Privacy Policy

Information about the processing of personal data concerning customers, spectators, suppliers, partners and other external individuals

1 Introduction

Below you will find the information that Odense Boldklub is obliged to provide you with, in accordance with Regulation (EU) 2016/679 (the "GDPR" or "Data Protection Regulation"), when we process personal data about you as a customer, spectator, supplier, partner or other external stakeholder.

2 The Data Controller

The data controller for the processing is:
Odense Sport & Event A/S
CVR no.: 71122112
Ørbækvej 350
5220 Odense SØ
Email: ob@ob.dk

3 Processing Activities

3.1 Sale of goods and services

3.1.1 Purpose

When you purchase an OB season ticket or tickets for OB matches, shop on the club's website, or participate in events organized by OB, we process information about you for the purpose of delivering the purchased goods and services.

3.1.2 Categories of personal data

Name and contact information, including your address, email address, and phone number
Delivery address (if different from your address)
Information about the purchase/transaction (which items and how many)
Payment information
Technical information necessary for the system to function securely and appropriately

3.1.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is:

Article 6, paragraph 1, point b, of the Data Protection Regulation, as the processing is necessary for entering into or fulfilling a contract with you.
Article 6, paragraph 1, point c, of the Data Protection Regulation, as the processing is necessary for us to comply with our documentation obligations under the Danish Bookkeeping Act and tax legislation.
Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in documenting and understanding our customers' purchasing patterns, as well as our legitimate interest in providing secure and stable technical solutions for our customers.

3.1.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

If you have purchased a ticket on the club's website for an away match that OB is playing, we will disclose information about the purchased ticket(s) to the club that OB is playing against in that match, so that the ticket can be recognized during access control for that match.

3.1.5 Storage

The information is generally stored for five years from the end of the year in which the transaction took place, so that we can comply with our obligations under section 12 of the Danish Bookkeeping Act. For tickets and season tickets, however, it is five years from the end of the year in which the last event to which the tickets or season ticket grants access has been held.

3.2 Hosting matches at Nature Energy Park

3.2.1 Purpose

When you visit Nature Energy Park for football matches or other events, we process information about you in connection with access control, including biometric data for automatic facial recognition, in order to ensure that individuals who have a temporary or permanent ban from Nature Energy Park are denied access to the stadium, and to apprehend individuals who have previously violated the 3F Superliga's rules of conduct or the Stadium Regulations for Nature Energy Park but have not yet been subject to sanctions for this.

3.2.2 Categories of personal data

Information about your season ticket or tickets (barcode/QR code, etc.) that you have used to gain access to the stadium
Information about which entrance you used, as well as the date and time of ticket/season ticket scanning
In connection with football matches, we also process
- Information in the form of name, date of birth, photo, and ban information for individuals registered on OB's or the away team's ban list, as well as photo information of individuals who have previously violated the 3F Superliga's Rules of Conduct or the Stadium Regulations for Nature Energy Park and are therefore being sought for apprehension for the purpose of issuing a ban.
- Biometric identifiers in connection with automatic facial recognition at the stadium entrances.

If you have purchased your ticket through the away team, we receive information about the purchased ticket(s) from them, as this is necessary to ensure that the tickets can be recognized by our access control system. Similarly, we receive information about individuals registered on the away team's ban list from the away team.

3.2.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is:
Article 6, paragraph 1, point b, of the Data Protection Regulation, as the processing is necessary for the fulfillment of a contract with you (the agreement for access to the relevant match or event)
Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in effective access control and thereby ensure peace and order at the stadium, including enforcing the 3F Superliga's rules of conduct and the Stadium Regulations for Nature Energy Park.

Our processing of sensitive personal data is based on the following legal grounds:

Section 7, paragraph 4 of the Data Protection Act, cf. Article 9, paragraph 2, point g) of the Data Protection Regulation, as processing is necessary for reasons of substantial public interest, cf. the Danish Data Protection Agency's authorization for the processing.

3.2.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

3.2.5 Storage

The information is generally stored for five years from the end of the year in which the relevant event was held.

However, the information we receive from the away team (about tickets they have sold) is only stored until the end of the season in which the match took place.

Biometric information is stored until it has been compared with information in our ban register and is then deleted again once you have passed access control; however, biometric information for individuals who have been issued a ban or are being sought for apprehension for the purpose of issuing a ban is stored from up to 72 hours before the match and for up to 24 hours after the match.

3.3 Video surveillance at and around Nature Energy Park

3.3.1 Purpose

Nature Energy Park is under video surveillance for the purpose of preventing crime, unsettling behavior, disturbances, and violations of the 3F Superliga's rules of conduct and the Stadium Regulations for Nature Energy Park, as well as to investigate and document such incidents should they occur.

3.3.2 Categories of personal data

Video recordings

3.3.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in preventing disturbances and violations of the rules of conduct and documenting such incidents if they occur.
Regarding information about criminal offenses that may appear in video recordings, the legal basis for processing is section 8, paragraph 3 of the Data Protection Act.

3.3.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

The information may also be disclosed to the police in connection with the investigation of serious incidents.

3.3.5 Storage

The information is generally stored for up to 30 days, after which it is deleted.

However, the information may be stored longer if it is necessary for the investigation or documentation of specific incidents.

3.4 Enforcement of the 3F Superliga's rules of conduct and the Stadium Regulations for Nature Energy Park

3.4.1 Purpose

If you violate the 3F Superliga's rules of conduct or the Stadium Regulations for Nature Energy Park, we process personal data about you for the purpose of registering the violation and potentially initiating sanctions against you, including a ban, which will result in you also being registered on our ban list.

3.4.2 Categories of personal data

Name and contact information, including address, email address, and phone number
Date of birth
Information about the specific violation (date and time, and the nature of the violation)
Video recordings (e.g., TV surveillance)
Other information necessary for the initiation or enforcement of sanctions, including information obtained in connection with our internal investigation of possible violations of the 3F Superliga's rules of conduct or the Stadium Regulations for Nature Energy Park.
Information about sanctions
Your photo, which in connection with matches is used as a basis for automatic facial recognition at stadium entrances (see section 3.2) to ensure that individuals who have been issued a ban and are therefore not allowed to be present at Nature Energy Park can be denied entry, and individuals who have violated the 3F Superliga's rules of conduct or the Stadium Regulations for Nature Energy Park in such a way that sanctions must be imposed on them, can be apprehended.

In some cases, we may receive information from the police. Other information will either have been obtained directly from the data subject, from witnesses, through TV surveillance, or via social media and other publicly available sources.

3.4.3 Legal basis

The legal basis for our processing of information about legal offenses and criminal matters is section 8, paragraphs 3 and 4 of the Data Protection Act.

The disclosure of ban information to other clubs for the purpose of enforcing bans in connection with OB matches at other stadiums, as further described in section 3.4.4 below, is based on the Executive Order on the Exchange of Information on Private Bans, section 1.

3.4.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

The information may also be disclosed to the police in connection with the investigation of serious incidents, including criminal offenses, as well as to OB's lawyers in connection with violations of the rules of conduct (but not images from TV surveillance).

Finally, information about names, dates of birth, photos, and bans for individuals who have been issued a ban may be disclosed to clubs that OB will play against away from home for the purpose of enforcing the ban.

3.4.5 Storage

The information is generally stored until a decision has been made regarding any sanctions and these have been fully executed - in the case of a ban, until it has ended.

3.5 Customer Service

3.5.1 Purpose

When you contact our customer service, we process personal data about you in order to process your inquiry.

3.5.2 Categories of personal data

Name and contact information, including address, email address, and phone number
Other information you provide to us in connection with your inquiry

3.5.3 Legal basis

3.5.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

In addition, we may disclose the information to third parties, such as lawyers or other advisors, if this is necessary to ensure proper and appropriate handling of your inquiry.

3.5.5 Storage

If your inquiry leads to a financial transaction, the information is stored for five years from the end of the year in which the latest transaction took place.
Other inquiries are stored for two years from the end of the year in which the processing of the inquiry was completed.

3.6 Newsletters and marketing

3.6.1 Purpose

If you sign up for our newsletter, we process information about you for the purpose of sending you newsletters and other marketing materials.

Similarly, we process information about your previous purchases from us, including in our fan shop, so that we can better tailor the marketing we send to you to your interests.

3.6.2 Categories of personal data

Name
Email address
Phone number
Any purchase history (if we have collected your information in connection with previous purchases)
Information about your consents to receive marketing materials, including information about when consents were given and potentially withdrawn

3.6.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in marketing to our customers and others who have indicated an interest in receiving marketing materials from us.

3.6.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

3.6.5 Storage

The information is stored for one year from the end of the year in which you unsubscribe from the newsletter or withdraw your consent to receive marketing.

3.7 Social media

3.7.1 Purpose

If you visit – and possibly interact with – our pages on social media (Facebook and Instagram), we process personal data about you to optimize our social media pages.

To the extent that our processing is based on the statistics compiled by the respective social media, we are joint data controllers with the social media in question for the collection of personal data that forms the basis of such statistics.

You can read more about the joint data controller status with Meta (Facebook and Instagram) here.

3.7.2 Categories of personal data

Information about your posts and your other interactions on our social media pages
Statistical data from Facebook and Instagram

3.7.3 Legal basis

3.7.4 Recipients of personal data

We are joint data controllers with Meta as mentioned above.

You can read more about the joint data controller status with Meta (Facebook and Instagram) here.

3.7.5 Storage

We store information about your interactions on our social media for up to three years; however, we may store information longer if, after a specific assessment, we deem it relevant.

Regarding statistics received from the providers of the respective platforms, we generally store these for up to three years – these statistics are already anonymized when we receive them. We have no influence on how long Meta stores the relevant information.

3.8 App

3.8.1 Purpose

When you register in our app, we process personal data about you to target relevant marketing to you and to provide your tickets and season tickets in the app.

3.8.2 Categories of personal data

Name
Email address
Phone number
Date of birth
Gender

3.8.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in managing and marketing to our customers and others who have indicated an interest in receiving marketing materials from us.

3.8.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

3.8.5 Storage

The information is stored as long as interactions occur or until you delete your user account.

3.9 Suppliers and partners

3.9.1 Purpose

If you are a (contact person at) our suppliers or partners, we process personal data about you in order to administer our relationship with you or the company you represent.

3.9.2 Categories of personal data

Name and contact information, including your work address, email address, and phone number
Correspondence and trade history

This information originates from you or the company you represent.

3.9.3 Legal basis

The legal basis for our processing of personal data for the stated purposes is Article 6, paragraph 1, point f, of the Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in administering and optimizing relationships with our suppliers and partners, as well as communicating effectively with them.

However, if you collaborate with us as a private individual or as the owner of a sole proprietorship, the legal basis for processing personal data in connection with our purchase of services from you is Article 6, paragraph 1, point b, of the Data Protection Act, as the processing is necessary for the conclusion or fulfillment of a contract to which you are a party.

3.9.4 Recipients of personal data

The information is shared with our IT providers (data processors), who store the information for us and process it according to our instructions.

3.9.5 Storage

The information is stored as long as we have an active relationship with you or the company you represent. We consider the relationship active if we have had at least one transaction with you or the company you represent within the last six calendar years.

4 Storage

Personal data is generally stored as indicated under the individual processing activities in section 3 above.

However, we may store information for a longer period if necessary to comply with a legal obligation that we are or may become subject to, or if it is necessary to establish or defend a legal claim or assert a legal claim.

5 Your rights

When we process personal data about you, you have the following rights:
Right to withdraw consent. If we process your data based on your consent, you have the right to withdraw your consent at any time. You can do this by contacting us at ob@ob.dk. The withdrawal of consent only applies to the processing of personal data after the time you have withdrawn consent and thus does not affect the lawfulness of previous processing.
Right of access. You have the right to be informed of what data we process about you, as well as the terms of this processing. In this regard, you have the right to receive a copy of the data we process about you.
Right to rectification. You have the right to have inaccurate data we process about you rectified, just as you have the right to have the data we process about you supplemented if it is incomplete.
Right to erasure. In certain cases, you have the right to have personal data we process about you erased (the right to be forgotten).
Right to restriction of processing. In certain cases, you have the right to have the processing of the personal data we process about you restricted.
Right to data portability. If we process data about you based on your consent or for the purpose of fulfilling a contract, you have the right to receive the personal data we process about you in a structured, commonly used, and machine-readable format.
Right to object to processing. If we process personal data about you based on Article 6(1)(f) of the General Data Protection Regulation, you have the right to object to the processing on grounds relating to your particular situation.

If the purpose of the processing is direct marketing, you always have an unconditional right to object to the processing.

You can exercise your rights by contacting us at ob@ob.dk. Please note that certain conditions and limitations apply to your rights. Therefore, we are not necessarily obliged to comply with your requests.

However, you always have the right to lodge a complaint with a supervisory authority – in Denmark, this is the Danish Data Protection Agency. You can read more about your options for complaining to the Danish Data Protection Agency on their website.

6. Updating the Privacy Policy

Odense Boldklub may periodically change this personal data policy if it is necessary to provide an accurate description of our processing of personal data.

In the event of significant changes in our processing of personal data about you, which we already possess, you will be notified directly of the update as far as possible (e.g., via email).

This privacy policy was last updated in November 2025.