Featuring Virgil van Dijk, Mohammed Kudus, Serge Gnabry and Kai Havertz.
AT ROOF WE WORK IN PARTNERSHIP TOGETHER WITH OUR CLIENTS TO UNLOCK THEIR FULL POTENTIAL, BOTH ON AND OFF THE PITCH.
SUCCESS ISN’T ACHIEVED ALONE,
IT IS BUILT THROUGH WORLD CLASS TEAM WORK.
Using our extensive and industry leading network we work closely with all of our clients to provide an unrivalled and world class service, supporting them on every step of their journey.
We are proud to represent some of the most exciting talents in world football.
We work with the very best players, coaches, managers, broadcasters and executives, supporting them across all areas of their life and career to allow them to focus on what matters most.
We believe responsibility extends beyond performance on the pitch.
Whilst we guide and support our clients throughout their professional careers, we also recognise the wider role football can play in society. We work alongside our clients and partners to support initiatives that create meaningful and lasting change, using the reach and influence of football to do this.
From local community programmes to international humanitarian projects, ROOF Charity is committed to raising awareness and directing resources where they are needed most. Together, we aim to demonstrate that football’s most lasting impact is often made beyond the game itself.
ROOF GmbH
Bavariafilmplatz 7
82031 Grünwald
Germany
Phone
+49 (0) 89/62189902
E-Mail
[email protected]
Managing Director
Thorsten Wirth, Steffen Asal, Daniel Delonga, Andreas Sadlo, Hannes Winzer, Tobias Sander, Björn Bezemer, René vom Bruch
Registry Court
Amtsgericht München
Registry Court Number
HRB 210859
VAT Number according to § 27a
DE 294491038
The controller in terms of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) is:
ROOF GmbH
Managing Director: Thorsten Wirth, Steffen Asal, Daniel Delonga, Andreas Sadlo, Hannes Winzer, Tobias Sander, Björn Bezemer, René vom Bruch
Bavariafilmplatz 7, 82031 Grünwald, Germany
Phone: +49 (0) 89/62189902
E-Mail: [email protected]
Data Privacy Officer: Dr. Philipp Wehler
c/o ROOF GmbH -Datenschutz-
Bavariafilmplatz 7, 82031 Grünwald, Germany
Email: [email protected]
Every time our website is accessed, our system automatically records information from the computer system which accesses it, logging the following data:
We never use this data to identify you personally or to create user profiles. We process the data only to the extent necessary for the presentation and optimisation of a functional website as well as our content and services.
The processing of personal data of our users normally takes place only with their consent. An exception applies in those cases where the data processing is permitted by law.
Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) to ensure system security and website functionality.
We only use cookies and similar technologies that are strictly necessary for us to provide the website you have chosen to visit. Under § 25(2) No. 2 TDDDG, we may therefore store these cookies on your device, and read them, without your consent.
Specifically:
The legal basis for any related processing of personal data is set out in the sections referred to above.
You can see the full list of cookies, who sets them and how long they last, and change your choices at any time, via “Cookie Settings” at the bottom of every page. You can also block or delete cookies in your browser settings, although some parts of the website may then not work properly.
We use Cookiebot, a service of Usercentrics A/S, Havneholmen 25, 1561 Copenhagen V, Denmark, to ask for and record your cookie choices. Cookiebot processes your IP address in shortened form, the date and time of your choice, browser information, the page you were on and a random consent ID. We are required to be able to prove the choices you have made (Art. 7(1) GDPR), so the legal basis is Art. 6(1)(c) GDPR, together with our legitimate interest in managing consent reliably (Art. 6(1)(f) GDPR). Consent records are deleted after 12 months. Usercentrics processes this data on our behalf under a data processing agreement and stores it in the EU.
When you contact us via email, we process:
Pre-contractual measures or legitimate interest in responding to your inquiry (Art. 6(1)(b) or (f) GDPR).
The processing of personal data from the input form is used solely for us to handle the contact request. The other personal data processed during the sending process is intended to prevent misuse of the contact form, and to ensure the security of our information technology systems.
Your personal data will be erased or blocked, as soon as the purpose for which it was stored no longer applies, as explained in the relevant sections below.
If you contact us by email and the nature of your message requires that we involve a third party, for example an affiliated group company in the USA or the UK, to reply to you, your message will be shared accordingly.
Safeguards: We may transfer your data to third-countries based on:
These third-countries may not provide the same level of data protection as the EU. You have the right to request copies of the safeguards we use for international transfers.
The user has the right to withdraw their consent to the processing of personal data at any time. In such cases, the conversation cannot be continued. To withdraw your consent, please click here.
In this event, all personal data that has been stored in the course of the contact will be deleted, unless we are legally obliged or permitted to keep the data.
The legal basis for the temporary storage of data and log files is Article 6 (1) point f) of the GDPR.
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. This requires the user’s IP address to be saved for the duration of the session. The IP address is recorded in the log file of the load balancer for 30 days. This ensures smooth operations and protection against attacks (e.g. DDoS).
Your IP address is normally not personal data for us. Your IP address is only personal data for us where we have a right to demand from your internet service provider your identity, for example because of illegal behaviour conducted by you.
The log files are stored centrally and deleted after 30 days.
The collection of data to present the website and storage of the data in log files is absolutely necessary for the operation of the internet presence.
You may object to this processing at any time under Art. 21(1) GDPR on grounds relating to your particular situation. If you do, we will stop processing your personal data for this purpose, unless:
We will assess each objection individually and let you know the outcome.
Our website is hosted by WPEngine, Inc., 504 Lavaca Street, Suite 1000, Austin, TX 78701, USA. As part of its hosting service, WP Engine delivers the website through the network of its sub-processor Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which speeds up the site and protects it against attacks, for example by filtering malicious traffic and blocking denial-of-service attacks. Cloudflare also hides the email addresses on our site from automated harvesting tools.
When you visit the website, WP Engine and Cloudflare process your IP address and the access data described in Section II.1 to deliver the website and keep it secure. The legal basis is our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR). WP Engine processes this data on our behalf under a data processing agreement and has bound Cloudflare to data protection obligations at least as protective as those in that agreement.
WP Engine and Cloudflare are based in the USA. Both are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). Our data processing agreement with WP Engine also includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy using the contact details in Section I.
If your personal data is processed, you are a data subject under the provisions of the GDPR and have the following rights that you can demand from your controller:
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed.
Where this is the case the data subject is entitled to obtain the following information from the controller:
The data subject is entitled to information on whether pertinent personal data is transferred to a third country or international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. Please also see the Right to data portability, pursuant to Article 20 GDPR.
The data subject shall have the right to obtain from the controller the rectification and/or completion of incorrect or incomplete personal data concerning him or her. The controller shall make the corrections without undue delay.
a) Right to be forgotten
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
b) Information to third parties
Where the controller has made the personal data public and is obliged pursuant to Article 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.
c) Exceptions
The right to be forgotten shall not apply to the extent that processing is necessary:
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
A data subject who has obtained restriction of processing on the basis of the above preconditions shall be informed by the controller before the restriction of processing is lifted.
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to haven the data transmitted to another controller, where:
In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point f) of Article 6 (1) GDPR.
The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, if the data subject considers that the processing of personal data relating to him or her infringes the provisions of GDPR. For your complaint you can contact any supervisory authority, i.e. of your permanent residence, your workplace or of our company headquarters.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.
To exercise these rights, please submit your request here, or contact us at: [email protected]
You have the right to lodge a complaint with a data protection supervisory authority in the EU, particularly in your country of residence, workplace, or where an alleged infringement occurred.
Der Bayerische Landesbeauftragte für Datenschutz, Wagmüllerstraße 18, 80538 München, Germany,
Website: https://www.datenschutz-bayern.de
Version Updated: October 2026
