1. Name and Contact Details of the Data Controller

Aachen-Laurensberger Rennverein e.V. (“ALRV“),

Albert-Servais-Allee 50, 52070 Aachen, Germany
// P.O. box 50 01 01, 52085 D-Aachen, Germany,

Phone: +49 241 / 9171 – 111
E-mail: tickets@aachen2026.com

2. Contact Details of the Data protection Officer
datenschutz@aachen2026.com

3. Purposes and Legal Bases of the Data Processing

3.1 Ticket Purchase
Your personal data will be processed for the performance of the contract for the purchase of tickets for events as part of the FEI World Championships 2026, which are at least co-organized by the ALRV (“Events”), as well as for the implementation of necessary, pre-contractual measures that are carried out at your request. The legal basis is Art. 6 (1) lit. b GDPR. This includes the following purposes: registration in our online ticket store under Ticketshop FEI World Championships Aachen 2026, purchase (usually via our online ticket store at Ticketshop FEI World Championships Aachen 2026, (electronic) shipping, receipt, deposit of personalized tickets, payment processing and, if applicable, the dispatch of event-related information (usually electronically by e-mail).

In addition, the ALRV processes personal data in accordance with Art. 6 (1) lit. c GDPR, insofar as this is necessary for the compliance with legal obligations to which the ALRV is subject as a legal entity. The purposes of processing include, in particular, retention obligations under tax law in accordance with Section 147 of the German Fiscal Code (Abgabenordnung) or responding to official inquiries from regulatory and/or law enforcement authorities.

Beyond the actual performance of the contract, the ALRV processes personal data in accordance with Art. 6 (1) lit. f GDPR. This is permissible if the processing is necessary to ensure the legitimate interests of the ALRV or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. Such an overriding, legitimate interest of the ALRV exists in the following cases: the execution of payment processing via external service providers, fraud prevention and prevention against ticket trading on the secondary market, the examination and optimization of procedures for needs analysis and direct customer contact, the assertion of legal claims, the defense in legal disputes and the guarantee of IT security, in the case of contact requests via the contact form and/or other contact
options to the ALRV.

3.2 Marketing and Advertising
It is furthermore in the legitimate interest of the ALRV pursuant to Art. 6 (1) lit. f GDPR to use the e-mail address provided when purchasing a ticket for the purpose of direct marketing for similar goods or services. The ALRV will make use of this to a reasonable extent, taking into account in particular your interest in receiving information and your interest in avoiding nuisance marketing. If you have also given your consent to direct advertising (in particular in the form of our newsletter) in the context of the ticket purchase, the legal basis is Art. 6 (1) lit. a GDPR. Consent that has been given can be withdrawn at any time. Such withdrawal is only effective for the future. Processing that took place before the withdrawal is not affected.

3.3 Attendance at the Event
To ensure security and effective law enforcement, the tournament grounds around Albert-Servais-Allee 50 in 52070 Aachen and/or the other official competition venues of the Events (“Event Site”) and partly its surroundings are video-monitored in accordance with Art. 6 (1) lit. f GDPR. Ticket holders may be recognizable as visitors to the Event Site. Insofar as law enforcement and prosecution authorities use video surveillance systems on the Event Site and in its surroundings during the Events to avert danger and to prosecute, this is done at their own responsibility under data protection law within the meaning of Art. 4 (7) GDPR.

For public reporting and promotion of the Events, the ALRV or third parties commissioned or otherwise authorized by it may, in accordance with Art. 6 (1) lit. f GDPR, create image and sound recordings that may show the ticket holder as a visitor to the Event Site and reproduce these (in part) publicly on the ALRV’s website or other channels. The ALRV’s legitimate interest lies in its interest in positioning and promoting the Events in the media. These image and sound recordings may be processed, used and publicly reproduced by companies affiliated with the ALRV in accordance with Section 15 of the Stock Corporation Act (AktG) and by third parties authorized by them (e.g. radio, press) within the scope of the same legitimate interest in this context.

Any recordings and publications of these recordings by the press and/or radio present at the events are made at their own responsibility under data protection law within the meaning of Art. 4 (7) GDPR.

3.4 Association Purposes
In addition, the ALRV has a legitimate interest pursuant to Art. 6 (1) lit. f GDPR in complying with its obligations under association law or contractual obligations, in particular, towards its governing association. This may include, in particular, the transmission of ticket information in connection with the events to the Fédération Équestre Internationale (FEI) or other national member associations, which, however, only contain personal data of ticket purchasers in exceptional cases (e.g., their membership in a national association, etc.).

4. Categories of Personal Data
Title, first and last name, date of birth (if applicable), address, e-mail address, telephone and mobile number (if applicable), nationality (if applicable), billing and payment data, membership in a national association (if applicable); if applicable, communication data in the event of a contact request; if applicable, audio, photo and video recordings where it cannot be ruled out that persons are identifiable.

5. Recipients or Categories of Recipients of Personal Data
Within the ALRV, access to the data subject’s personal data is granted to those departments that require it to perform the ALRV’s contractual and legal obligations. Processors engaged by us (Art. 28 GDPR) may also receive data for these purposes. These are companies in the categories of IT services, logistics, shipping, debt collection, advice and consulting, sales and marketing, event security and hospitality. In exceptional cases, recipients may also be professional secrecy holders and authorities, radio and/or press and, with regard to data required under association law, the FEI and any national member associations.

6. Third Country Transfers
If personal data is transferred to the FEI in this context, this is a transfer to a third country due to the FEI’s registered office in Switzerland. In its decision of July 26, 2000, the European Commission confirmed the adequacy of the protection of personal data in Switzerland (Art. 45 para. 1 sentence 1 GDPR). No other third country transfers are intended. Should these take place in exceptional cases on the basis of the purposes and legal bases mentioned in section 3, the requirements of Art. 44 et seq. GDPR are complied with.

7. Retention
Data shall be deleted as soon as it is no longer required for the purposes for which it was collected. If an Event that has been video-monitored is uneventful, the recordings will be deleted immediately (usually no later than 72 hours after the end of the respective Event).

Due to proof and retention obligations in accordance with Section 147 of the German Fiscal Code (Abgabenordnung), the ALRV is obliged to retain or document accounting records (in particular invoices) for up to ten years, starting at the end of the calendar year in which they were issued.

8. Rights of the Data Subjects
Data subjects have the right to obtain information from the controller about the personal data concerned (Art. 15 GDPR), as well as the right to correction (Art. 16 GDPR) or deletion (Art. 17 GDPR) or restriction of processing (Art. 18 GDPR) as well as a right to data portability (Art. 20 GDPR).

In case of data processing based on an overriding legitimate interest (Art. 6 (1) lit. f GDPR), data subjects have a right to object in accordance with Art. 21 GDPR.

In the case of data processing for direct marketing on this basis, data subjects can object without stating reasons.

If the data subject believes that data processing violates data protection law, he or she has the right to complain to a data protection supervisory authority of his or her choice (Art. 77 GDPR in conjunction with Sec. 19 of the German Federal Data Protection Act (“BDSG”)). This also includes the data protection supervisory authority responsible for us:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
P.O. box 20 04 44
40102 Düsseldorf
Phone: 0211 38424-0
Fax: 0211 38424-10
E-mail: poststelle@ldi.nrw.de

9. Data Sources
In principle, we collect all personal data relating to you directly from you. When issuing personalized tickets for the Events and/or in the case of the permitted transfer of tickets, we sometimes receive the personal data of the actual ticket holders.

10. Changes and Updates to this Privacy Notification
For legal and/or organizational reasons and/or against the background of relevant case law, changes or adjustments to this Privacy Notification may be necessary from time to time. In this respect, please refer to the current version of our Privacy Notification, which you can access and save permanently at any time via our online ticket store at Ticketshop FEI World Championships Aachen 2026.

11. Language
This English version of the Privacy Notification shall only be seen as convenience translation. In the event of any inconsistency between the German version and this English version of the Privacy Notification, the German version shall prevail.

Version: November 2023