DATA PROTECTION POLICY

The Professional Football League, along with its Subsidiary LFP 1 (hereinafter collectively referred to as the "LFP" or "We" or "Our"), jointly process your personal data when you access or browse LFP websites, use LFP applications, participate in games, contests, and other events offered by the LFP (hereinafter collectively referred to as the "Events"), interact on social media platforms, and/or when you communicate with or contact the LFP (hereinafter collectively referred to as the "Sites, Apps, Events, and other Media"). When applicable and necessary, a link to this Policy is provided on these various Sites and Apps or any other communication Media, so that you can read it at any time. This Data Protection Policy (or Policy) describes the operations carried out on your Data, the rights you have over your Data under the applicable Data Protection Regulations, and how to exercise those rights. This Data Protection Policy supplements the legal notices, the T&Cs applicable to the Sites and Apps, and any other documentation provided on the Sites, Apps, Events, and other Media. We invite you to read this Data Protection Policy carefully and regularly.

1. DEFINITIONS

A brief reminder of some terms used in this Policy, to facilitate your reading and to ensure you understand what these terms cover. Note that these terms have specific meanings, which are, in some cases, dictated by the applicable Data Protection Regulations.

Data or Personal Data: refers to any information relating to a Data Subject that allows them to be identified directly or indirectly (examples: your first name, your email address, your favorite club or players, the content of your messages and requests).

Person concerned : refers to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity (example: as a natural person accessing one of our Sites, you are a Data Subject. We will refer to you either by this term or by the pronoun "you").

Applicable Data Protection Regulations : refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (commonly known as the "GDPR"), as well as Law No. 78-17 of 6 January 1978 as amended (known as the "Data Protection Act") and any other applicable legal or regulatory provisions relating to the processing and/or protection of personal data.

Data Controller : Data Controller refers to the entity (natural person or legal entity, public authority, agency, or other body) which alone or jointly with others determines the purposes and means of the processing of personal data.

Sub-contractor : designates the entity (natural or legal person, public authority, service or any other body) processing personal data on behalf of the Controller(s) of the processing.

Processing : refers to any operation or set of operations carried out with or without automated processes and applied to personal data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, as well as locking, erasure or destruction.

Partners :

2. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLERS AND THEIR DPO

The identification of the data controller(s) is necessary so that you know who is responsible for the collection or processing of your data when using and navigating the Websites, App, and other Platforms, or when registering for Events.

Thus, your personal data is collected and processed by: the Ligue de Football Professionnel (Association under the 1901 law, located at 34 Boulevard de Courcelles, 75017 Paris) and its subsidiary LFP 1 (simplified joint stock company, located at 34 Boulevard de Courcelles, 75017 Paris). The LFP and its subsidiary LFP 1 jointly control the data processing activities described in this Data Protection Policy, meaning they collaborate in implementing and managing these processes based on their respective activities. For ease of reference, both entities will be collectively referred to herein and hereafter as 'LFP.' A Data Protection Officer (DPO) has been appointed by the LFP, whom you can contact: • by email: dpo@lfp.fr • by mail: LFP, Attention: DPO, 34 Boulevard de Courcelles, 75017 Paris

3. COLLECTION OF YOUR PERSONAL DATA

How is your data collected by the LFP through Websites, Apps, and Events, whether through interactions with you or in the context of the relationship that LFP has with you as a user or visitor of the Websites and Apps?

We may collect your data in various ways, including when you create an account on the Websites or Apps, participate/register for our Events, browse Our Sites and/or use the Apps (via Cookies), make one or more purchases, or when you contact us by email, mail, or phone. Additionally, we may collect data about you indirectly through third parties such as commercial and media partners of LFP, suppliers of LFP, or from public sources such as media and social networks. This data may include: name, first name, username, content of posts and messages, reactions to posts or content shared, preferences, any other publicly disclosed data that could help us refine your user profile or better understand trends.

Note : If you were a user of MPG before July 1, 2023, your data (i.e., user data) was transferred to LFP as part of the acquisition of Fantaleague by LFP.

4. PURPOSES, LEGAL BASES, AND DURATION OF DATA PROCESSING

This is to explain why your data is processed, the justification for such processing (based on legal grounds provided by regulations – Article 6 of the GDPR), and the duration for which your data is retained.

Thus, we hereby present the purposes of processing, the envisaged legal bases as provided by applicable data protection regulations, and the retention periods applied based on these processes :

Purposes

Legal Bases

Retention Periods

Creation and management of a user account: managing and monitoring the creation and use of a user account; verifying identity or age if necessary; managing identification via SSO (Single Sign-On); managing the use of the user account credentials to access various digital content offered by the LFP; managing purchases made on the Websites and App, managing and tracking the delivery of ordered goods, executing and monitoring the associated sales contract, and maintaining the purchase history.

• For account management: execution of the contract - T&Cs • For retaining purchase history: LFP's legitimate interest in promoting its activities

For user account management: as long as the user account is active, and then for 3 years from the user's last action. For identity or age verification: for the duration necessary for verification.

Payment management : managing online payments, managing the storage of bank card information, managing the retention of accounting records, verifying the identity of the payment cardholder.

• The execution of the contract - T&Cs • Compliance with a legal obligation for the retention of accounting records

For the duration necessary to complete the transaction or as long as the card is valid when the details have been saved. Note: Certain purchase-related data may be archived for the duration of the applicable legal retention period for evidentiary purposes or due to legal obligations (e.g., tax), such as the retention of accounting records.

Personalization of content and audience measurement, improvement of content, Websites, and Apps: tracking the journey and experience of visitors/users on the Website(s) or Apps and the frequency of visits; managing user-defined preferences (e.g., favorite club, favorite players); managing content recordings and other favorite content; personalizing the content of the Websites and/or Apps based on user preferences and choices; ensuring that the content of the Websites and/or Apps, our social media pages, and our emails are presented in the most effective way tailored to the needs of our visitors and users; improving the quality of the Websites, Apps, and other platforms; conducting statistical studies, surveys, and polls.

• The legitimate interest of LFP to provide users with personalized content, promote its activities, improve and evolve its Websites, Apps, Events, and other platforms.

For the duration necessary for audience study and analysis, for a period sufficient in relation to the content of the Websites, Apps, and events or content in question.

For sending communications (to users): sending notifications, newsletters, and general information alerts by LFP; sending communications about its partners, competitions, offers, or various football-related events; sending communications based on your preferences and history of participation in our events; transmitting data to its partners for the purpose of sending communications.

• Your consent (which you can withdraw at any time – see Section 10. YOUR RIGHTS REGARDING YOUR DATA) • Legitimate interest of the LFP to promote its activity and Gaming services to users

Except in case of withdrawal of consent, for 3 years from the last contact with the individual concerned.

Management of various requests: responding to various requests from any visitor or user directly addressed via one of the Websites or Apps or any other platform, or through any other means, including requests to exercise rights under applicable data protection regulations (see Section 10. YOUR RIGHTS REGARDING YOUR DATA).

• For various requests: legitimate interest of LFP to respond to these requests. • To respond to requests to exercise rights: compliance with a legal obligation (GDPR).

For the duration necessary to process your request, then archiving for evidentiary purposes for the duration of the applicable legal prescription period (Note: copies of identity documents are not kept after processing the request).

Management of registrations and participation in events organized by LFP: ensuring the tracking of registrations and management of participation in events, games, or contests; organizing and monitoring of draws; ensuring compliance with game regulations; monitoring the relationship with participants.

• For events: legitimate interest of LFP to be able to monitor the events it organizes • For games and contests: execution of the contract - applicable game regulations

For the management of registrations and participation in games and contests: during the duration of the game or contest, then archiving for the duration of the applicable legal retention period. For the management of registrations and participation in events organized by LFP: for 3 years from the last contact with the individual concerned.

5. MANDATORY OR OPTIONAL NATURE OF DATA COLLECTION

In some cases, you are required to provide one or more pieces of information about yourself, and what are the consequences if you do not? For instance, when creating an account on MyLigue, you need to provide identifying information such as your first name, last name, email address, password, and date of birth (due to protective measures for minors). These mandatory pieces of information are indicated by an asterisk (*) and are strictly necessary.

When providing information that is mandatory, it is indicated by an asterisk (*) in the collection forms. The requirement for mandatory information stems from either a legal obligation, a contractual necessity, or a requirement related to the purpose of the processing (for example, providing contact details to respond to an information request). If you do not fill in these "mandatory" pieces of information, LFP may be unable to proceed with your registration, request, or form submission. DATE OF BIRTH: Why is the date of birth required for registration? We need to determine if you are of legal age to register (to accept the T&Cs, for example) and to consent to receive communications (according to applicable regulations, only minors aged 15 and above can consent without parental or legal guardian approval). Anyone providing a date of birth indicating they are under 16 will be denied account creation. Additionally, we use this date of birth to tailor the content of communications sent via email; certain communications are reserved exclusively for adults (aged 18 and above). LFP may request documentation to verify age if there is any doubt. Fields in a form that are not marked as mandatory are optional and left to your discretion. It is up to you to decide whether to fill them in or not.

6. INFORMATION WE SHARE

This is to inform you about the recipients of your data, so that you know to whom the LFP transmits your data or who has access to your data within the framework of the processing covered by this Data Protection Policy.

We do not disclose the data we collect about you, except in the following cases: • To the departments responsible for the aforementioned purposes within the LFP for internal reasons, mainly for operational purposes related to the objectives described in this Policy; • To LFP Partners* when you have consented to such transmission (in your user account preferences) or as part of organizing events; • To social networks when you accept the associated cookies—for example, when you log in to a Site or an App using your Facebook, Google, or other account and/or when you click on the share buttons present on our website; • To our subcontractors as part of their services on behalf of the LFP. We may share aggregated, pseudonymized, or anonymized information that no longer identifies you, for statistical analysis purposes, which includes, but is not limited to, the number of visitors to our Sites and App, and the number of responses following email campaigns.

7. COOKIES

A cookie is a small text file that may be placed and stored in a space on your device's hard drive (e.g., computer, mobile, tablet) when you visit an online service (website or app). It allows the cookie issuer to identify the device in which it is stored and to retain certain information related to your browsing experience during the cookie's validity period. This can simplify your navigation on a website, secure your connection, or adapt the content of a page to your interests. Other technologies with similar functionalities may also be used, especially in environments that do not support cookies, such as mobile apps. The term "cookies" in this Policy applies to all these technologies. These cookies can come from different issuers: • LFP cookies: These are cookies that may be placed by the LFP on your device during your navigation on our Sites and Apps. These cookies allow us to personalize and continually improve your experience on our Sites and Apps. • Third-party cookies: These are cookies that may be placed by third-party companies (e.g., advertising agencies, social networks, LFP partners) on your device during your navigation on our Sites and Apps. These cookies allow these third-party companies, during the validity period of their cookies, to facilitate your login when you use an account with a social network or other system (SSO), identify your interests, collect browsing information related to your visit to our Sites and Apps, and personalize ads that may match your interests and user profile which you may be exposed to on our Sites and Apps. Our Sites and Apps use the following cookies: • Technical cookies: These enable you to use the Site/App and its functionalities, allowing you to access the services of the Sites and Apps. These cookies are placed without your consent as they are purely technical. However, you can oppose the placement of these cookies and delete them using the Cookie Manager (link available at the bottom of the Site or App pages) or by configuring your browser (in the absence of a Cookie Manager - for Sites and Apps that only have technical cookies). Please note that opposing the placement of these "Technical" cookies may degrade the use of the Site/App. • Advertising and audience measurement cookies – subject to your prior consent for their placement: These cookies measure audience, social networks, and video content, to adapt the Sites and Apps and their content according to the usage and navigation of visitors, measure the number of visits, pages viewed, user activity on the Sites or Apps, and the frequency of user returns. You can oppose the placement of these cookies and delete them at any time using the Cookie Manager (link available at the bottom of the Site or App pages). To learn more about the different cookies, their purposes, durations, and to manage your consents, we invite you to click on the Cookie Manager link accessible at the bottom of the Site or App pages.

8. DATA TRANSFER

You are informed that some of your data may be transferred by the LFP to countries outside the European Union under certain limited circumstances. When the LFP transfers your personal data to a country outside the EU, we ensure that appropriate security measures are in place to offer protection to your personal data equivalent to that which you would receive within the EU, in accordance with the applicable data protection regulations. We have implemented standard contractual clauses (SCCs) based on the European Commission's model to adequately protect transfers outside the EU to countries not recognized as adequate by the EU. To date, the countries to which the LFP may transfer data are as follows: • United States (transfers regulated by SCCs and/or the adequacy decision between the EU and this country) • China (transfers regulated by SCCs) • United Kingdom (adequacy decision between the EU and this country) • Monaco (transfers regulated by SCCs) • Switzerland (adequacy decision between the EU and this country) For more details on how we protect your data transferred outside the EU, please contact us using the contact details mentioned in point 12 below.

9. SOCIAL NETWORKS AND USER-GENERATED CONTENT

On sharing data via social networks and precautions you should take when posting on our pages.

Our Sites and Apps feature share buttons that allow access to content disseminated by the LFP on social networks. These share buttons may collect data when you are logged in to these social networks or when you have accepted the placement of social media cookies. Transmissions may also occur when you connect to the Sites and Apps using an account you have with a social network (SSO system), limited to your authentication. Additionally, as a user of social networks, you can post content on LFP pages. Please note that content displayed on our social platforms may be viewed by the public. Therefore, exercise caution when providing certain data or information on these platforms that you do not wish to be exposed to the public. We are not responsible for actions taken by others if you post data on our social platforms.

10. YOUR RIGHTS REGARDING YOUR DATA

What are your rights regarding your data and how can you exercise them? The applicable data protection regulations provide rights for individuals so that they can have more control over their data.

In accordance with applicable data protection regulations and under the conditions provided by such regulations (as certain rights apply depending on the legal basis of the processing, see above at 4. PURPOSES, LEGAL BASES, AND DURATION OF DATA PROCESSING), you have the following rights regarding your data: • Right of access: You can inquire about which data the LFP processes. • Right to rectification: You can correct any data that is incorrect, incomplete, or outdated (e.g., changing an email address). • Right to erasure: You can request the deletion of your data under conditions specified in the GDPR (Article 17), for example, if you have objected to the processing of your data or withdrawn your consent. • Right to withdraw consent: When you give consent, you can withdraw it at any time without providing a reason (e.g., unsubscribing from newsletters by clicking the unsubscribe link or via your user account on our Sites and Apps). • Right to data portability: Under conditions specified in the GDPR (Article 20), when processing is based on contract execution or consent, is automated, and you wish to retrieve your data or have it transferred to a third party. • Right to restriction of processing: Under conditions specified in the GDPR (Article 18), when you wish to temporarily suspend the processing of your data due to specific circumstances. • Right to object: You can object to processing carried out by the LFP based on its legitimate interests, such as managing requests or personalization, and at any time regarding the sending of communications. You can exercise these rights by contacting us as specified in section "12. Contact Us" below. Please note that if necessary, we may ask for a copy of your ID (passport or ID card) before responding to your request. Regarding sending communications and marketing, please be aware that you have the right at any time and without justification, • To withdraw any consent given. • To object to the processing of your data for the purpose of receiving communications via email or other electronic means. You can exercise the withdrawal or objection by clicking on the unsubscribe link at the bottom of our communication emails, logging into your account on our Sites and Apps, or by sending a request to the email address: dpo@lfp.fr Additionally, you have the right to lodge a complaint with any competent data protection authority – for France, this is the CNIL (Commission Nationale de l'Informatique et des Libertés), either directly online or by mail: 3 Place Fontenoy – TSA 80715 – 75334 Paris Cedex 07. If you wish to delete your account, you can go directly within the application to your user account and select the "Account Deletion" section. Your account will be deleted on all Ligue 1 Connect platforms. Alternatively, you can send an email to dpo@lfp.fr requesting account deletion. For technical and operational reasons, the email address associated with deleted accounts is retained in encrypted form for a maximum period of 30 days from the effective date of account deletion. This temporary retention ensures the proper execution of deletion operations and prevents any abusive re-registration during this period.

11. CHANGES TO THE DATA PROTECTION POLICY

This Data Protection Policy may be updated periodically to reflect changes in our practices regarding the processing of personal data. It is your responsibility to regularly review this document. LFP reserves the right to modify this privacy policy at any time and without prior notice. However, we will inform you if we make significant changes via email.

12. CONTACT US

For any further information regarding the protection of your personal data, please contact us at : • Email: dpo@lfp.fr • Mail: LFP, Attention: DPO, 34 Boulevard de Courcelles, 75017 Paris Last updated : [11/07/2024]