact if you want to exercise your data subject rights, otherwise ESL and Porsche are broadly responsible for their own obligations under GDPR. You can find out more on this division of responsibility below.

Who processes which data and why?

As the technical operator, we (ESL) process data as set out in this privacy policy. For the operation of the tournament and the services needed for this, especially the ESL Play platform, we cooperate with ESL Gaming GmbH, Schanzenstraße 23, 51063 Cologne, Germany, a partner ESL company, that provides these services. You can find further information on how ESL Gaming GmbH processes your data in the other sections of this privacy policy.
We are responsible for organizational matters regarding the tournament and through this have certain control over the purposes of data processing for the tournament in an immediate and direct way. By doing this, we process data as a controller, which especially includes:

• Providing the ESL Play platform for the tournament and through this processing personal data such as account information (e.g. your name, nickname, ESL-ID);

• Providing other technical infrastructure (e.g. for the websites) as needed and through this processing personal data such as IP-addresses;

• Publishing leaderboards and winners and through this processing personal data such as images and names;

Data we process to execute the tournament, especially to sign you up, so you can play the matches and compete with others and to grant support to you is required to either enter into a contract with you or perform such a contract (legal basis: Art. 6 para. 1 let. b) GDPR). Apart from this, we also have a legitimate interest in processing this data so you can compete in a fully functioning esports tournament and view your results in the respective leaderboards (legal basis: Art. 6 para. 1 let. f) GDPR). Your ESL Play account data is stored for as long as you maintain your ESL Play account which can be closed anytime at your request or it will be closed automatically after four years of inactivity. Closed accounts will be permanently deleted after a period of 60 days.

By appointing ESL to provide the services for executing the tournament, covering the tournament over media channels and by hosting the tournament under its name, Porsche decides on aspects of and has a say in if and how the tournament will be executed. Through this Porsche has a basic form of control over the execution of the tournament and is the initiator of the processing of personal data for the execution of the tournament and therefore jointly determines the purposes of processing personal data for the execution of the tournament with ESL.

Once the winners of the tournament are determined, ESL will share this information with Porsche, so Porsche can publish the winner’s name, nickname, match results and profile picture and, if desired by the winner, the winner’s social media name to refer to his/her social media profile in the relevant social media networks over the dedicated Porsche media channels (e.g. social media presence). We and Porsche both have a legitimate interest to share this information and to publish who won the Porsche Forza Challenge, since it is an esports tournament open for the public and it is of public interest to be able to receive information on cultural sports events and their results (legal basis: Art. 6 para. 1 let. f) GDPR). Apart from this, it is part of the contractual obligation towards you, to grant you a public platform as a winner of the tournament (legal basis: Art. 6 para. 1 let. b) GDPR), this being ESL Play as a platform as a channel provided by ESL, and Porsche’s media channels dedicated to the coverage of the tournament provided by Porsche. As part of performance of our contract with you, the contact information (e.g. your address and email address) you provide ESL will be shared with Porsche, so Porsche can grant you your prize. This also is a legitimate interest of both ESL and Porsche. Contact information for the grant of the prize will not be made public and only shared with Porsche for this purpose.

Who is responsible for what?

Under the GDPR you have certain rights, namely:
● Right of information: You have the right to be provided information regarding the processing of your personal data by us, in accordance with Art. 13 and 14 GDPR.
● Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data, in accordance with Art. 15 GDPR.
● Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you, in accordance with Art. 16 GDPR.
● Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you, in accordance with Art. 17 GDPR.
● Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing, in accordance with Art. 18 GDPR.
● Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, in accordance with Art. 20 GDPR.
● Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you, in accordance with Art. 21 GDPR. This includes but is not limited to the right to object in cases in which we process your personal data on the legal basis of Art. 6 para. 1 let. f) GDPR.
● Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).
● Right to withdraw consent: If a processing of your personal data is based on your consent as set out in Art. 6 para. 1 let. a) GDPR or Art. 9 para. 2 let. a) GDPR, you have the right to withdraw your consent at any time, in accordance with Art. 7 para. 3 GDPR. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
● Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, as set out in Art. 22 para 1 GDPR.

We (ESL Gaming UK Ltd.) are the primary contact point for you to exercise these rights of yours when we process your personal data in connection with the joint controllership (see contact section below). You can at any time of course also contact Porsche to exercise your data subject rights. Porsche and ESL can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Porsche and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or Porsche (as appropriate), will, where required by article 34 GDPR, inform you about the personal data breach without undue delay.

Contact:
If you want to contact ESL to exercise your rights or if you have any questions for us regarding the use of your data, you can contact us via email: privacy@eslgaming.com

You can also at any time contact Porsche if you would like to make a request relating to your personal data, you may either call Porsche on +44 3457 911 911 or write to Porsche at the following address: Data Protection Officer, Porsche Cars Great Britain Limited, Bath Road, Calcot, Reading, RG31 7SE. If you wish to exercise your data subject rights against Porsche, you can do this through the Porsche Rights Request web form;

You can find details on how Porsche processes your personal data in Porsche’s privacy policy: https://www.porsche.com/uk/privacy-policy/
For further information on how ESL process your personal data, please see our main privacy notice: https://www.eslgaming.com/privacypolicy/

Depending on your request, it is possible that Porsche and we will forward your request to one another, should this be necessary to help each other out to answer your request or to get directly in touch with you for this purpose. The legal basis for this is Art. 6 para. 1 lit. f) GDPR, as we each have a legitimate interest in answering your inquiry effectively and satisfactorily for you. In case of a forward of your request, we and Porsche inform each other about the matter to the extent necessary for answering your request.


2.3. UEFA eEURO 2021 eTournament

What does joint controllership mean?
The UEFA eEURO 2021 eTournament is an esports tournament hosted by Union des Associations Européennes de Football, Route de Genéve 46, 1260 Nyon, Switzerland (“UEFA”). ESL Gaming GmbH (“we”, “us” or “ESL”) and UEFA plan and conduct the UEFA eEURO 2021 eTournament together. This means that we and/or UEFA jointly determine if and how certain personal data of yours is processed when you participate in the tournament. Since we and UEFA each are controllers of your data when doing so, the working relationship is called a joint controllership. We and UEFA have come to an agreement that defines the respective responsibilities of ours and UEFA for compliance with the GDPR. In summary, ESL is responsible for giving you notice and for being the primary point of contact if you want to exercise your data subject rights, otherwise ESL and UEFA are broadly responsible for their own obligations under GDPR. You can find out more on this division of responsibility below.

Who processes which data and why?
As the technical operator, we (ESL) process data, especially:
• To execute the tournament, especially to provide the ESL Play platform, we process account information from your ESL-ID. We do so for the purpose of performing a contract and based on our legitimate interest of having a functioning and easy signup and playing process for the tournament (legal basis: Art. 6 para. 1 let. b) and f) GDPR).
• To provide technical infrastructure as needed for the tournament we process personal data such as your IP-address for the delivery of the website or when using analytics tools, which are both in our legitimate interest of granting functioning webservices and a better user experience (legal basis: Art. 6 let. f) GDPR).
• To provide technical opt-in solutions for you if you want to opt-in to the UEFA newsletter. The data you agree to grant UEFA for sending you the newsletter, is transferred by us to UEFA based on your consent to the transfer and for the purpose that UEFA can send you its newsletter (legal basis: Art. 6 para. 1 let. a) GDPR). You can at any time withdraw your consent to the transfer of your data to UEFA via email to privacy@eslgaming.com. The withdrawal of your consent does not affect the lawfulness of the use of your data before your withdrawal.
• To publish leaderboards and winners we process personal data of yours, such as your image and name. We do so for the purpose of performing a contract and based on our legitimate interest of having a functioning playing process for the tournament and for a good experience of the players and the audience of the tournament (legal basis: Art. 6 para. 1 let. b) and let. f) GDPR).
• If you participate in a part of the tournament that is broadcasted and/or streamed live as part of the tournament, we process personal data that are reasonably required for the production and filming of such an event for its audience, such as your image and name. We have a legitimate interest in creating such video and photo material by processing your data (Art. 6 para. 1 let. f GDPR).
• If you participate in the finals, we process the personal data of yours necessary to book your travel and accommodation at the location of the finals. We do so for the purpose of performing a contract and based on our legitimate interest of helping you attend the finals (legal basis: Art. 6 para. 1 let. f) GDPR).
• If you are a winner of the tournament, we use your personal data required to contact you to grant you the prize you may have won. We do so for the purpose of performing a contract and based on our legitimate interest of granting you a prize you may have won (legal basis: Art. 6 para. 1 let. b) and let. f) GDPR).
• We process personal data of yours we receive not directly from you but from the national association you may be playing for as well as from UEFA. We do so to perform our contract with you and also based on our legitimate interests of informing the audience about the results of matches and making sure you can progress in the tournament according to your game results (legal basis: Art. 6 para. 1 let. f) GDPR).
Personal data processed based on a performance of contract is stored for at least for as long as the contract with you and us is given. Personal data processed based on a legitimate interest of ours is stored for as long as such legitimate interest is given. The criteria for these storage periods are such as the security and functionality of our IT systems, copyrights in recording video material, legal obligations to store data. Your ESL Play account data is stored for as long as you maintain your ESL Play account which can be closed anytime at your request or it will be closed automatically after four years of inactivity. Closed accounts will be permanently deleted after a period of 60 days.
Please see the other sections in our privacy policy for further information on how we process your personal data.

By hosting the event under its name, and by appointing ESL to help conduct the tournament, and by deciding on aspects of the tournament, UEFA is the initiator of the processing of personal data for the execution of the event. Due to this, UEFA jointly determines the purposes of processing of personal data for the execution of the event together with us.

We share the following data with UEFA which UEFA processes as follows:
• Email addresses of users that opt-in to UEFA’s newsletter (see for further information regarding the UEFA newsletter: http://www.uefa.com/privacypolicy);
• Personal data included in team rosters (e.g. names) and information for public leaderboards to properly run the tournament together with ESL (legal basis: Art. 6 para. 1 let. b) and f) GDPR). This data will be deleted by UEFA after the finals of the eEURO 2021 eTournament.

Who is responsible for what?
Under the GDPR you have certain rights, namely:
● Right of information: You have the right to be provided information regarding the processing of your personal data by us, in accordance with Art. 13 and 14 GDPR.
● Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data, in accordance with Art. 15 GDPR.
● Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you, in accordance with Art. 16 GDPR.
● Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you, in accordance with Art. 17 GDPR.
● Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing, in accordance with Art. 18 GDPR.
● Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, in accordance with Art. 20 GDPR.
● Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you, in accordance with Art. 21 GDPR. This includes but is not limited to the right to object in cases in which we process your personal data on the legal basis of Art. 6 para. 1 let. f) GDPR.
● Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).
● Right to withdraw consent: If a processing of your personal data is based on your consent as set out in Art. 6 para. 1 let. a) GDPR or Art. 9 para. 2 let. a) GDPR, you have the right to withdraw your consent at any time, in accordance with Art. 7 para. 3 GDPR. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
● Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, as set out in Art. 22 para 1 GDPR.

We (ESL Gaming GmbH) are the primary contact point for you to exercise these rights of yours when we process your personal data in connection with the joint controllership (see contact section below). You can at any time of course also contact UEFA to exercise your data subject rights. UEFA and ESL can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of UEFA and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or UEFA (as appropriate), will, where required by article 34 GDPR, inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights or if you have any questions regarding the processing, you can contact us via email:privacy@eslgaming.com
Of course, you can also contact UEFA at any time. In such case it is possible that UEFA will forward your request to us, so we can help UEFA out to answer your request or so we can get directly in touch with you for this purpose. Also, it is possible that we will forward your request to UEFA should we not be able to answer it without the UEFA’s help. In case of a forward of your request, we and UEFA inform each other about the matter to the extent necessary for answering your request.

2.4. Information on the joint controllership between ESL, EGO and Dreamhack


What does joint controllership mean?
Our newsletter is jointly maintained by us, DreamHack AB, Telefonvägen 30, 126 26 Hägersten, Sweden (“Dreamhack”) and ESL Gaming Online Inc., 1212 Chestnut St, Burbank, CA 91506 (“EGO”). This means that Dreamhack, EGO and we jointly determine if and how certain personal data of yours is processed to offer you the newsletter. Since Dreamhack, EGO and we each are controllers of your data when doing so, the working relationship is called a joint controllership. Dreamhack, EGO and we have come to an agreement that defines the respective responsibilities of Dreamhack, EGO and us for compliance with the GDPR.

How do Dreamhack, EGO and we process data?
Dreamhack, EGO and we jointly process personal data collected when you sign up for our joint newsletter. We organize the signups for the newsletter over websites and other channels together and process personal data of subscribers, including but not limited to email addresses, names and information gathered by the analytics tool of the newsletter software. We may add information on your interests to our newsletter database to personalize the newsletter you receive (e.g. if you have signed up for a newsletter in connection with a specific event we will add the information to our database that you are interested in such events).

Who is responsible for what?
We (ESL Gaming GmbH) are the primary contact point for you to exercise your data subject rights set out in Sect. V when we process your personal data in connection with the joint controllership (see contact section below). You can at any time of course also contact Dreamhack or EGO to exercise your data subject rights. Dreamhack, EGO and we can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Dreamhack and/or EGO and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we, Dreamhack or EGO (as appropriate), will, where required by article 34 GDPR, inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights or if you have any questions regarding the processing, you can contact us via email: mailto:privacy@eslgaming.com
Of course, you can also contact Dreamhack or EGO at any time. In such case it is possible that Dreamhack or EGO will forward your request to us, so we can help Dreamhack or EGO out to answer your request or so we can get directly in touch with you for this purpose. Also, it is possible that we will forward your request to Dreamhack and/or EGO should we not be able to answer it without the Dreamhack and/or EGO’s help. In case of a forward of your request, Dreamhack, EGO and we inform each other about the matter to the extent necessary for answering your request. Please see Sect. VII. for further information on how we process data when cooperating with our Subsidiaries when communicating with you and when answering requests you have as data subject. This information also applies to the cooperation with Dreamhack when communicating with you regarding the newsletter and/or when you have a request as data subject regarding the newsletter.

2.5. Starcraft II® & Warcraft® III: Reforged™ esports tournaments

What does joint controllership mean?
We work together with Blizzard Entertainment, Inc., One Blizzard Way, Irvine, CA 92518 and Blizzard Entertainment International, a division of Activision Blizzard International B.V., Prinses Beatrixlaan 582, WTC The Hague, Toren E, Units 6.01-6.03, 2595 BM 's-Gravenhage, The Netherlands (“Blizzard”) and DreamHack AB, Telefonvägen 30, 126 26 Hägersten, Sweden („Dreamhack“) to conduct Blizzard’s Starcraft II® & Warcraft® III: Reforged™ esports tournaments. This means that Dreamhack, Blizzard and we jointly determine if and how certain personal data of yours is processed when conducting the tournaments. Since Dreamhack, Blizzard and we each are controllers of your data when doing so, the working relationship is called a joint controllership.

How do Dreamhack, Blizzard and we process data?
Dreamhack, Blizzard and we jointly process personal data collected when you participate in a Starcraft II® or Warcraft® III: Reforged™ esports tournament. We are the technical operator of the tournaments and decide on how personal data of yours is processed to conduct a tournament you participate in, e.g., when we provide technical infrastructure (e.g., the ESL Play platform), publish leaderboards, produce, film or broadcast the tournament or pay out prize money and thereby process personal data. Dreamhack also may operate such tournaments and provide technical infrastructure (e.g., operating websites), publish leaderboards, produce, film or broadcasts a tournament and thereby process personal data. Blizzard also has control over such personal data of yours since it decides on certain aspects of the tournament and is the initiator of the processing of personal data for the execution of the tournaments and may provide us game data and other data relevant for conducting the tournaments. Details on how your data is processed can be found in Blizzard’s or our privacy policy.

Who is responsible for what?
For all tournaments primarily operated by us (ESL Gaming GmbH), we are the primary contact point for you to exercise your data subject rights set out in Sect. V when your personal data is processed in connection with the joint controllership (see contact section below). You can at any time of course also contact Dreamhack or Blizzard to exercise your data subject rights. Dreamhack, Blizzard and we can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers. For all tournaments primarily operated by Dreamhack, Dreamhack is the primary contact point for you to exercise your data subject rights when your personal data is processed in connection with the joint controllership (see contact section below). You can at any time of course also contact Blizzard or us to exercise your data subject rights. Dreamhack, Blizzard and we can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Dreamhack and/or Blizzard and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we, Dreamhack or Blizzard (as appropriate), will, where required by article 34 GDPR, inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights towards us or if you have any questions regarding the processing, you can contact us via email at privacy@eslgaming.com If you want to exercise your rights towards Dreamhack or if you have any questions regarding the processing, you can contact Dreamhack via email at support@dreamhack.com Of course, you can choose if you want to contact Dreamhack, Blizzard or us. In such case it is possible that Dreamhack, Blizzard or we will forward your request to one another, so we can help each other to answer your request or so we can get directly in touch with you for this purpose. In case of a forward of your request, Dreamhack, Blizzard and we inform each other about the matter to the extent necessary for answering your request. Please see Sect. VII. for further information on how we process data when cooperating with our Subsidiaries when communicating with you and when answering requests you have as data subject. This information also applies to when you communicate with Dreamhack regarding a request you may have as data subject.

2.6. Hearthstone® esports tournaments

What does joint controllership mean?
We work together with Blizzard Entertainment, Inc., One Blizzard Way, Irvine, CA 92518 and Blizzard Entertainment International, a division of Activision Blizzard International B.V., Prinses Beatrixlaan 582, WTC The Hague, Toren E, Units 6.01-6.03, 2595 BM 's-Gravenhage, The Netherlands (“Blizzard”) and DreamHack AB, Telefonvägen 30, 126 26 Hägersten, Sweden („Dreamhack“) to conduct Blizzard’s Hearthstone® esports tournaments. This means that Dreamhack, Blizzard and we jointly determine if and how certain personal data of yours is processed when conducting the tournaments. Since Dreamhack, Blizzard and we each are controllers of your data when doing so, the working relationship is called a joint controllership.

How do Dreamhack, Blizzard and we process data?
Dreamhack, Blizzard and we jointly process personal data collected when you participate in a Hearthstone® esports tournament. ESL is the technical operator of the tournaments and decides on how personal data of yours is processed to conduct a tournament you participate in, e.g., when it provides technical infrastructure, publishes leaderboards, produces, films or broadcasts the tournament or pays out prize money. If a tournament takes place at a Dreamhack festival, Dreamhack may process personal data required to manage the accreditation to the event and/or the travel and accommodation matters of participants. Blizzard also has control over such personal data of yours since it decides on certain aspects of the tournament and is the initiator of the processing of personal data for the execution of the tournaments and may provide us game data and other data relevant for conducting the tournaments. Details on how your data is processed can be found in Blizzard’s or our privacy policy.

Who is responsible for what?
We (ESL Gaming GmbH) are the primary contact point for you to exercise your data subject rights set out in Sect. V when your personal data is processed in connection with the joint controllership (see contact section below). You can at any time of course also contact Dreamhack or Blizzard to exercise your data subject rights. Dreamhack, Blizzard and we can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Dreamhack and/or Blizzard and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we, Dreamhack or Blizzard (as appropriate), will, where required by article 34 GDPR, inform you about the personal data breach without undue delay.

Contact:
If you want to exercise your rights or if you have any questions regarding the processing, you can contact us via email: privacy@eslgaming.com Of course, you can choose if you want to contact Dreamhack, Blizzard or us. In such case it is possible that Dreamhack, Blizzard or we will forward your request to one another, so we can help each other to answer your request or so we can get directly in touch with you for this purpose. In case of a forward of your request, Dreamhack, Blizzard and we inform each other about the matter to the extent necessary for answering your request. Please see Sect. VII. for further information on how we process data when cooperating with our Subsidiaries when communicating with you and when answering requests you have as data subject. This information also applies to when you communicate with Dreamhack regarding a request you may have as data subject.

2.7. Wargaming e-Shop

What does joint controllership mean?
The Wargaming Shop is an online store that is jointly operated by Wargaming Group Limited, with address at 105, Agion Omologiton Avenue, 1080 Nicosia, Cyprus (“Wargaming”) and by ESL Gaming GmbH, with address at Schanzenstraße 23, 51063 Cologne, Germany (“we”, “us” or “ESL”). This means that we and/or Wargaming jointly determine if and how certain personal data of yours is processed when you access the Shop or make purchases.

Since we and Wargaming each are controllers with regard to certain personal data, when doing so, the working relationship is called a joint controllership. We and Wargaming have come to an agreement that defines the respective responsibilities of ours and Wargaming for compliance with the GDPR (General Data Protection Regulation of the European Union). In summary, ESL is responsible for giving you notice with respect to the joint controllership and for being the primary point of contact if you want to exercise your data subject rights, otherwise ESL and Wargaming are responsible for their own obligations under their main agreement.

You can find out more on the joint controllership and the division of responsibility below.

Who processes which data and why?
As the technical operator of the Shop, we (ESL) process data as set out in this privacy policy.

We are responsible for organizational matters regarding the tournament and through this have certain control over the purposes of data processing for the tournament in an immediate and direct way. By doing this, we process data as a controller, which especially includes:

• Providing technical infrastructure as needed and thereby processing personal data such as IP addresses for the delivery of the website or when using analytics tools;
• Communicating with customers and executing purchases and requests and thereby processing personal data such as names, addresses and email addresses,
• Processing email addresses of customers that opt-in to receive e-Shop-related marketing material.

By appointing ESL to provide the services as set out in the Main Agreement, by hosting the E-Shop under its name, and by exercising its approval rights, Partner decides on aspects of and has a saying in if and how the E-Shop shall be operated, thus it has a basic form of control over the operation of the E-Shop and is the initiator of the processing of personal data for the operation of the E-Shop and therefore jointly determines the purposes of processing of personal data for the execution of the E-Shop with ESL.

Who is responsible for what?
Under the GDPR you have certain rights, as described under section “Your Rights” of this privacy policy.

We (ESL) are the primary contact point for you to exercise these rights of yours when we process your personal data in connection with the joint controllership (see contact section below). You can at any time of course also contact Wargaming to exercise your data subject rights. Wargaming and ESL can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers.

How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.

What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Wargaming and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or – where required by article 34 GDPR – Wargaming will inform you about the personal data breach without undue delay.

Contact:
If you want to contact ESL to exercise your rights or if you have any questions for us regarding the use of your data, you can contact us via email: privacy@eslgaming.com

Depending on your request, it is possible that Wargaming and we will forward your request to one another, should this be necessary to help each other out to answer your request or to get directly in touch with you for this purpose. The legal basis for this is Art. 6 para. 1 lit. f) GDPR, as we each have a legitimate interest in answering your inquiry effectively and satisfactorily for you. In case of a forward of your request, we and Wargaming inform each other about the matter to the extent necessary for answering your request.
III. Meaning of Terms
The meaning of certain terms we use in this Privacy Notice is defined by the General Data Protection Regulation (“GDPR”), a data protection law of the European Union. All definitions set out in Art. 4 GDPR apply to this Privacy Notice. We would like to explicitly mention the meanings of the following terms to make transparent what the often-used terms personal data, data subject, processing, controller and processor mean according to the GDPR:

● ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

● ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

● ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

● ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

IV. Legal Basis
As a controller we need a legal basis to process your data lawfully, according to Art. 6 para. 1 GDPR. If:

● you have given your consent to the processing of your personal data for one or more specific purposes, this forms a legal basis according to Art. 6 para. 1 let. a) GDPR;

● you have given explicit consent to the processing of special categories of personal data (e.g. data concerning health) for one or more specified purposes, and such consent is possible according to applicable law, this forms a legal basis according to Art. 9 para. 2 let. a) GDPR;

● the processing is necessary for the performance of a contract between you and us or in order to take steps at your request prior to entering into a contract, the legal basis for this is Art. 6 para. 1 let. b) GDPR;

● the processing is necessary for compliance with a legal obligation to which we are subject, the legal basis for this is Art. 6 para. 1 let. c) GDPR;

● the processing is necessary to protect our legitimate interests or legitimate interests of a third party and such legitimate interests are not outweighed by your interests or fundamental rights and freedoms, the legal basis for this is Art. 6 para. 1 let. f) GDPR.

● the data is processed for employment-related purposes, e.g. for hiring, carrying out or terminating an employment contract, the legal basis for this is Art. 88 para. 1 GDPR in connection with Sect. 26 para. 1 sent. 1 or para. 3 Federal Data Protection Act (Bundesdatenschutzgestz – BDSG).

V. Your Rights
Under the GDPR you have certain rights concerning the processing of personal data by us. According to the GDPR you have the following rights:

● Right of information: You have the right to be provided information regarding the processing of your personal data by us, in accordance with Art. 13 and 14 GDPR.

● Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data, in accordance with Art. 15 GDPR.

● Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you, in accordance with Art. 16 GDPR.

● Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you, in accordance with Art. 17 GDPR.

● Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing, in accordance with Art. 18 GDPR.

● Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, in accordance with Art. 20 GDPR.

● Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you, in accordance with Art. 21 GDPR. This includes but is not limited to the right to object in cases in which we process your personal data on the legal basis of Art. 6 para. 1 let. f) GDPR.

● Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR, as set out in Art. 77 GDPR.

● Right to withdraw consent: If a processing of your personal data is based on your consent as set out in Art. 6 para. 1 let. a) GDPR or Art. 9 para. 2 let. a) GDPR, you have the right to withdraw your consent at any time, in accordance with Art. 7 para. 3 GDPR. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

● Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, as set out in Art. 22 para 1 GDPR.

If you want to exercise your rights or if you have any questions for us regarding the processing, you can contact us via email: privacy@eslgaming.com.

VI. Recipients / Categories of Recipients
The personal data we process can also be either processed by other parties on our behalf (data processors) or transferred to and processed by other controllers. When data is processed according to this Privacy Notice, in principle, it is done so by the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Especially the following main providers of ours may be recipients of your data:


HR services:

Bamboo HR LLC
335 South 560 West Lindon
UT 84042
USA (“Bamboo”)


Office tools (Workspace, formerly GSuite), advertising and analytics tools:

Google Ireland Limited, register number
368047, Gordon House, Barrow Street,
Dublin 4, Ireland (“Google Ireland”)

and

Google LLC
1600, Amphitheatre Parkway Mountain View, CA 94043
USA (both together: “Google”)


Ticketing and related tools:

Atlassian Pty Ltd
Level 6, 341 George Street Sydney
NSW 2000
Australia (“Atlassian”)


Social media platforms and analytics tools:

Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland (“Facebook”)

and

Twitter International Company
One Cumberland Place, Fenian Street
Dublin 2, D02 AX07 Ireland (“Twitter”)

and

Google Ireland (Advertisements and Analytics)


Newsletter software:

The Rocket Science Group, LLC
675 Ponce de Leon Ave NE
Suite 5000
Atlanta, GA 30308 USA (“Mailchimp”)


Survey tools:

SurveyMonkey Europe UC
2nd Floor, 2 Shelbourne Buildings,
Shelbourne Road, Dublin, Ireland

and

SurveyMonkey Inc.
1 Curiosity Way San Mateo,
CA 94403, USA (both together: “SurveyMonkey”)


Raffle tools:

Crowd9 PTY LTD
16 Jacaranda Crescent
Mornington, VIC 3931
Australia (“Gleam”)


Customer support tools:

Go Squared Ltd.
3 Barn Hawe
High Street
Edenbridge
Kent
United Kingdom
TN8 5AQ (“Go Squared”)

and

Zendesk, Inc.
1019 Market Street
San Francisco, CA 94103
USA (“Zendesk”)


Host providers:

PlusServer GmbH
Hohenzollernring 72
50672, Köln (“Plusserver”)

and

Pantheon Systems, Inc.
717 California Street, 3rd Floor,
San Francisco, California (“Pantheon”)


CRM tools:

Salesforce.com, Inc.
The Landmark @ One Market Street,
San Francisco, CA 94105
USA (“Salesforce”)


Messaging software:

Slack Technologies, Inc., 500 Howard Street, San Francisco, CA 94105
USA (“Slack”)


Shop tools:

Shopify Inc.
150 Elgin Street, Suite 800
Ottawa, ON, K2P 1L4
Canada

and

Shopify International Ltd.
Victoria Buildings, 2. Etage
1-2 Haddington Road
Dublin 4, D04 XN32
Ireland (both together: “Shopify”)

and

Yotpo Ltd,
14 Oscar Shindler,
Tel Aviv, Israel (“Yotpo”)

and

TradeGecko Pte. Ltd.
121 Telok Ayer, #02
Singapore, 068590 (“QuickBooks”)


Video and photo platforms:

Google Ireland (YouTube)

and

Twitch Interactive, Inc.
350 Bush Street, 2nd Floor
San Francisco, CA 94104 (“Twitch”)


Consent management:

Usercentrics GmbH
Sendlinger Str. 7
80331 München
Germany (“Usercentrics”)


Forum software:

Vanilla Forums, Inc.
388 St Jacques, Suite 800
Montreal, QC H2Y 1S1
Canada (“Vanilla Forums”)


Contract signing:

DocuSign, Inc.
221 Main Street, Suite 1000,
San Francisco, CA 94105,
USA, (“DocuSign”)


Some of these recipients are established outside of the European Union. These recipients are either located in a third country for which the European Commission has recognized that it provides an adequate level of data protection – here Israel and Canada – or we have concluded the EU Standard Contractual Clauses for transfers of personal data to processors established in so called third countries, meaning countries that are not part of the European Union or the European Economic Area, which provide adequate guarantees to ensure data protection at European level.

With Subsidiaries of ours that are established outside the European Union and to whom we may transfer personal data as controllers or that process data on our behalf as processors we have also concluded a Intercompany Data Protection Agreement including the necessary provisions for joint controllers according to Art. 26 GDPR and Art. 28 GDPR as well as the respective EU Standard Contractual Clauses for transfers of personal data.

Apart from this, the following categories of recipients process data either on our behalf or with us as joint controllers or as individual controllers: financial and IT services; media; partners that statistically and analytically process sports data; website analytics providers; messaging systems; Subsidiaries of ESL (e.g. when a Tournament is conducted in a country outside of Germany in which such subsidiary of ESL has its offices); other players of the played game; companies involved in travel bookings; providers of online shop software; partners of ours that are dedicated to broadcasting, coverage or other commercial engagements connected to an esports tournament; providers of raffle solutions; forum software providers; sponsors of prizes.

You can find further information on which recipients and categories of recipients are involved in the processing of personal data under Section VII.

VII. General Data Processing
In the following we would like to inform you about how we process your personal data. These are the general processing activities that can apply when you interact with us. Every processing activity is broken down into 5 parts:

(a.) What: What data is processed?
(b.) Who: Who receives the data?
(c.) Why: For what purpose is the data processed?
(d.) Legal Basis: What law allows us to process the data?
(e.) How Long: How long do we keep the data?

1. Communication via Email and Phone

a. What
If we communicate with you via email, mail or telephone, we process all personal data you disclose to us during our conversation (e.g. you name, email address, the reason why you are contacting us etc.).

Apart from this, it is also possible that we use other online messaging systems to communicate with you, if you wish to contact us over these channels. Please note that if you wish to contact us via such messaging systems, it is possible that the respective companies that offer these communication services may also process your personal data and that regarding this their privacy policies apply. We have no influence over such data processing by third parties. For further information on how these services process your personal data, please view their privacy policies.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing (e.g. someone from a department that you are contacting with a request). Possible further recipients: the providers of the respective messaging systems; Google (Workspace); Go Squared; Slack; Zendesk.

Depending on the specific topic of the conversation as well as the circumstances (e.g. a certain Tournament you participate in) it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
Depending on the specific conversation with you, the personal data can either be processed in order to take steps at your request prior to entering into a contract with us or to perform a contract you have concluded with us. Also, the processing can be necessary for us to comply with legal documentation obligations, or the processing can be necessary for the purposes of our legitimate interest to respond to mails and calls of yours when you contact us and are not our contractual partner as well as to have proof regarding substantial content of our conversation, including but not limited to cases of potential legal claims on our or your side.

d. Legal Basis
The legal basis for processing the personal data in order to take steps at your request prior to entering into a contract with us or to perform a contract you have concluded with us is Art. 6 para. 1 let. b) GDPR. The legal basis for processing the data for compliance with our legal obligations is Art. 6 para. 1 let. c) GDPR. The legal basis for processing the data due to our legitimate interest is Art. 6 para. 1 let. f) GDPR.

e. How long
The data is stored at least for the time until our contract with you is fully performed. If the data has been stored in order to take steps at your request prior to entering into a contract with us, we will store the data for as long as reasons objectively exist to believe that the respective conversation will be continued within the foreseeable future. If your communication is considered a commercial or business letter under Sect. 147 para. 1 no. 2 of the Fiscal Code of Germany, it is stored for 6 years as set out in Sect. 147 para. 3 sent. 1 of the Fiscal Code of Germany. Should it be considered documentation according to Sect. 257 para. 1 no. 2 and 3 of the German Commercial Code, the storage duration also is 6 years and if it is considered documentation according to Sect. 257 para. 1 no. 1 and 4 of the German Commercial Code, the storage duration is 10 years, as set out in Sect. 257 para. 4 of the German Commercial Code.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

2. Visiting our Websites

a. What
When you visit our website, we process personal data of yours, such as your IP-address, the time of your visit, what browser type you use, which pages on our websites you visited, if applicable, also the website from where you were referred to our website.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: IT service providers and host providers, especially Plusserver and Pantheon.

c. Why
We process this data to display the website correctly in your browser, so you are able to make use of the full functionality of the services and the website content. We also process the data for troubleshooting, should the website not work correctly as well as for security purposes (e.g. to prevent malicious attacks on our website). These are legitimate interests of ours.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. f) GDPR.

e. How long
The data is stored for as long as our legitimate interest is given. For this, the data is stored for the time that we reasonably need to ensure our systems have not been subject to malicious use and to be able to effectively respond to any potential bugs or other malfunctions of the website.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

3. Prize Money & Other Payments

a. What
We process your bank details (e.g. IBAN, BIC etc.) together with your first and last name to be able to pay you a remuneration you might be entitled to due to a contract with us or to pay out prize money when you are the winner of a Tournament of ours and have a claim to such prize money according to the respective rules and to comply with legal obligations (e.g. tax laws). Without this data we are not able to make the respective payment.

If you have not given us the data yourself, we would like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us).

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: financial and IT services; Atlassian; Google (Workspace); SAP.

Depending on your contract or the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
The personal data is processed to perform our obligations of our contract with you, namely the payment of a remuneration or prize money. If a payment is made, the data is processed to comply with legal obligations, such as bookkeeping and taxes.

d. Legal Basis
The legal basis for processing the personal data for the performance of our contract with you is Art. 6 para. 1 let. b) GDPR. The legal basis for processing the data for compliance with our legal obligations is Art. 6 para. 1 let. c) GDPR.

e. How long
The data is stored at least for the time until our contract with you is fully performed. If a payment is made, the data will be stored for as long as the legal obligations we need to comply with require us to store the information for (e.g. 6 or 10 years according to Sect. 147 para. 3 of the Fiscal Code of Germany).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

4. Compliance Checks for Prize Money Payments

a. What
We process personal data of yours, such as your name and bank account number and share this information with our bank to pay out your prize money. To fulfill certain financial and economic regulations, our bank can require us in specific cases to gather and transfer to it the following information of yours: your full name, birth date, place of birth, address and bank information (e.g. bank account number). It is possible that we will additionally require a copy of your ID (e.g. passport) to provide it to our bank. Should a copy of your ID be necessary, please mark it clearly as a copy before sending it to us (e.g. insert in capital letters “COPY” across the scan of your ID). If you have not provided us the data yourself, we would like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us, or if your name appears on a public list).

b. Who
Recipients of the processed personal data are the respective internal employees of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: Financial and IT service providers, especially our bank, can be the recipients of the data.

c. Why
We process your personal data and share it with our bank for the purpose of paying out your prize money and complying with financial and economic regulations (e.g. prevention of profits from criminal activities) that apply to money transfers. Should a legal obligation to process your data for compliance reasons apply to our bank (e.g. compliance with international sanctions lists to prevent terrorism and other criminal activities), as well as to us to assist the bank, we will cooperate accordingly with our bank, to ensure that you can receive your payment and that this happens in a lawful way. Our bank can be obliged to do such checks, e.g. according to Art. 2 para. 3 of the regulation (EG) Nr. 881/2002 and its amendments, Art. 3 para. 2 of the regulation (EU) Nr. 753/2011 or other applicable sanctions and regulations. Also, it is a legitimate interest of ours to cooperate accordingly with our bank, to ensure that you can receive your payment and that this happens in a lawful way, even if a legal obligation to process your data for compliance reasons should only apply to our bank (e.g. compliance with international sanctions lists to prevent terrorism and other criminal activities).

d. Legal Basis
The legal basis for processing the personal data for paying out the prize money as part of our contract with you is Art. 6 para. 1 let. b) GDPR. The legal basis for processing the data for compliance with the legal obligations of our bank to comply with the GwG (Act on the Tracing of Profits from Serious Crimes) is Art. 6 para. 1 let. c) GDPR in connection with § 11 para. 6 sent. 1 GwG. Should another regulation form the basis for an obligatory cooperation of ours with the bank, the legal basis is Art. 6 para. 1 let. c) GDPR in connection with the respective regulation. The legal basis for processing the data to comply with other compliance obligations based on our legitimate interest, is Art. 6 para. let. f) GDPR.

e. How long
We store the data at least for the time until our contract with you is fully performed. If a payment of prize money is made, the data will be stored for as long as the legal obligations we need to comply with require us to store the information for (e.g. 6 or 10 years according to Sect. 147 para. 3 of the Fiscal Code of Germany). Should a copy of your ID have been required by us for the payment of prize money, we will delete the copy after transferring it to our bank without undue delay.

5. ESL Account (ESL ID)

a. What
When you register for an ESL Account, we process the following required data of yours:
• nickname
• email address
• birth date
• country of residence

Apart from this required data, you have the option to upload further optional data to your account, such as your full name, team, profile picture, homepage, hardware, personal favorites, game-related favorites, favorite websites, social media presences.

When you play games while logged in to your ESL Account, your performance in games (e.g. match scores etc.) is saved to your account.

Please note that all personal data you upload to your ESL Account or that is related to your performance in games is publicly visible, except for your first and last name, age, city and postal code (you can opt in to display these though) and your email address.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for processing the data. Possible further recipients: IT service providers and host providers.

c. Why
We process the required data to enter into and perform a contract with you (account contract) so you can use our service (e.g. participate in Tournaments through your ESL ID or communicate with friends on the platform). Game-related data is processed to perform the contract with you and also based on the legitimate interest of ours and the other ESL Play users to view match statistics and other data relevant to the games that are played on ESL Play.

Optional data is processed based on our legitimate interest of providing you a services that lets you individualize your public appearance, connect with friends and enjoy a personalized experience with the esports community.

d. Legal Basis
The legal basis for processing the data to enter into or perform a contract we concluded with you is Art. 6 para. 1 let. b) GDPR.

The legal basis for processing data based on our legitimate interest is Art. 6 para. let. f) GDPR.

e. How long
Your ESL Account data is stored for as long as you maintain your ESL account which can be closed anytime at your request or it will be closed automatically after four years of inactivity. Closed accounts will be permanently deleted after a period of 60 days.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

6. Account linking

a. What
You have the possibility to link certain accounts you may have with third-party platforms to your ESL Account. This grants you the possibility to:
• verify your identity when you want to join matches on that platform with your ESL ID;
• sync tournaments you participate in that take place on a third-party platform;
• integrate ESL functions into functions of services of the respective third-party platform and vice versa. Functions vary from platform to platform, as well as the personal data that may be shared by us and the third-party platform. Please check the respective information page for this; or
• automatically fill in fields of your ESL Account profile when you first register for an ESL account and chose to register with a third-party account.
When you link an account that you may have with a third-party platform, we can view certain profile information of the linked account (e.g. your name, account nickname, email address) and use this data to offer you ESL services. The same applies to cases in which you link your ESL Account to a third-party account and the platform provider can view information of yours in your ESL Account.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for processing the data. Possible further recipients: IT services; host providers; the third-party platform provider may receive the information you share with it by linking your ESL Account to its service.

c. Why
We process the data to enter into a contract with you at your request, if you chose to register to your ESL Account with an account you may have with a third-party platform. It is also a legitimate interest of ours to provide you the possibility of easily setting up your account by transferring data you have already entered for another account into your new ESL Account.

When we process the data to provide you features (e.g. syncing tournaments, verifying your identity), we do so to perform the contract we have concluded with you when you registered for your ESL Account. We also have a legitimate interest to process and transfer the data to the platform provider of the linked account, since you can freely choose to use this possibility and easily combine service features of ours and of the third-party platform.

d. Legal Basis
The legal basis for processing the data to enter into or perform a contract we concluded with you is Art. 6 para. 1 let. b) GDPR.

The legal basis for processing data based on our legitimate interest is Art. 6 para. let. f) GDPR.

e. How long
If you have linked your ESL Account to another account, you can at any time unlink them under “Manage linkages”. Please note, that data you have shared during the linkage is stored by the third-party platform provider according to its retention periods. Please check that provider’s privacy notice for further information.

Your ESL Account data is stored for as long as you maintain your ESL Account which can be closed anytime at your request or it will be closed automatically after four years of inactivity. Closed accounts will be permanently deleted after a period of 60 days.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

7. ESL Discord Servers

a. What
You have the possibility to link your Discord account to your ESL Account. To improve our services, to better serve you, and for statistical purposes, if you choose to share your status from games, Spotify or any other apps/services you have connected to Discord, and if you consent to this by clicking on the window that will pop-up to request consent, we will collect information on what games you play, games that interest you the most, when you are active, what music you listen to while playing, and other information available in connection with the apps/services linked to your Discord account.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for processing the personal data. Possible further recipients: IT services; host providers.

c. Why
We process the data to improve and optimize our services by understanding you better, to offer new or related services on Discord and our websites, to make our marketing communications more relevant for you, and for statistical purposes.

d. Legal Basis
The legal basis for processing the personal data is your consent, according to Art. 6 para. 1 let. a) of the GDPR.

e. How long
If you have given us your consent to process the personal data, you may withdraw it at any time by going to settings and selecting the option “Stop sharing Discord data with ESL Gaming”. Please note that withdrawal of your consent does not affect the legality of the data processing previously carried out.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

8. Raffles

a. What
When you participate in a raffle that we conduct, we process the personal information required for such participation and for sending you your prize if you won. What data specifically is processed depends on the individual raffle you are participating in but commonly includes contact information of yours, such as your name, email address or social media account name. Should you win a prize we will process your contact details (name, address, email address). In some cases, we may require your age to make sure you meet our minimum age requirements.

Please note that your name and/or nickname can be made public over our media channels (e.g. our social media channels) and channels of a potential partner with whom we cooperate for the raffle (e.g. a sponsor) if you are a winner of a raffle (e.g. if you participate in a raffle that has an official announcement at the end).

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes of processing your data. Possible further recipients: Google (Workspace); the partner with whom we may cooperate to conduct the specific raffle in which you participate; providers of raffle solutions, especially Gleam.

Depending on the specific raffle, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1 as well as third-party partners of ours according to Sect. II.2.

c. Why
The purpose of processing your personal data for conducting the raffle and, if necessary, sharing your personal data related to the raffle with the sponsor, is making sure that you can participate properly in the raffle and we perform potential contractual obligations we may have towards you. We also have a legitimate interest in cooperating with our partners and sharing the information with them to enable your participation in the raffle (e.g. sharing your contact details with them so the partner can organize the shipping of your prize, should you not receive it from us directly or so we and our partner can publicly announce you as a winner).
If you do not conclude a contract with us when participating, but instead with our partner, we have a legitimate interest in receiving specific personal data of yours related to the raffle from our partner and using it to properly conduct the raffle (e.g. to be able to send you your prize we will need your contact details).

d. Legal Basis
If you conclude a contract with us regarding the raffle, the legal basis for processing and, if necessary, sharing your personal data with our partner is Art. 6 para. 1 let. b) GDPR. Insofar as the processing is based on our legitimate interest, the legal basis is Art. 6 para. 1 let. f) GDPR.

e. How Long
If you receive a payment from us as a prize, your data is stored for as long as the legal obligations we need to comply with require us to store the information for (e.g. 6 or 10 years according to Sect. 147 para. 3 of the Fiscal Code of Germany).
If you receive a non-monetary prize from us, we store your information for 3 years beginning with the end date of the raffle. This storage period is based on the regular limitation period for claims as set out in Sect. 195 of the German Civil Code (Bürgerliches Gesetzbuch).
If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
9. Surveys

a. What
You can participate in surveys we may offer. Such surveys can either be accessible directly on our website or we may contact you via email or direct message to participate in a survey. In this case we process your IP address and the data you enter when answering the survey (e.g. a comment you make in a comment section, or a choice of a multiple choice question) and if we contact you via email or direct message to participate in a survey we process your email address and your name to address you personally.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes of processing your data. Possible further recipients: SurveyMonkey, Mailchimp, Google (Workspace).

c. Why
The purpose of processing your personal data for conducting the survey is improving the customer and user experience by respectively improving our products and services according to the answers of the survey. Such surveys can be considered as conducted for advertising purposes of ours.

d. Legal Basis
For advertising purposes, we will only use your e-mail address without your consent if we have received it from you in connection with a purchase of products or services of ours, and in accordance with § 7 para. 3 UWG (German Act against Unfair Competition) and on the basis of Art. 6 para.1 lit. f) GDPR. We have a legitimate interest in offering small surveys for the services and products of ours that are similar to products and services of ours you have purchased or made use of so we have information about your purchasing or user experience and can offer you even more attractive products and services in the future. You can at any time object to receiving such information that is not related to a newsletter subscription of yours free of charge.

For other surveys than these, we will ask you for your consent to process the data when conducting the service. In such case the legal basis is your consent according to Art. 6 para. 1 let. a) GDPR.

e. How Long
Data that we have obtained from surveys based on our legitimate interest is stored for as long as our legitimate interest applies. This depends on the number of participants and importance of the survey.

Data that we have obtained from surveys based on consent are stored until you withdraw your consent. You can at any time withdraw your consent. If you want to declare your withdrawal, please let us know under the following email-address: privacy@eslgaming.com. Please note that the withdrawal does not affect the lawfulness of processing of the data based on the consent before its withdrawal. If you are under the age of 16, the holder of parental responsibility for you (e.g. your parents) must give his/her/their consent or authorize your consent. Please contact us regarding this in such a case.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
10. Videos & Photos at Live Events

a. What
At our live events (e.g. e-sports tournaments) videos may be made and photographs may be taken. If you visit one of these events (e.g. as part of the audience, as a player or personnel of a team), it is possible that you will appear in such videos and photographs. Videos and photographs are published by us over our websites (e.g. the website of the specific event), on our photo platform photos.eslgaming.com, or over other public media channels (e.g. Twitch).

In such case, we process your personal data (visual image, spoken word) by storing and using the videos and photos (e.g. publicly broadcasting the event live on TV or online-platforms or making videos and/or photos publicly accessible on demand online after the event) that include this data.

b. Who
Recipient of the processed personal data can be anyone that watches the event or views the videos and/or photos, either live or over media channels (e.g. online video streams) and platforms that provide these channels (Twitch, Google (YouTube)).

c. Why
The data is processed to conduct the event as a broadcasted live event (linear and digital), for marketing/advertising purposes, for protecting the photographer’s artistic expression, to ensure a reasonable quality standard of the event and a good viewer experience (e.g. capturing the reaction of the audience) and through this fulfilling the interest of fans and the general public in esports, and for the internal and external documentation and communication of the event. These are our legitimate interests.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. f) GDPR.

e. How Long
Your personal data will be stored by us as long as it is covered by our legitimate interests. The storage period is determined by the necessity of the establishment, exercise or defense of legal claims (Art. 17 para. 3 let. e) GDPR), especially regarding our intellectual property rights in the video and photo material (e.g. copyrights which expire after 70 years after the author’s death, as set out in sect. 64 of the German Act on Copyright and Related Rights (Urheberrechtsgesetz)). Please note that we have no influence on the storage of public available data by other third-party controllers (e.g. other websites unrelated to us).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

11. Social Media Presences

a. What
We have presences on social media platforms such as Facebook, Instagram and Twitter that help us connect to our fans and the esports community. We may also cooperate with some of our partners and maintain social media presences for games they publish or tournaments they host.

When you interact with a social media presence of ours (e.g. you comment a post of ours or write on our timeline), we process your name/nickname, profile picture and other personal data that your account may publicly display as well as personal data that you provide e.g. in a comment or post of yours.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for processing the data. Possible further recipients: the provider of the social media platform (Facebook, Twitter, Google (YouTube)); a partner of ours with whom we may cooperate for its social media presence.

c. Why
Your personal data is processed by us to effectively communicate with you within the social media platform (e.g. respond to posts and comments). This is a legitimate interest of ours and, if applicable, of our partner with whom we cooperate for its social media presence.

d. Legal Basis
The legal basis for processing data based on our legitimate interest is Art. 6 para. 1 let. f) GDPR.

e. How long
The data is stored for as long as we maintain the respective social media presence and you do not decide to delete your account or the respective post, comment or other interaction with us on the social media presence.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
12. Newsletter

a. What
You can request the receipt of our email newsletter which includes information about products, services, special offers or invitations to participate in various programs. To send you the newsletter we process your email address and name and statistical information on the reception of the newsletter by you. Additionally, we may add information on your interests to our newsletter database to personalize the newsletter you receive (e.g. if you have signed up for a newsletter in connection with a specific event we will add the information to our database that you are interested in such events).

We may also offer you the possibility to sign up for the newsletter of a partner of ours on a website that we manage for our partner (e.g. tournaments which we jointly conduct with a partner). In such case we collect and share the relevant personal data of yours that our partner requires to send you its newsletter.

Apart from a newsletter subscription we may send you information regarding ESL products and services if we have received your email address or direct messaging in connection with products or services of ours (e.g. you have ordered products in the ESL shop or are a user of ESL Play) and we advertise products or goods of ours that are similar to such you have already purchased or used.

Included in a newsletter is a so-called "web-beacon", a pixel-sized file which is retrieved from our server when the newsletter is opened or from its server in the case of the use of a mailing service provider. As part of this, technical information, such as information about the browser and your system, as well as your IP address and time will be collected. This information is intended to improve the technical performance of the service based on the technical data or the target groups and your reading behavior based on locations (which can be determined with the help of the IP address) or the access times. Likewise, it is determined if and when the newsletters are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. This is based on recognizing the reading habits of our users and adapting our content to them or sending different content according to the interests of our users.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Our newsletter is jointly maintained by DreamHack AB, Telefonvägen 30, 126 26 Hägersten, Sweden („Dreamhack“), ESL Gaming Online, Inc. (“EGO”) and us. Regarding the joint controllership between Dreamhack, EGO and us, please view the respective information under Sect. II.2. Possible further recipients: Mailchimp.

If you sign up for the newsletter of a partner over a website we manage for such partner, the partner is a recipient of your data. Possible further recipients: Mailchimp.

c. Why
The purpose of processing the personal data is to keep you updated on our products, services, special offers or invitations to participate in various programs or tournaments via email, according to your wish to receive the newsletter and improve your user experience with our services and products. This purpose also applies to information we may send you that is not part of a newsletter subscription when we advertise products or goods of ours that are similar to such you have already purchased or used.

We also have a legitimate interest in providing you the opportunity to receive a newsletter with information about events, services and products offered by Dreamhack or EGO (e.g. content related to ESEA, a service of EGO), since Dreamhack, EGO and we cooperate together for esports events, belong to the MTG group of companies and Dreamhack as well as EGO are also subsidiary companies of ours.

The purpose for collecting and sharing your information with our partner, should you sign up for partner’s newsletter over a website we manage for the partner, is to comply with your wish that the partner can send you its newsletter.

d. Legal Basis
The legal basis for processing your personal data for the newsletter you subscribed to is your declaration of consent, in accordance with Art. 6 para. 1 let. a) GDPR.

For information we may send you that is not part of a newsletter subscription, we will only use your e-mail address and name without your consent if we have received it from you in connection with a purchase of products or services of ours, and in accordance with § 7 para. 3 UWG (German Act against Unfair Competition) and on the basis of Art. 6 para.1 lit. f) GDPR. We have a legitimate interest in informing you about attractive offers for you and to win you over as a customer or user or to receive information about your purchasing and user experiences regarding services and products of ours that are similar to products and services of ours you have purchased or made use of so we can offer you even more attractive products and services in the future. You can at any time object to receiving such information that is not related to a newsletter subscription of yours free of charge.

As far as consent is not a legal basis for the cooperation between us, Dreamhack and EGO, the joint processing of the data is based on our legitimate interest and therefore on Art. 6 para. 1 let. f) GDPR.

The legal basis for sharing data with a partner, should you sign up for its newsletter over a website we manage for a partner of ours is Art. 6 para. 1 let. a) GDPR.

e. How long
Data that we use to send information based on our legitimate interest will be stored as long as our legitimate interest exists, and you have not objected. In case of an objection, your data will be blocked for such use and kept only as long as necessary to comply with our legal obligations.

The personal data will be stored for as long as you do not withdraw your consent. You can at any time withdraw your consent. If you want to declare your withdrawal, please let us know under the following email-address: privacy@eslgaming.com. Please note that the withdrawal does not affect the lawfulness of processing of the data based on the consent before its withdrawal. If you are under the age of 16, the holder of parental responsibility for you (e.g. your parents) must give his/her/their consent or authorize your consent. Please contact us regarding this in such a case.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

13. Data of Minors

a. What
If you are the legal guardian of a minor who is under the age of 16 we may require that you consent to the processing of the minor’s personal data or authorize that the minor consents him/herself to the data processing. In such a case we process your name and email address together with the personal data of the minor to have proof that we obtained your consent as legal guardian according to the GDPR.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for obtaining the consent. Possible further recipients: Atlassian; Google (Workspace).

c. Why
We process the data to be able to prove that we have complied with the rules of the GDPR that require the legal guardian to consent to/authorize the processing of personal data of a minor.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. c in connection with Art. 8 para. 1 GDPR.

e. How long
The data is stored until you withdraw your consent/authorization. In the case of a withdrawal, we store the data for 3 years and one month starting with the end of the year in which you withdrew your consent.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

14. Job Applications

a. What
We process the personal data you provide when applying for a job or to work together with us as a freelancer (e.g. your name, date of birth, address, etc.).

b. Who
Recipients of the processed personal data are the respective employees of ours that are responsible for pursuing our purposes for the processing (e.g. HR employees, your potential line manager and management). Possible further recipients: Bamboo; Google (Workspace).

Depending on the respective job you are applying for, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1.

c. Why
The data is processed to decide if a contract with you will be concluded or, if you already have a contract with us, to perform our obligations or terminate the contract.

d. Legal Basis
The legal basis for processing the personal data is Art. 88 para. 1 GDPR in connection with Sect. 26 para. 1 sent. 1 BDSG (for applicants applying for an employment) or Art. 6 para. 1 let. b) GDPR (for applicants applying as freelancer).

e. How long
If we work together with you, your data is stored for the applicable statutory storage periods, at least though for three years and one month starting at the end of the year in which your contract has ended (criteria derived from the general statute of limitations set out in Sect. 195 and 199 German Civil Code).
Should we not decide to work together with you, we will delete your application after 2 months, so we are able to defend ourselves against potential claims based on Sect. 15 AGG (Allgemeines Gleichbehandlungsgesetz - General Act on Equal Treatment).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

15. Travel Bookings

a. What
Under certain circumstances it is possible that we offer assistance to you regarding the planning of your participation in the Tournament. This can include helping you book your travel to the Tournament. In such a case we process the personal data you provide us to book your travel (e.g. flights, hotel) for you (e.g. your name, address, phone number, email, and other information stated on the required identification documents).

If you have not given us the data yourself, we’d like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us).

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing as well as companies that require the personal data to book your travel (e.g. hotels or airlines). Possible further recipients: Atlassian; Google (Workspace). In some cases, especially now during the Coronavirus pandemic, it might be necessary to share your phone number or email so airlines and hotels can contact you directly should your booking change, or if they need to notify applicable health requirements.

Depending on the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
The personal data is processed to help you plan your participation in the Tournament in consideration of your individual preferences and needs regarding your travel and to perform our contractual obligations by doing so, which we could not do without processing the data.

d. Legal Basis
The legal basis for processing the data for the abovementioned purpose is Art. 6 para. 1 let. b) GDPR.

e. How long
We process data that we need for the conclusion or the execution of a contract at least as long as it is necessary to take steps at your request to conclude a contract or to fulfill a contract between you and us. This depends on the duration of your contract or your team's contract with us or on whether we are still in contact with you to conclude a potential contract. If claims arise from the contract, we will store the data for as long as it is necessary to be able to defend ourselves against such claims, especially according to the respective limitation periods.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

16. Videos and Photos

a. What
During the Tournament we process your personal data (e.g. name, nickname, nationality) by publicly displaying the information. If you are a player or other associated personnel of a participating team that publicly acts for the team (e.g. in interviews), we additionally publicly broadcast and, if applicable, present live on a stage your visual image and spoken word to the audience of the Tournament during and after the Tournament (e.g. in recaps) in videos and photos.

b. Who
Recipient of the processed personal data can be anyone that watches the Tournament, either live or over media channels (e.g. online video streams, our photo platform) and platforms that provide these channels (Twitch, Google (YouTube)).

c. Why
The data is processed to conduct the Tournament as a broadcasted live event and to ensure a reasonable quality standard of the Tournament, e.g. by displaying information such as your name, nickname or nationality for the Tournament.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. b) GDPR and Art. 6 para. 1 let. f) GDPR. Broadcasting your image and spoken word during your performance in the Tournament is part of our performance of our contract with you as a participant and without such processing of the respective personal data we could not publicly conduct the Tournament. Also, it is a legitimate interest of ours to ensure a good experience of the live and online esports audience by broadcasting your image and spoken word and to make the content available to such an audience.

e. How long
Data that is processed based on Art. 6 para. 1 let. b) GDPR is stored at least for as long as it is necessary to perform the contract between you and us. This can be determined by the term of your contract. Personal data that is processed based on our legitimate interest, will be stored as long as it is covered by such legitimate interest. The storage period in such cases is determined by the necessity of the establishment, exercise or defense of legal claims (Art. 17 para. 3 let. e) GDPR), especially regarding our intellectual property rights in the video and photo material (e.g. copyrights which expire after 70 years after the author’s death, as set out in sect. 64 of the German Act on Copyright and Related Rights (Urheberrechtsgesetz)).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

17. Anticheat Software

a. What
Certain information regarding your computer and the software it contains is required for effective operation of our anticheat software. If you run an anticheat software that is required by us for participation in the Tournament on your device, information from it is collected and analyzed that is required to identify and prevent the use of cheat software, files used to gain an unfair advantage, and to enforce bans. Its installation and use on your device can be a requirement for participating in a Tournament. This information collection is not strictly limited to when you are logged into the anticheat software. Information analyzed or collected by the anticheat software may include hardware, network and software identifiers; running programs; system configuration information; files or data suspected of being used to cheat or gain an unfair advantage.

b. Who
Recipients of the processed personal data are the respective internal employees of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: IT-services.

c. Why
The personal data is processed to ensure a fair and rule-compliant Tournament for you, the other participants and the audience and through this ensuring the integrity and credibility of our Tournaments as well as esports itself as a fair competitive sport. These are legitimate interests of ours. If competitions lack fairness and security, competitive games will lose players as well as audiences. Without processing the data, we cannot provide an anticheat software with the same effectiveness.

Also, if the use of anticheat software is required for a Tournament participation, the processing of data is done to perform the contract you conclude with us by participating in the Tournament as well as the contract regarding the use of the respective anticheat software itself by agreeing to the terms and conditions for its use.

d. Legal Basis
The legal bases for processing the data for the abovementioned purposes are Art. 6 para. 1 let. f) GDPR and Art. 6 para. 1 let. b) GDPR.

e. How long
We process the data as long as it is necessary to perform the contract between you and us. This can be determined by the term of your respective contract. Without the data we could not perform our contractual obligations with you. If entitlements to claims arise from the contract we store the data for the respective limitation period according to the applicable law. Personal data that is processed based on our legitimate interest, will be stored as long as it is covered by such legitimate interest. The storage period in such cases is determined by the necessity of the establishment, exercise or defense of legal claims (Art. 17 para. 3 let. e) GDPR), e.g. to have proof for a defense against unjustified claims by participants or teams who have verifiably cheated for prize money or rankings within the respective statute of limitations or according to the tournament rulebook.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

18. Integrity Partner

a. What
We work together with the Esports Integrity Commission Limited, Suite 129, 14 Chertsey Road, Woking GU22 5AH, United Kingdom (“ESIC”). Should we receive a request from ESIC that based on objective indications or evidence that you may have either violated our terms & conditions, tournament rules, or statutory laws of a country (e.g. through fraudulent behavior) we will provide ESIC personal data related to you that is required to make a conclusive assessment if such violation is given. The transfer of data will be strictly limited to only the purpose of making such an assessment.

b. Who
Recipients of the processed personal data are the respective internal employees of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: ESIC.

c. Why
Data transfers to ESIC are made to ensure fair and rule-compliant Tournaments for you, the other participants and the audience and through this ensuring the integrity and credibility of our Tournaments as well as esports itself as a fair competitive sport. These are legitimate interests of ours. If competitions lack fairness, competitive games will lose players as well as audiences. Without working together with ESIC, we cannot ensure the integrity of our Tournaments and esports in general with the same effectiveness.

d. Legal Basis
The legal basis for processing the data based on our legitimate interests is Art. 6 para. 1 let. f) GDPR.

e. How long
The data will be stored as long as our legitimate interests exist. This depends in particular on criteria such as the duration of the investigation of a rule violation on your part by us and ESIC.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
19. Press Releases

a. What
We may process personal data of yours when issuing press releases in connection with a Tournament that contain information about you and your performance in the Tournament. This can include especially your first and last name, nickname, nationality, picture, quotes and information about your performance in the Tournament (e.g. scores etc.).

b. Who
Recipient of the processed personal data can be anyone that reads or watches the media channels on which the press releases are issued (e.g. our website, updates for journalists), either live or over media channels (e.g. online video streams) and platforms that provide these channels.

c. Why
Since our Tournaments are events of public interest, the data is processed for the purpose of issuing press releases about your participation in our Tournaments over media channels and for editorial purposes connected to this.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. f) GDPR. It is a legitimate interest of ours to ensure a good experience of the esports audience and the general public to report on Tournaments as well as participants of and events in connection with such Tournaments. If reporting about you is part of an obligation in your contract with us, the legal basis for the data processing can additionally be Art. 6 para. 1 let. b) GDPR. Without the processing of the data we could not fulfill such an obligation.

e. How long
If data is processed to perform the contract between you and us, the storage period can be determined by the term of your contract. Personal data that is processed based on our legitimate interest, will be stored as long as it is covered by such legitimate interest. The criteria to determine this are especially the importance of the Tournament and events connected to it in the esports community, the public interest in the Tournament and events connected to it. The storage period can also be determined by the necessity of the establishment, exercise or defense of legal claims (Art. 17 para. 3 let. e) GDPR), especially if the press releases are protected by intellectual property rights of ours (e.g. copyrights which expire after 70 years after the author’s death, as set out in sect. 64 of the German Act on Copyright and Related Rights (Urheberrechtsgesetz)).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

20. Press Mailing List

a. What
If you are a journalist, you can sign up to our press mailing list to be updated by us on news regarding ESL and esports. When you sign up, we collect your first and last name, email address and the name of the press outlet (e.g. magazine, news website, YouTube channel) you work for or operate yourself and store this information in our press mailing list.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: Google (Workspace).

c. Why
We process the data to keep you updated on ESL brands, projects and products and other developments regarding ESL and esports and communicate with you regarding these topics.

d. Legal Basis
The legal basis for processing your personal data for the receipt of our information through our press mailing list is your declaration of consent, in accordance with Art. 6 para. 1 let. a) GDPR.

e. How long
The data is stored as long as you have not withdrawn your consent. You can at any time withdraw your consent by sending a respective request to privacy@eslgaming.com. Please note that the withdrawal does not affect the lawfulness of the processing done prior to your withdrawal.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
21. ESL Shop & Partner Shops

a. What
You can buy products on our ESL Shop or on shops we operate for a partner of ours. In this case, we process the personal data you enter during the ordering process, such as your name, e-mail address, contact details and information about your purchase.

b. Who
Recipients of the processed personal data are our respective internal employees and freelancers who are responsible for the pursuit of our processing purposes. Possible further recipients: providers of online store software, especially Shopify, Yotpo, QuickBooks; financial and IT services.

If you shop in a shop that we operate for a partner, it is possible that this partner may process your personal data together with us as joint controller as set out in Sect. II.2.

c. Why
We process the data in order to initiate a contract with you and to conclude and perform it when you make a purchase, as well as to fulfil our accounting and tax obligations.

d. Legal Basis
The legal basis for the processing of data for the initiation as well as for the conclusion or performance of a contract we have concluded with you is Art. 6 para. 1 let. b) GDPR.

The legal basis for the processing of data on the basis of one of our legal obligations is Art. 6 para. 1 let. c) GDPR.

e. How long
The data will be stored for at least 2 years after purchase in order to comply with EU consumer laws regarding defects of purchased products.

Apart from that, the data will be stored for as long as the legal obligations we have to comply with require it (e.g. 6 or 10 years according to § 147 para. 3 of the Fiscal Code of Germany).

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
22. Data Subject Requests

a. What
When you contact us to make use of your data subject rights (see above), we process you name, email address and any additional information you provide us in your request.

To make sure we can correctly identify you we may ask you to provide a copy of your passport or other identification document (“ID”). When you upload this information, we will process the personal data of yours stated on the ID, namely: your name, birth date, address and validity of the document. Please make any other data on the copy of your ID-document unreadable (e.g. serial number of the document) before the upload and mark the document as copy (e.g. add the imprint “copy” on it).

We kindly ask you to only use the portal in which your ticket was created for you after addressing us over privacy@eslgaming.com to upload the ID. Documents provided through any other channel are not accepted and will be deleted by us.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for answering your request. Possible further recipients: Atlassian; Google (Workspace).

Depending on the specific request of yours, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1.

Only the designated employees of ours entrusted with privacy matters, and possibly employees that maintain our IT infrastructure, will view your ID. Processor processing your data on our behalf is Atlassian.

c. Why
The personal data of your request is processed for the purpose of answering your request – if necessary also with the help of our Subsidiaries or to answer such request for our Subsidiaries should it be directed at it – as well as the purpose of proving our compliance with the GDPR by helping you as data subject exercise your rights set out in the GDPR. This is also a legitimate interest of ours.

We process the ID data to verify your identity. This is required to prevent cases of fraud committed by using false identities. We have a legitimate interest in this purpose that outweighs a potential contrary interest of yours to not disclose this information, since we have a responsibility in protecting our users’ and partners’ personal data and since we will delete your ID promptly after we have verified your identity. The ID will not be used for any other purposes.

d. Legal Basis
The legal basis for processing the data of your request and – if necessary – sharing this information with our Subsidiaries is Art. 6 para. 1 let. c) in connection with Art. 12 GDPR as well as Art. 6 para let. f) GDPR.

The legal basis for ID verifications is Art. 6 para. 1 let. f) GDPR.

e. How long
The data of your request is stored for 3 years and one month starting with the end of the year in which you made your request.

The uploaded ID will be deleted promptly after we have verified your identity.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.
23. ESL Forum

a. What
If you have an ESL Account, you can post in our ESL Forum. When you do this, we process your:

• nickname
• number of posts
• level
• date of your post
• content of your post

This information is publicly visible in the forum.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for processing the data. Possible further recipients: host providers; forum software providers, especially Vanilla Forums.

c. Why
We process the data to perform a contract with you so you can use our service.

Should you violate our terms of use (e.g. post offensive content) we will save such posts to prove the violation. We have a legitimate interest of making sure that the rules for participating in our forum are followed and toxic behavior of users can be properly sanctioned to ensure a friendly and respectful space for everyone.

d. Legal Basis
The legal basis for processing the data to enter into or perform a contract we concluded with you is Art. 6 para. 1 let. b) GDPR.

The legal basis for processing data based on our legitimate interest is Art. 6 para. let. f) GDPR.

e. How long
The data is stored at least for the duration of the contract with you. If entitlements to claims arise from the contract we store the data for the respective limitation period according to the applicable law. Personal data that is processed based on our legitimate interest, will be stored as long as it is covered by such legitimate interest. The storage period in such cases is determined by the necessity of the establishment, exercise or defense of legal claims (Art. 17 para. 3 let. e) GDPR), e.g. to have proof for a defense against unjustified claims within the respective statute of limitations by users who have verifiably violated our terms of use.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

24. Third Party Analytics Tools & Consent Management
We use third party tools to analyze the use of our websites and services, to provide a better user experience for you when you use these or to display ads that may interest you. To make it easy for you to inform yourself about these tools and to withdraw a potentially necessary consent of yours or object to a processing based on a legitimate interest of ours, we have – depending on which website/service of ours you visit/use – implemented consent management platforms by Usercentrics or Quantcast. You can at any time open the consent management platform by clicking the platform button (e.g. the fingerprint or gear wheel in the corner of the screen) or the link on our website or in our service to open it. In the consent management platform, you will find all information on what data is processed, who the recipient is, the purpose, legal basis and storage period.

You can at anytime of course also contact us at privacy@eslgaming.com for further details or if you want to declare your withdrawal or objection to us processing your personal data.

25. B2B Partnerships

a. What
When we communicate and conclude contracts with you as a business partner (B2B only), we store certain personal data of yours in our B2B data base, such as your business email address and other business information related to our (potential) partnership.

b. Who
Recipients of the processed personal data are the respective employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: Google (Workspace); Salesforce.

Depending on the respective business partnership between you and us, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1.

c. Why
The data is processed to decide if a contract with you will be concluded or, if you already have a contract with us, to perform our obligations or terminate the contract.

We also have a legitimate interest in processing this data of yours to be able to remain in contact with you for business purposes. We have a legitimate interest in processing the information of B2B contacts with whom we have a contractual relationship or objectively likely will have a contractual relationship with in the future, since this is not only necessary to properly perform the contract between us and them, but also to facilitate communication with them concerning their cooperation with us. We also have a legitimate interest in processing the personal data of the B2B contacts who are currently not commissioned by us and not have been commissioned in the past, since it facilitates getting in touch with them for future projects.

d. Legal Basis
The legal basis for processing the personal data to enter into or perform a contract with you is Art. 6 para. 1 let. b) GDPR. The legal basis for processing the personal data based on our legitimate interest is Art. 6 para. 1 let. f) GDPR.

e. How long
Documentation regarding B2B contacts that we have concluded a contract with which is considered a commercial or business letter under Sect. 147 para. 1 no. 2 of the Fiscal Code of Germany is stored for 6 years as set out in Sect. 147 para. 3 sent. 1 of the Fiscal Code of Germany. Should it be considered documentation according to Sect. 257 para. 1 no. 2 and 3 of the German Commercial Code, the storage duration also is 6 years and if it is considered documentation according to Sect. 257 para. 1 no. 1 and 4 of the German Commercial Code, the storage duration is 10 years, as set out in Sect. 257 para. 4 of the German Commercial Code.

Personal data of B2B contacts with whom we have no contract and have no objective reasons to believe we will be concluding a contract with in the near future, will be deleted from our database after 3 years of inactivity.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

26. Legal Work

a. What?
Our legal department works with our Subsidiaries to assess and manage legal matters. If a matter or dispute between you and us or between you and one of our Subsidiaries requires relevant legal review, we and, if necessary, the relevant subsidiary process the data relevant to the matter or dispute. In particular, this may include your name, e-mail address and contact details.

b. Who?
The recipients of the personal data processed are our respective employees and freelancers responsible for processing the matter. Possible further recipients: Google (Workspace).

Depending on the specific case, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1.

c. Why?
The purpose of the processing of the data by us and – if applicable – our Subsidiaries is the effective and uniform handling of legal matters. This is a legitimate interest of ours and our Subsidiaries. In addition, the data processing may serve to conclude and perform contracts with you.

d. Legal Basis
As far as the data processing concerns the conclusion or performance of a contract with you, the legal basis of the data processing is Art. 6 para. 1 let. b) GDPR.

If the data processing is based on a legitimate interest, the legal basis is Art. 6 para. 1 let. f) GDPR.

e. How Long?
The storage period for data processed for the purpose of handling legal matters or disputes is governed by the relevant limitation period, so that we can sufficiently defend ourselves against claims, or by the relevant legal obligations to retain documents, in particular § 147 of the Fiscal Code of Germany and § 257 of the German Commercial Code.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

VIII. Data Processing – Professional Tournaments
When you participate in professional tournaments (e.g. such that you need to qualify for to participate in them), your personal data can also be processed as stated in this Section. Every processing activity is broken down into 5 parts:

(a.) What: What data is processed?
(b.) Who: Who receives the data?
(c.) Why: For what purpose is the data processed?
(d.) Legal Basis: What law allows us to process the data?
(e.) How Long: How long do we keep the data?
1. Tournament Registration

a. What
To be able to plan and realize our professional esports tournaments (“Tournaments”), we require certain information from you (e.g. team managers), when registering for a Tournament. Therefore, we process the following data we require from you (“Required Data”):

● First and last name;
● Position within team (e.g. player position or team manager position);
● Platform ID(s) for the respective game (e.g. ESEA-ID, Steam-ID, ESL-ID);
● Nickname used by players in the respective game;
● Birthdates of players;
● Nationality of players;
● Country of residence of players.

Required Data is necessary for us to perform our contract with you and without it we do not have the necessary information to conduct the Tournament properly.

Additionally, to Required Data, we also process optional information which you grant us voluntarily (“Optional Data”). This can include, but is not limited to information such as:

● Name of social media accounts of teams and players;
● Phone numbers.

Required and optional data can be collected by us via a so called “teamsheet”. In such a case you can have the possibility to access the teamsheet and view the data you have provided us after handing in the teamsheet, making the processing of data more transparent and easier for you to make use of your right of access according to Art. 15 GDPR.

If you have not given us the data yourself, we’d like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us) or it is already known to us e.g. if we already know you personally or we have it from public databases such as liquipedia.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: partners of ours that are dedicated to broadcasting, coverage or other commercial engagements connected to the Tournament; Atlassian; Google (Workspace).

Depending on the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
Required Data is processed to be able to identify you as a player, team member or other associated personnel that will take part in one of our Tournaments, identify you as a (potential) contractual party of us and perform our respective contractual duties once a contract has been concluded between you and us (e.g. to register you as a participant of a Tournament, declare you as a winner of a Tournament or to display your name for the viewers of the Tournament). If you belong to personnel associated to a team and participate in such function in the Tournament (e.g. a team manager) we have a legitimate interest in identifying you as such for communication purposes in connection with the Tournament and informing the relevant audiences about you and your function within the team. Your date of birth is specifically required to assure you meet the minimum age requirements for participating in the Tournament. Your country of residence is specifically required to check if you meet the country specific requirements to participate in a Tournament. Further, certain Required Data can be processed to ensure a reasonable quality standard of the Tournament, e.g. by displaying information such as your name, nickname or nationality during a Tournament.

Your date of birth, country of residence, first and last name are processed based on our legitimate interest to comply with youth protection law, as well as to ensure our own rules regarding the age and country of residence of participants are followed and to prevent cases of fraud committed by using false identities. Your platform-ID(s) is/are processed to verify you as a legitimate player of the game and prevent cheating (see also section VII. 11).

If your team is our contractual partner, it is in our legitimate interest to process the Required Data to be able to identify you, to conclude a contract with your team and perform our contractual obligations with your team, such as the examples mentioned in the previous section.

If you provide us with Optional Data, we have a legitimate interest in processing it to provide more detailed information for the interested esports audience, a better user experience and interesting and/or interactive information (e.g. displaying social media channels of players during a Tournament) on players in connection with the Tournament.

d. Legal Basis
The legal basis for processing the Required Data is Art. 6 para. 1 let. b) GDPR and Art. 6 para. 1 let. f) GDPR. Regarding the legal basis of Art. 6 para. 1 let. b) GDPR the data is required to conclude and perform a contract with you, which would not be possible without this information. If the processing is based on Art. 6 para. 1 let. f) GDPR, our legitimate interest is to be able to identify you, to conclude a contract with your team and perform our contractual obligations with your team or we may have a legitimate interest in identifying you as associated personnel of a team for communication purposes in connection with the Tournament and informing the relevant audiences about you and your function within the team. Further, we have a legitimate interest in using certain Required Data to ensure a good experience of the live and online esports audience, e.g. by displaying information such as your name, nickname or nationality during a Tournament.

Also, the legal basis for processing your date of birth, country of residence, first and last name is Art. 6 para. 1 let. f) GDPR. It is our legitimate interest to comply with youth protection law, as well as to ensure our own rules regarding the age and country of residence of participants are followed and to prevent cases of fraud committed by using false identities. The legal basis for processing your platform-ID(s) is Art. 6 para. 1 let. f) GDPR.

The legal basis for the processing of Optional Data is Art. 6 para. 1 let. f) GDPR. It is our legitimate interest to provide a better user experience and interesting and/or interactive information (e.g. displaying social media channels of players for fans to connect with them) on players in connection with the Tournament.

e. How long
We process data that we require for entering or performing a contract at least for as long as it is necessary for taking steps at your request to enter into a contract or to perform a contract between you and us. This is determined by the term of your contract and the contract of your team with us or if we still are in contact about concluding a potential contract.

Required Data that is processed based on our legitimate interest, will be stored for as long as it is covered by such legitimate interest. The storage period depends on the individual case and is determined by criteria such as the necessity to prove that youth protection laws have been complied with and for the establishment, exercise or defense of legal claims.

Optional Data that is processed based on our legitimate interest, will be stored for as long as it is covered by such legitimate interests. We will routinely check the data stored by us once a year and request your decision if required or Optional Data should be deleted, should we find that you have not participated in a Tournament within this time period or we are certain that you do not intend to participate in a Tournament in the future and no other legal basis and purpose for the processing of it applies. Of course, you are always free to contact us if you wish to have your data deleted sooner according to Art. 17 GDPR.

If you participate in a Tournament (especially in which you can win prize money), the data will not be stored longer than for the regular standard regulation period set out in Section 195 BGB (Bürgerliches Gesetzbuch - German Civil Code.

Please note that when you participate in a Tournament, the fact of your participation and the data that is naturally made public during a publicly broadcasted or conducted Tournament (e.g. you nickname, name and nationality) becomes known to the public and the recipients involved in the coverage of such esports events. We have no influence on the storage period of such data by third parties that do not act as processors on our behalf.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

2. Processing of verification data

a. What
In specific cases we may ask you to provide us a copy of your ID (e.g. passport or other document of identification) so we can properly verify your identity. These cases are:

• When you participate in certain esports tournaments as a ESL Play user, pro player or personnel of a team we may need to verify your identity and that you comply with the rules of participation regarding age and country of residence;
• Change requests for ESL Trusted accounts;
• You lost your ESL account login credentials and can’t reset your account via email.

In these cases we process the respective data stated on your ID-document (e.g. passport or other document of identification) that you provide us. The data required from the ID-document for the age check includes: first and last name, birth date, country of residence (your address can be required if you request the change of your address of a ESL Trusted account or account recovery). Please make any other data on the copy of your ID-document unreadable (e.g. serial number of the document) before the upload and mark the document as copy (e.g. add the imprint “copy” on it). Apart from this data, we process any additional information you enter into the upload form which we require to understand the context of your request.

In the mentioned cases we can’t comply with your request without receiving the required information from you.

For ESL Play users we have installed a secure upload portal to upload the ID copy. Documents provided through any other channel are not accepted and will be deleted by us.

For pro players and their team personnel we have installed a designated secure upload portal where the documents can be provided. We ask you to only use this portal for such uploads. Documents provided through any other channel are not accepted and will be deleted by us.

If you have not given us the data yourself, we’d like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us).

b. Who
Recipients of the personal data are the respective internal employees of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: host providers; Atlassian.

c. Why
Depending on your specific case, we process the data to

• verify your identity, age and country of residence. This is required to comply with youth protection law, as well as to ensure our own rules regarding the age and country of residence of participants are followed and to prevent cases of fraud committed by using false identities;
• verify that you are the legitimate person requesting to apply changes to your Trusted ESL account; or
• verify that you are the legitimate person requesting access to an account to which regular access is not possible.

We have a legitimate interest in these purposes.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. f) GDPR as the purposes for the processing are in our legitimate interest.

e. How long
The uploaded ID-document will be deleted after we have verified your identity.
3. Creation and Maintenance of Team Presentations

a. What
We process personal information from publicly available sources to create and maintain publicly available team presentations, such as world rankings. This can include data such as nickname, nationality, event-performance, photos and team membership of players and personnel associated with the respective esports teams.

According to Art. 14 para. 2 f) GDPR we’d like to inform you that the sources of the mentioned data can be public databases such as liquipedia or if it is already known to us e.g. if we already know you personally.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: anyone who accesses the ranking over the website on which it is published; IT services; host providers; Google (Workspace).

Depending on the specific circumstances (e.g. the league you participate in) it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1 as well as third-party partners of ours according to Sect. II.2.

c. Why
The data is processed to inform our audience, fans, users and the general public about the current teams and developments in esports.

d. Legal Basis
The legal basis for processing the data is Art. 6 para. 1 let. f) GDPR. As an esports company, we have legitimate economic but also cultural interest in informing our audience, fans, users and the general public about the current teams and developments in esports.

e. How long
The data is stored for as long as our legitimate interests persist. The length of the storage period especially depends on if the data is still relevant to our audience, fans, users and the general public in which case our legitimate interest to exercise our freedom of expression and information outweighs a potential right of erasure.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

4. Video and Audio Material
Video and Audio Material of Professional Players for Preventing and Sanctioning Cheating

a. What
We generally process your image and spoken word as set out under Sect. VII. 15 for presenting a Tournament you participate in live on stage or broadcasting it over media channels (e.g. live streams).

In addition to this we may process your image and spoken word for additional video and audio material, if you are a pro player or personnel of a pro team participating in a Tournament. This includes
• recordings of the team conversation (e.g. over your dedicated team channel);
• footage of player cams (e.g. a webcam that shows you playing at your computer);
• room footage and conversations (e.g. while you play in your team HQ).

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: IT-services; Google (Workspace).

Depending on the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
Processing data from team conversations, player cams as well as room cams and mics during your performance in the Tournament is based on our contract with you as a participant.

We need to prevent cheating and fraudulent actions. If competitions lack fairness and security, competitive games will lose players as well as audiences. Processing the data to prevent cheating and fraudulent actions helps to ensure a fair and rule-compliant Tournament for you, the other participants and the audience and through this ensuring the integrity and credibility of our Tournaments as well as esports itself as a fair competitive sport. Maintaining the fairness of the Tournament is a core issue of our contract with the players and teams.


d. Legal Basis


The legal basis for processing the data for fraud prevention is based on Art. 6 para. 1 let. b) GDPR.

e. How long
Data that is processed based on Art. 6 para. 1 let. b) GDPR is stored at least for as long as it is necessary to perform the contract between you and us. The data will be deleted after potential claims against you are time barred (§ 195 BGB).

Video and Audio Material of Professional Players for Promotion

a. What
We generally process your image and spoken word as set out under Sect. VII. 15 for presenting a Tournament you participate in live on stage or broadcasting it over media channels (e.g. live streams).

In addition to this we may process your image and spoken word for additional video and audio material, if you are a pro player or personnel of a pro team participating in a Tournament. This includes
• recordings of the team conversation (e.g. over your dedicated team channel);
• footage of player cams (e.g. a webcam that shows you playing at your computer);
• room footage and conversations (e.g. while you play in your team HQ).

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: IT-services; Google (Workspace); anyone that watches the Tournament, either live or over media channels (e.g. online video streams, our official photo platform) and platforms that provide these channels (Twitch, Google (YouTube)).

Depending on the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1. as well as third-party partners of ours according to Sect. II.2.

c. Why
Processing data from team conversations, player cams as well as room cams and mics during your performance in the Tournament is based on our contract with you as a participant. The data is processed to conduct the Tournament as a broadcasted live event and to ensure a reasonable quality standard of the Tournament.

If you ask us to record your team conversation for training purposes, we have a legitimate interest in recording and providing the material to you.

Should you have agreed to it, we may use your voice recording for commercial purposes (e.g. for advertising products that are not related to ESL or ESL tournaments).

d. Legal Basis

The legal basis for processing the data to conduct the Tournament as a broadcasted live event is Art. 6 para. 1 let. b) GDPR.

The legal basis for processing the data for recordal of your team conversation for training purposes, is based on your consent according to Art. 6 para. 1 let. a) GDPR.

The legal basis for processing your voice and other recordings for commercial purposes (e.g. for advertising products that are not related to ESL or ESL tournaments) is based on your consent according to Art. 6 para. 1 let. a) GDPR.

e. How long
Data that is processed based on Art. 6 para. 1 let. b) GDPR is stored at least for as long as it is necessary to perform the contract between you and us. The data will be deleted after potential claims against you are time barred (§ 195 BGB). Any material where we own intellectual property rights in (e.g. photos) will be kept until expiry of the rights (e.g. copyrights which expire after 70 years after the author´s death, as set out in sect. 64 of the German Act on Copyright and Related Rights (Urheberrechtsgesetz).

Should we have recorded the material solely for your training purposes (based on your consent), we will delete it after we have submitted it to you.

Personal data that is processed based on your consent (e.g. for advertising products that are not related to ESL or ESL tournaments) will be stored for as long as you do not withdraw your consent. You can at any time withdraw your consent. If you want to declare your withdrawal, please let us know under the following e-mail address: privacy@eslgaming.com. Please note that the withdrawal does not affect the lawfulness of processing of the data based on the consent before its withdrawal. Any material where we own intellectual property rights in (e.g. photos and videos) will be kept until expiry of the rights.


5. Game Statistics

a. What
If you participate in a Tournament of ours as a player or associated personnel, we process your platform-ID(s) and nickname you (regularly only players) use in the respective game together with statistical information of the game you are playing in the Tournament (e.g. scores, number of kills, deaths, character choices etc.) and information about you as a player or associated personnel relevant for public presentation of the event and/or relevant for the interested public (name, birthday, teams, professional player profile picture, nationality) (“Statistical Data”). Statistical Data can be stored together with Optional Data you provide us (see above VI.3.).

If you have not given us the data yourself, we’d like to inform you according to Art. 14 para. 2 let. f) GDPR that the sources of the mentioned data can be another person that acts on your behalf (e.g. you are a player or other personnel of a participating team and a team manager with power of attorney hands in your data to us) or it is already known to us e.g. if we already know you personally or have it from public databases such as liquipedia.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: partners of ours that are dedicated to broadcasting, coverage or that statistically and analytically process sports data; Google (Workspace).

c. Why
Statistical Data is processed for our legitimate business interest to provide as an esports company game and player information from our Tournament that is relevant for our audience, the general esports audience as well as the interested public or to improve the experience of players as well as these audiences.

d. Legal Basis
The legal basis for the processing of Statistical Data is Art. 6 para. 1 let. f) GDPR. Statistical Data is processed for our legitimate business interest to provide as an esports company game and player information from our Tournaments that is relevant for the abovementioned audiences or to improve the experience of players as well as these audiences.

e. How long
Statistical Data is stored for as long as it is covered by our legitimate interest. The storage period depends on the individual case and is determined by criteria such as importance of the Tournament or public interest in the Tournament in which you’ve participated in or your ranking as a player.

Please note that when you participate in a Tournament, the fact of your participation and Statistical Data is naturally made public during a publicly broadcasted or conducted Tournament and becomes known to the public (e.g. the audience can view statistics on your performance within the game) and the recipients involved in the coverage of such esports events. We have no influence on the storage period of such data by third parties that do not act as processors on our behalf.

If the data is also processed for another purpose set out in this Privacy Notice, the storage period regarding that purpose applies as well.

6. Dietary and Other Health-Related Information

a. What
Under certain circumstances it is possible that we offer assistance to you regarding the planning of your participation in the Tournament. This can include such questions as your preferred meals, e.g. at the location where the Tournament is held. If you have any health conditions that require you to follow a certain diet (e.g. allergies) and other health-related conditions (e.g. disabilities that require special accessibility in a venue) relevant to the participation in the Tournament and you choose to share this information with us, we process this personal data of yours.

b. Who
Recipients of the processed personal data are the respective internal employees and freelancers of ours that are responsible for pursuing our purposes for the processing. Possible further recipients: Atlassian; Google (Workspace).

Depending on the respective Tournament you participate in, it is possible that Subsidiaries of ours jointly process personal data with us according to Sect. II.1.

c. Why
The personal data is processed to help you plan your participation in the Tournament in consideration of your individual health-based needs (e.g. ordering meals that do not contain ingredients to which you are allergic).

d. Legal Basis
The legal basis for processing the personal data is your consent in accordance with Art. 9 para. 2 let. a) GDPR.

e. How long
The personal data will be stored for as long as you do not withdraw your consent. You can at any time withdraw your consent. If you want to declare your withdrawal, please let us know under the following email-address: privacy@eslgaming.com. Please note that the withdrawal does not affect the lawfulness of processing of the data based on the consent before its withdrawal.

7. Changes to the Privacy Notice

We regularly review our Privacy Notice to make sure is kept up-to-date and compliant with new legislation, rules or case law. We reserve the right to make any changes. You can check when the Privacy Notice was last amended by looking at the date at the end of the document.


Last Update: July 28, 2021