UEFA CHAMPIONS LEAGUE™ Privacy Notice

Identity of the Data Controller

Union des Association Européennes de Football (UEFA) and UEFA Events SA, whose offices are located at Route de Genève 46, 1260 Nyon 2, Switzerland, acting as joint data controllers (together “UEFA Parties”), via the ticketing system of the Match and the App (as defined in the 2025 UEFA Champions League™ Final Ticketing Terms and Conditions for guests of Qatar Airways (the “Terms and Conditions”)).

Capitalised terms used but not defined in this Privacy Notification are defined in the Terms and Conditions in the context of which this Privacy Notification must be taken note of and read.

Categories of personal data

When receiving a Ticket from Qatar Airways’ allocation, you are requested to provide the following personal data to Qatar Airways, acting as an independent data controller in this context:

• first name(s) and last name
• email address

The personal data will then be transferred by Qatar Airways to UEFA Parties via the ticketing system.

When Tickets are distributed to you by UEFA Parties, you will be requested to provide the following personal data and any additional data as required under Applicable Laws or at the request of the competent authorities on the App for you:

• first name(s) and last name
• date of birth
• email address
• passport/ID issued by country name
• mobile number
• gender (optional)

and for any other Ticket Holder accompanying you to the Match:

• first name(s) and last name
• date of birth
• passport/ID issued by country name

When attending the Match, your voice, image and likeness may be recorded during your time in the Stadium (“Recordings”).

Purposes of the processing

The personal data are collected and processed:

1. for the purposes of handling the Tickets from Qatar Airways’ allocation and providing you with Tickets for the Match.
2. for the purposes of any relevant safety, security and sanitary measures related to the Match.

The Recordings are also used for the purposes of public reporting and promotion of the Match.

Legal basis

The personal data are processed on the basis that such processing is necessary in order to process the Tickets from Qatar Airways’ allocation and distribute them in accordance with the Terms and Conditions.

• Legal basis for the data processing is Article 6 (1) lit. b of the GDPR.

The personal data, including the Recordings via a closed-circuit television system, are processed on the basis that such processing is necessary for the purpose of the legitimate interest of guaranteeing an effective security system and a safe environment inside and around the Stadium, as well as to combat the unlawful sale of Tickets.

The use of the Recordings is also necessary for the purpose of the legitimate interest of public reporting and promotion of the Match.

• Legal basis for the data processing is Article 6 (1) lit. f of the GDPR.

Failure to provide the data

You are free to provide your personal data to UEFA Parties. If you do not provide personal data, Tickets for the Match may not be allocated to you.

Categories of recipients

You understand that your personal data will be available to UEFA Parties and their parent or related companies. UEFA Events SA has contracted SecuTix SA, Av. Général-Guisan 70A, 1009 Pully, Switzerland, for managing the ticketing system, acting as data processor in this context. Technical service providers may access certain personal data for the sole purpose of (i) maintaining the security and performance of the ticketing system, (ii) detecting online fraud, and (iii) issuing and distributing Tickets, also acting as data processor(s) in this context.

Third parties authorised by UEFA Parties in each case (e.g., broadcasting, press) may process, exploit and publicly reproduce the Recordings for the purposes of public reporting and promotion of the Match.

The Host Association, the Stadium Owner, the stadium security and access service providers and any such other providers which help to organise the Match and maintain safety and security (including in relation to sanitary measures) may access certain personal data for the purposes of providing their services.

The transfer of personal data to the relevant public authorities, based on legal provisions and obligations, for the purpose of safety, security and sanitary measures and law enforcement related to the Match, is reserved.

Onward transfer

UEFA Parties will not, in principle, transfer your personal data to countries outside of the European Economic Area (EEA).

In the event of a transfer of personal data to the recipients identified above located in a country which does not ensure an adequate level of protection within the meaning of applicable data protection laws, UEFA Parties (i) have put in place European Commission approved standard contractual clauses to protect your personal data and/or (ii) will rely on your consent (where permitted by law).

To learn more about those safeguards, please contact us at: privacy@uefa.ch. 

Storage

All personal data provided to UEFA Parties shall be stored in the ticketing system managed by SecuTix SA in Switzerland (please see above).

Your rights

You may request deletion, access or update your personal data in the ticketing system by contacting us at: https://support.tickets-uclfinal.uefa.com/hc/en-us/requests/new. 

In addition, you have certain rights under Chapter III of the GDPR, depending on the legal basis and the purpose of the processing, in particular the right of access (Article 15 of the GDPR) and the rights to rectification (Article 16 of the GDPR), erasure (Article 17 of the GDPR), restriction of processing (Article 18 of the GDPR), and data portability (Article 20 of the GDPR), as well as the right to object (Article 21 of the GDPR).

The data privacy team can be contacted at: privacy@uefa.ch.

You have also the right to lodge a complaint with your local Data Protection Supervisory Authority and have the ability to seek to enforce your rights through a judicial remedy. The list of relevant local Data Protection Supervisory Authorities in the European Union is available here.

Retention period

The personal data is only collected and processed by UEFA Parties for no longer than is necessary for the purposes described above, unless the use of such personal data is further required for ongoing administrative or judicial proceedings relating to the Match or, where necessary, for preventing or detecting unlawful actions.

Personal data obtained from others

If you submit personal data on behalf of or for others, such as your Guest(s), you confirm having OBTAINED ANY NECESSARY CONSENT AND HAVING INFORMED THEM of the content of this Privacy Notification prior to data capture. You accept the responsibility of informing each person of these rules and procedures. UEFA is entitled to require at any time EVIDENCE OF SUCH CONSENT OR of THE PROVISION OF such information.

Additional information

You understand and acknowledge that your personal data is being collected and processed in accordance with the Terms and Conditions and:

• UEFA Privacy Policy available at https://www.uefa.com/privacypolicy/index.html.

Definitions

GDPR: EU General Data Protection Regulation 2016/679