PDT Privacy Statement

Overview

Privacy Statement: Personal Digital Access

This privacy statement (hereinafter:“Privacy Statement”), which relates exclusively to data processing in the context of Personal Digital Access (hereinafter:“PDT”), is used by (i) PSV N.V., a public limited company under Dutch law, registered in the Commercial Register of the Chamber of Commerce under number 17104199, with its registered office in Eindhoven and its principal place of business at (5616 NH) Frederiklaan 10A, Eindhoven, (ii) PSV Stadionexploitatie B.V., a private limited liability company, registered in the Commercial Register of the Chamber of Commerce under number 17126009, with its registered office in Eindhoven and its place of business at Frederiklaan 10A, Eindhoven (5616 NH), (iii) Eindhovense Voetbalvereniging Philips’ Sport Vereniging, registered in the Commercial Register of the Chamber of Commerce under number 40235615, with its registered office in Eindhoven and its place of business at (5616 NH) Frederiklaan 10A, Eindhoven, (iv) Stichting PSV Foundation, registered in the Commercial Register of the Chamber of Commerce under number 67779727, with its registered office in Eindhoven and its place of business at (5616 NH) Frederiklaan 10A, Eindhoven (hereinafter collectively referred to as“PSV”or“we”).

For the processing activities described in Section 2 of this Privacy Statement, PSV may be considered a (joint) data controller (together with Siip Group (hereinafter:“Siip”)) within the meaning of the General Data Protection Regulation (hereinafter:“GDPR”).

In this Privacy Statement, we explain, among other things, what personal data we collect and process from you and for what purpose we do so. In addition, we inform you about your rights vis-à-vis PSV regarding the processing of your personal data. We also discuss the retention periods we apply and the categories of recipients with whom we may share your personal data. Finally, we explain how we protect your personal data and how you can contact us.

1. How does PDT work, and what is its purpose?

How does PDT work, and what is its purpose?

PDT is a system for digital pre-registration and access control at stadiums. It enables visitors to gain access to the stadium via a digital wallet on their smartphone. This system replaces traditional physical admission tickets with a digital process, in which the visitor registers and identifies themselves once via the Siip wallet, tickets are digitally linked to the visitor’s verified identity, upon acceptance of a ticket, a check is performed via C3V for national stadium bans; at the stadium entrance, a barcode is scanned for access control; and PSV receives a final visitor list containing the personal data of visitors who were actually present.

The various phases can be distinguished as follows:

1. Ticket sales (via the PSV website)
2. Creating an account (via the PSV website or app)
3. Club card validation
4. ID verification
5. Ticket acceptance and linking
6. C3V check
7. Forwarding tickets
8. Stadium access control and visitor registration

The PDT solution is used exclusively in phases 4 through 8. The goal of PDT is reliable ID validation, making access control for football matches more effective and secure, enforcing stadium bans, and ensuring safety within the stadium.

2. What data is processed?

In this section, we describe what data is processed within the framework of PDT (phases 4 through 8).

ID Validation
When registering in the app, data from an ID card, passport, or driver’s license is read (hereinafter:“ID validation”). Only the following forms of identification may be used for ID validation:

  • a driver’s license,
  • an ID card issued on or after August 1, 2021, or
  • a passport issued after August 30, 2021.

ID validation, including authenticity checks, is performed by Siip. During ID validation, data from the NFC chip of an identity card (hereinafter:“ID card”), passport, or driver’s license is read (in encrypted form). This involves the following data:

  • the photo (in color);
  • document type;
  • country of publication;
  • prefix(es);
  • name;
  • first names;
  • document number;
  • holder’s nationality;
  • date of birth;
  • gender;
  • Expiration date.

Only the following data is stored decentralized and encrypted in the user’s wallet:

  • first name;
  • last name;
  • date of birth;
  • The passport photo is stored off-site in the user’s wallet.

Any other data read from the NFC chip is immediately destroyed.

Ticket Acceptance and Linking
After ID validation, once you have accepted the ticket (the digital access right) and following a positive C3V check, it is digitally linked to (the wallet of) your verified identity. Your email address serves as the linking key (bridge identifier) between the two systems. Siip links the ticket to your wallet based on this email address and generates a customer number specifically for you to use with PSV. You will receive the ticket in the wallet linked to this customer number and must accept the ticket there. The following (personal) data is processed in this process:

  • email address;
  • customer number;
  • ticket details (ticket ID, entrance, section, row, seat, event, start date, end date, start time, end time, venue);
  • acceptance status;
  • customer number (for support purposes);
  • barcode.

    Only when you accept a ticket—which, according to the text, is a different action than purchasing a ticket—will you be placed on a provisional visitor list, and the following information will be shared with PSV:

    • email address;
    • first name;
    • last name;
    • date of birth;
    • passport photo.

    C3V check
    National stadium bans are verified with the KNVB via C3V. The verification is based on the following data:

    • initials;
    • insert;
    • last name;
    • date of birth;

    The admission ticket is only issued if the C3V check confirms that no national ban is in effect. If the result is negative, the admission ticket will not be issued to you. You will then see a pop-up in the app asking you to report to the fan desk. At the fan desk, you can request a (re)evaluation.

    Forwarding Tickets
    The person to whom a ticket has been forwarded must complete all the steps described in this section themselves.

    Stadium access control and visitor registration
    Another access check takes place at the stadiumentrance, where the barcode in the app is scanned manually. The following data is processed during this process:

    • first name;
    • last name;
    • email address;
    • date of birth;
    • passport photo;
    • time of scan;
    • section, row, and seat number.

    After this access check, PSV gains access to a final list of visitors who have scanned their tickets and are therefore inside the stadium.

    3. Is the citizen service number processed?

    Your citizen service number (hereinafter:“BSN”) will not be processed if you use a driver’s license, an identity card issued on or after August 1, 2021, or a passport issued after August 30, 2021. For users who identify themselves with a driver’s license, an ID card issued on or after August 1, 2021, or a passport issued after August 30, 2021, the BSN does not appear in the authenticity check: For these ID cards and passports, the BSN is not stored in the NFC chip. For driver’s licenses, Siip has configured the system so that the data group containing the BSN is not read.

    For users who identify themselves with an ID card issued before August 1, 2021, or a passport issued before August 31, 2021, the NFC chip contains the BSN. During the authenticity check, the BSN is briefly (for a few seconds) transmitted in encrypted form as an integral part of the data set required for the check; it is not used as a separate piece of data and is destroyed immediately upon completion of the authenticity check. We never receive the BSN.

    If you do not have a driver’s license, an ID card (issued on or after August 1, 2021), or a passport (issued after August 30), we ask that you stop the identification process and report to the FANdesk or to PSV Ticket Sales on match days at the stadium (Entrance 11). There, you can verify your identity using your ID (an ID card issued before August 1, 2021, or a passport issued before August 31) without your BSN being scanned.

    4. Does PDT also process special categories of personal data?

    No, no special categories of personal data are processed when using PDT.

    5. Purposes of Processing and Legal Basis

    With regard to PDT, PSV can rely on the following two principles:

    Necessary for the performance of the agreement (Article 6, paragraph 1, preamble and (under b, GDPR)

    PSV can base the processing of personal data associated with the PDT solution in part on the legal basis of Article 6, paragraph 1, preamble and subparagraph (b), of the GDPR. After all, the purchase of a ticket establishes a contract between the visitor in question and PSV. By doing so, the visitor (automatically) agrees to, among other things, PSV’s Internal Regulations and the KNVB’s Standard Terms and Conditions. This specifically concerns the following processing activities: ticket sales, account creation and registration in the app, ticket acceptance and linking, access control, and visitor registration. This legal basis is invoked in combination with the “legitimate interest” legal basis.

    Legitimate interest (Article 6, paragraph 1, preamble and subparagraph f, GDPR)

    The processing of personal data in conjunction with the PDT solution is based on the legal basis of Article 6, paragraph 1, preamble and subparagraph (f), of the GDPR. This involves the following processing activities: registration in the app (ID validation), club card validation, ticket acceptance and linking, resale and transfer of tickets, C3V check, access control, visitor registration, and the investigation and resolution of incidents.

    Pursuant to Article 6(1)(f) of the GDPR, the processing of personal data is permitted if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or the fundamental rights and freedoms of the data subject that require the protection of personal data outweigh those interests.

    Through PDT, PSV pursues the following legitimate interests:

    · PSV has a concrete, legitimate interest in knowing who is actually present at the Philips Stadium. Only when PSV knows who is actually present at the Philips Stadium (and thus not merely who holds a PSV Season Club Card or a PSV Season Club Card All-in) can PSV effectively guarantee the safety of all fans and, in accordance with its duty of care, attempt to prevent threatening situations. If digital, personalized access is not implemented, it will not be clear to PSV who is sitting where, and incidents may be handled less effectively.

    · In addition, in the context of enforcing stadium bans, PSV has a legitimate interest in barring individuals if they have been issued a (national or local) stadium ban by PSV and/or the KNVB. In the past, it has been observed on multiple occasions that individuals subject to stadium bans have nevertheless managed to gain access to the Philips Stadium. This can be prevented through the use of digital, personalized access. PSV therefore has a legitimate interest in improving security checks, barring these individuals, and ensuring safety within the Philips Stadium;

    · With the use of PDT, PSV can clearly see who is sitting where in the stadium, enabling PSV to act more quickly and effectively against behavior that violates the KNVB Standard Terms and Conditions (or other soccer-related misconduct). Without digital, personalized access, it is not really possible to identify and sanction offenders. With digital, personalized access, PSV can ensure safety within the stadium, so that football remains safe and accessible for everyone.

    · PDT is also expected to have a preventive effect and could reduce unlawful behavior—including violence, discrimination, or endangering others—at the Philips Stadium. Because fans are aware that PSV knows who is inside the Philips Stadium, they will be more likely to refrain from unlawful or disruptive behavior, as there is a higher chance that they will face sanctions.

    · PSV considers the interests described above to outweigh the (privacy) interests of visitors.

    · Furthermore, in the balancing of interests carried out by PSV, an explicit decision was made to process (only) the strictly necessary personal data and to use decentralized storage. PSV and Siip have implemented appropriate technical and organizational measures to ensure an adequate level of security.

    6. Who is responsible for the personal data processed via the PSV App for the purposes of PDT?

    When using the PDT application, the user of the PDT solution enters into both an agreement with Siip (for the creation of a Siip wallet) and an agreement with PSV for the use of PSV’s PDT application.

    To create your wallet, a general customer number will be generated and linked to your email address. In addition, a customer number will be generated for you specifically for PSV.

    Siip is the independent data controller responsible for processing the general customer number for the purpose of creating the wallet. In addition, Siip is responsible for verifying authenticity.

    PSV and Siip jointly determine the purpose and means of the email address and customer number. Siip because it determines the purpose and means of the email address and customer number by using them as linked data. PSV because it chooses to integrate the Siip wallet into its PDT solution and thereby also determines the purpose and means of processing the email address and customer number.

    Siip’s joint responsibility as a data controller is limited to the phase of creating and managing the wallet. Once the user shares their data with PSV’s PDT application to obtain stadium access, PSV acts as an independent data controller.

    For more information about how Siip processes your personal data, please refer to: Terms and Conditions | Siip & Privacy Statement | Siip

    7. Who are our data processors?

    PSV identifies visitors through the PDT application, which is managed by Siip and made available to visitors on behalf of PSV. The moment a visitor shares their data with PSV’s PDT app in order to obtain access to the stadium, PSV acts as an independent data controller. From that moment on, Siip acts as a data processor for PSV.

    For more information about the processing of your personal data by Siip and the (sub)processors it engages, please refer to: Terms and Conditions | Siip & Privacy Statement | Siip

    8. How long is personal data retained?

    The personal data provided by the data subject to PSV and Siip through the use of PDT will be automatically deleted by Siip within twenty-eight (28) days. Personal data related to an incident will be retained by PSV until the incident in question has been irrevocably resolved.

    The data in your wallet is stored for as long as you have an account.

    9. Is personal data transferred internationally?

    Your personal data will be processed solely within the European Economic Area.

    10. Is decision-making and profiling carried out solely by automated means?

    No, there is no use of purely automated decision-making or profiling

    11. Your Rights Under the GDPR

    Data subjects have the right to access, rectify, erase, restrict the processing of, and/or the right to data portability regarding their personal data processed in the context of digital personalized access (Articles 15 through 20 of the GDPR). A data subject also has the right to object to the processing of his or her personal data (Art. 21 of the GDPR). Finally, data subjects have the right to file a complaint with the Dutch Data Protection Authority.

    Data subjects may submit their GDPR requests and/or objections via <legalnotices@psv.nl> or by mail to: Legal Affairs Department, Frederiklaan 10a, 5616 NH, Eindhoven.

    Contact information:
    PSV N.V.
    Attn: Legal Affairs Department
    Frederiklaan 10a, 5616 NH, Eindhoven
    T: +31 (0)40 – 2505 629
    E: legalnotices@psv.nl

    12. Privacy Policy Update

    PSV reserves the right to amend this Privacy Statement. Should the Privacy Statement be amended, this revised version will be communicated to you via publication on the PSV website. We therefore recommend that you continue to review this Privacy Statement regularly so that you can be aware of any changes.

    This Privacy Statement was last updated on October 2, 2026.