May my sports club share my data with sponsors?

A sports club is controller for member data — bound by GDPR. Sharing data with sponsors = separate processing = separate basis required (Art. 6). Membership signup does NOT count as consent for sponsor transfer. What is ALLOWED? (1) Aggregated data (total members, age distribution) — no personal data. (2) Specific opt-in question: "do you want targeted offers from our main sponsor X?" — free, specific, informed, unambiguous consent. (3) Match results + photos with sponsor mention if member agreed. What is NOT allowed? (1) Selling or giving membership list. (2) "Our sponsor will contact you" without prior consent. (3) Sharing email so sponsor sends own newsletter. (4) Profiling for sponsor targeting. What to do on overstepping? (1) Written question to board: basis + consent evidence. (2) Erasure request to sponsor itself (GDPR Art. 17). (3) AP complaint — club life is AP enforcement focus. (4) On WBTR impact: board members personally liable. Member rights: all regular GDPR rights apply also for club — access, erasure, objection.