PRIVACY NOTICE FOR THE PAID ONLINE VOTING OF THE 2026 EUROVISION SONG CONTEST

The following information is intended to provide You, voter (hereinafter, “You”, “Your(s)”) in the 2026 Eurovision Song Contest (“ESC”) via the paid online voting platform available at esc.vote (the “Paid Online Voting Platform") with an overview of the personal data we collect and process about You when You vote via the Paid Online Voting Platform in the ESC 2026 and Your rights under the Data Protection Laws.

As Joint Controllers, We

The European Broadcasting Union - Union Européenne de Radio Télévision, L’Ancienne-Route 17A, 1218 Le Grand- Saconnex, Genève, Switzerland (the “EBU”)

And
CLT-UFA S.A., 43 Boulevard Pierre Frieden, L-1543 Luxembourg acting as Participating Broadcaster for Luxembourg in the ESC 2026 (the “National Broadcaster”), and the other Participating Broadcasters taking part in the ESC 2026, the list of which is included at the end of this Privacy Notice.

And
Once Germany GmbH (formerly known as digame GmbH), Schanzenstrasse 38 D-51063 Cologne Germany (the “ESC Voting operator”)

are committed to protect Your personal data and respect Your privacy in compliance with all applicable data protection laws, notably the EU General Data Protection Regulation 2016/679 (“GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and the German Federal Data Protection Act (“BDSG”) (the “Data Protection Laws”). We will not process Your personal data for any other Purposes that the ones set below.

The EBU the Participating Broadcasters and the ESC Voting operator have executed specific and separate joint controllers’ arrangement pursuant to Article 26 of GDPR, the key content of which is available on demand at the premises of either the EBU or of the ESC Voting operator.

What categories of personal data are being processed?

We will process only the personal data which the ESC Voting operator receives when You cast Your vote online via Voting Platform.

When doing so, the ESC Voting operator will – depending on Your country of origin – gather or have access to the following categories of data from You if applicable:

• IP-address
• Geolocation
• User Agent
• Vote selection
• Payment data
  
  • Payment method details (unique ID, card number, card fingerprint, card expiry date, card type, card issuer, 3D Secure authentication details)
  • Payment amount
  • Owner email address
  • Name (optional)
  • Country of issuance
  • Date and time of transaction
• Anti-fraud metadata from payment network

Please note that the ESC Voting operator does not keep separate copies of Your payment details, as those are solely processed by the appointed payment providers as Independent Controllers. Payment providers provide the ESC Voting operator access to Your payment data (as listed above) to enable us to detect fraudulent or non-eligible votes or verify any refund request.

What are the Purposes of processing and what is the legal basis for this?

We collect Your personal data on the basis of the performance of a contract (Art. 6 Para. 1 (b) GDPR) and of our legitimate interest (Art. 6 Para. 1 (f) GDPR) for the purposes of (“Purposes”):

• calculating and generating valid and official results of the ESC on the basis of the votes cast by the audience (including Yours) to generate the official results determining the ranking of the songs entered in the ESC and the winner thereof;
• generating aggregated statistics on the voting in the ESC;
• publishing aggregated and anonymized results;
• payment of the votes casted via Paid Online Voting

Who will have access to your personal data?

We will share Your personal data with the following service providers acting as processors on our behalf with whom the ESC Voting operator has entered into a data processing agreement (DPA) in accordance with Article 28 GDPR and which will process Your data for different purposes such as hosting, content delivery etc.

External Hosting provider acting as processor

The Voting Platform is hosted by an external service provider (host). Personal data collected on the Voting Platform are stored on the servers of the host. Our provider will only process Your data to the extent necessary to fulfil the performance of its obligations and to follow our instructions with respect to such data

Content delivery network providers acting as processors

The information transfer between Your browser and the Voting Platform is technically routed via the content delivery network. This enables us to boost the global availability and performance capabilities of the Voting Platform.

Payment services providers acting as separate Independent Controllers

We integrate payment services of third-party companies on the Voting Platform. When You proceed with payment for Your votes, Your payment data (as listed above) are processed by the payment service providers as Independent Controllers for the purpose of payment processing. For these transactions, You acknowledge that Your personal data will be processed in accordance with those service providers own respective legal ground and privacy notice for which We have no responsibility. You acknowledge that payment providers will provide the ESC Voting operator access to Your payment data (as listed above) to enable us to detect fraudulent or non-eligible votes or verify any refund request.

Inside the ESC Voting operator

Your personal data is accessible to various staff members acting under the ESC Voting operator’s authority and in accordance with our instructions. Whilst the EBU and the Participating Broadcaster are joint controller with the ESC Voting operator with regard to the Paid Online Voting, the ESC Voting operator will not transfer Your personal data to them, and they will receive from the ESC Voting operator only anonymized results for the purposes listed above. Only the aggregated and anonymized results will be published.

Will personal data be transferred to a third country or an international organization?

Please note that whenever Your personal data is transferred to processors or third parties located in countries outside the European Economic Area, Switzerland or the United Kingdom, which are not considered by the European Commission to guarantee an adequate level of protection for personal data, we will ensure that appropriate measures are implemented according to the applicable national and European legislation relating to data protection. We will, in particular, use Standard Contractual Clauses approved by the European Commission to ensure adequate protection. For further information, including a copy of the documents used to protect your personal data, please contact us at privacy@once.net.

How long will my personal data be kept by us?

The ESC Voting operator will process and store Your personal data for as long as required to fulfil our contractual and legal obligations. Once the personal data is no longer required to fulfil contractual or legal obligations, it will regularly be erased unless its further processing – for a fixed period of time – is required for the following purposes including:

• fulfilment of commercial- and tax-law related storage obligations;
• compliance with the German Commercial Code (HGB), Tax Code (AO), Money Laundering Act (GwG). These laws generally specify storage periods for archiving and documentation purposes ranging from two (2) to ten (10) years.

Use of cookies

The Voting Platform uses essential cookies set by our payment service provider, Stripe, to ensure secure and efficient payment processing. These cookies are vital for maintaining the security and reliability of our payment systems. They help verify user identity, prevent fraud, and enhance security. Additionally, by analysing how users interact with our payment features, Stripe's cookies help optimize the security and functionality of our services.

These cookies are necessary for processing payments and therefore do not require prior consent. They cannot be disabled if you wish to use our payment services, ensuring continuous, secure transaction processing.

What are your rights?

You have the right to review Your personal data, and to request that they are corrected in the event of inaccuracy or deleted in the event that they are no longer necessary in relation to the purposes for which they were collected and processed.

In some cases, You have the right to ask for a restriction of processing, for data portability or to object to processing. Any consent You give to the processing of Your personal data by us may be withdrawn at any time. Please note that the withdrawal of consent will only apply for the future. Processing which took place before the withdrawal of consent will not be affected by it.

You may exercise your rights by sending your request by mail at privacy@once.net.

If You believe that the processing of Your personal data constitutes a violation of the Data Protection Laws, You have the right to file a complaint with a supervisory authority, in particular in the Member State of the European Union of Your usual place of residence, Your place of work or the place where the violation occurred.

How can you contact our Data Protection Officers?

If You have any questions or concerns about this Privacy Notice You may contact the ESC Voting operator’s Data Protection Officer at privacy@once.net.

Effective date and Changes

This Privacy Notice is effective from Thursday 12 February 2026. We reserve the right, at our complete discretion, to change, modify, add, or remove portions of this Privacy Notice at any time.

LIST OF PARTICIPATING BROADCASTERS IN THE ESC 2026 ACTING AS JOINT CONTROLLERS TOGETHER WITH THE EBU AND THE ESC VOTING OPERATOR