Data Protection declaration of VfL Wolfsburg-Fußball GmbH (as of 08/07/2024)

A. Controller

This data protection declaration has been published by VfL Wolfsburg-Fußball GmbH, In den Allerwiesen 1, 38446 Wolfsburg, Germany,, entered in the commercial register held by the District Court of Braunschweig under No. HRB 100486. Any references in the following document to “VfL Wolfsburg”, “we” or “us” are references to VfL Wolfsburg-Fußball GmbH.

B. Processing your personal data

1. General information

This data protection declaration provides you as a fan, member, season ticket holder, contact of an organisation or company, event participant, user of our online media or as our customer who purchases or uses VfL Wolfsburg products and services with information on how your personal data is processed.

1.1. What are personal data?

Pursuant to Art. 4 (1) of the European General Data Protection Regulation (GDPR), personal data is any information from which conclusions could be drawn about your identity. Personal data includes your name (this refers hereinafter to your first and last names), your address (including your billing address and your delivery address), your telephone number, your email address, payment information, such as your IBAN or credit card number, and your date of birth. Personal data does not include information that cannot be directly associated with your actual identity (e.g. favourited websites or the number of users of a website).

1.2. Which activities does the term “processing” cover?

Data processing within the meaning of Art. 4 (2) GDPR is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

1.3. What does processing of personal data for the purpose of business transactions entail?  

VfL Wolfsburg processes personal data for the purpose of various business operations. For instance, this includes areas such as the sale of tickets, merchandising, memberships, events, general advertising or online media (VfL Wolfsburg’s website or email newsletter, etc.) that are outlined in detail in Clause B.2 below. Each of these business operations is implemented for at least one purpose. In case of the purchase of a VfL Wolfsburg product, this may be delivery and payment or, in case of events, for example, conducting of the event in question. Moreover, any operation through which personal data is processed has a basis in law, e.g. the need to prepare or perform a contract (Art. 6 (1) (b) GDPR) or the need to comply with a legal obligation to which VfL Wolfsburg is subjected (Art. 6 (1) (c) GDPR). In these instances VfL Wolfsburg will give information if an obligation on the basis of contract or law exists. Refusal to provide the data may lead to loss of an otherwise existing legal position or the impossibility to conduct the contract in the aspired form. Additionally, data is processed on the basis of a legitimate interest of VfL Wolfsburg following an appropriate balancing of interests (Art. 6 (1) (f) GDPR) or on the basis of consent (Art. 6 (1) (a) GDPR).

1.4. How long will VfL Wolfsburg store your personal data?

We will process and store your personal data for as long as it is necessary for the fulfilment of our contractual and statutory obligations. It should be noted that in the case of a season ticket contract, our business relationship is a continuing obligation over a number of years.

Data no longer needed for the fulfilment of contractual or statutory obligations is regularly deleted, except when further processing, such as storage is required – for a limited period and for the following purposes:

  • Compliance with the retention requirements stipulated in commercial and tax law: this includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention or documentation periods specified therein are between two and ten years.
  • Preservation of evidence in accordance with statutory limitation periods. According to sections 195 et seq. of the German Civil Code (BGB), these limitation periods can last for up to 30 years, though the standard limitation period is three years.

In these cases, we may store and, if necessary, use your data for a duration appropriate for these purposes even after our business relationship or our pre-contractual legal relationship has ended.

1.5. Further definitions

Stadium: covers all of VfL Wolfsburg’s sporting venues such as the Volkswagen Arena, the AOK Stadium, the VfL Stadium at Elsterweg and the Porsche Stadium.

Address: an address will be requested for many business operations. By default, this consists of your street, house number, postcode, place of residence and country.

Payment information: this includes account details such as your IBAN and BIC as well as credit card details (card number and card expiry date), depending on the forms of payment that are offered for the business transaction in question.

Tickets: this refers to tickets for all of our teams’ matches, in particular our men’s and women’s professional football teams and our U19 and U17 team.  

VfL website: this covers all of the websites operated by VfL Wolfsburg. As well as the main website and its sub-pages, e.g. Fans, Tickets, Shop and FußballWelt, this also includes the “WölfiClub” site,

Online shops: this refers to the online ticket shop and “Wölfeshop” (fan merchandise), which are accessible via

2. Processing operations through which personal data are processed

In the following, VfL Wolfsburg notifies you of the business operations through which it will register your personal data, the concrete purposes for which it processes these data and its legal basis for doing so. If you cannot find any specific information regarding the duration of storage, please refer to Clause B.1.4. If you have any queries, you may submit these to us in accordance with Clauses C and E of this data protection declaration. We have defined the following categories for individual business operations:

  • Tickets and merchandising
  • Memberships
  • Events
  • VfL-FußballWelt
  • Fans department
  • Payment methods and outstanding dept
  • Images from events
  • Sponsorship/licensee, supplier and merchant contacts
  • raffles and surveys
  • Online media and personalised advertising
  • Complaints management
  • Automated decision-making and profiling

2.1. Tickets and merchandising

2.1.1. Day ticket/season ticket and fan merchandise

When you purchase a day and/or an (away) season ticket for public and VIP areas or purchase merchandise, as your contract partner, we will collect your name and address, your gender in order to identify and address you correctly, and – where applicable – your customer number (optionally also your telephone number) as well as your payment information for this transaction. We provide you with further information on payment details in Clause B.1.5 and B.2.6. 

When you make a purchase via our online shops, with your VfL account or as a guest, we will also request your email address so that we can send you your order confirmation. We require your data in order to produce tickets, for merchandise and payment. This data is thus necessary for the execution of the purchase contract that has been concluded (Art. 6 (1) (b) GDPR). This includes season ticket subscription contracts and sponsorship contracts where a ticket or fan merchandise quota has been agreed. We will also notify you of any changes relevant to your contract, such as the price of season tickets for the new season. We will store your data in our system and record you as a contact in our system, including a personal customer number that we will communicate to you.

In order to grant discounts and to ensure that children are appropriately supervised, for discounted tickets for children up to the age of six or 15 years old, we will also request the date of birth of the ticket holder/user. Further discounted rates may also be claimed according to the ticket price list. Here, we will merely register an entitlement to a discount rate and not the specific reason thereof.

When you purchase daily passes or fan merchandise through our ticket booths on a match day or through our fan shops, your data will generally only be recorded if you wish to claim a discount as a member, for instance. You will find more information on membership in Clause B.2.2.

If you have purchased an away season ticket and thus have a guaranteed right of first presale for tickets for our away games, we will always request your email address, your date of birth and, where applicable, your customer number. Before every away game, we will ask you by email whether you wish to make use of your right of first presale.

If a season ticket subscription for our home matches consists of more than one season ticket, by selecting the “personalised season ticket” option, we will also collect the name and address of other ticket holders who are not our contract partners/subscription holders. If that ticket holder does not have full legal capacity, we will also collect the same personal data for a parent or legal guardian. Pursuant to Art. 14 GDPR, each ticket holder or his parent or legal guardian must be notified in writing – indicating the name and address of the subscription holder – that the aforementioned data has been provided to VfL Wolfsburg to issue a season ticket. VfL Wolfsburg will notify ticket holders of this following the conclusion of the season ticket subscription contract.

A service provider finishes football shirts on our behalf. If you would like your name printed on your football shirt, we will send this to our service provider for flock printing.

2.1.2. Replacement of match-day ticket and upcharge

If you wish to transfer your match-day ticket or your season ticket to a third party along with the associated contractual right to enter the stadium, you may request the production of a replacement match-day ticket through our online ticket shop. If this third party is not eligible for the discunted rate associated with your ticket, an upcharge can be paid, which will be taken into consideration when the replacement match-day ticket is issued. Payment information (see Clauses B.1.5 and B.2.6) will be requested for payment of the surcharge and for any fees arising.

2.1.3. Transfer of tickets through the VfL ticket exchange plattform

If a season ticket is successfully sold through the VfL ticket exchange for a specific match day within the scope of fulfilment of the season ticket subscription contract (Art. 6 (1) (b) GDPR), the ticket holder will be credited a portion of the overall price. This will be either in form of a voucher, or this amount will be credited to the ticket holder’s bank account. Depending on the form of reimbursement chosen, VfL Wolfsburg will also register the payment information of the season ticket holder for this transaction.

2.1.4. cashless payment within Volkswagen Arena

To access the services provided in the Volkswagen Arena you can use the VfL-Card, any bank card and your phones. The service provider Ingenico payment services GmbH is responsible for any transaction in question and processes any accruing personal data, such as the credit card and corresponding account information, the transaction account and if needed the customer´s signature. The information is necessary to ensure a smooth transaction and payment of the concluded contract about the acquisition of goods as stated in Art. 6 (1) (b) DSGVO.

The login details for your personal VfL account (see Clause B.2.10.2 for further details) are required for identification purposes in order to top up your VfL Card (girogo “GeldKarte”) with credit through our online shop. The system will subsequently request your ten-digit card number to ensure that your card is correctly topped up. The process of topping up a card and using it in the stadium is generally anonymous. In this case, we will only register your card number and the top-up/payment amount. If you pay your top-up amount by direct debit or credit card, we will register your payment information for this transaction and transfer these details to our payment service provider for completion of the transaction. We require this information for the execution of the contract concluded for the purchase of the VFL Card’s credit and the related payment (Art. 6 (1) (b) GDPR).

When you use your VfL Card for payment at the stadium kiosk, we will register the sales receipt and the number of the card used. VfL Wolfsburg is the system operator, while our stadium caterer is your contract partner.

Generally, all sales are processed anonymously. Our catering system processes exclusively card numbers and their corresponding receipts. Your personal data generated by your purchase through a VfL-card as a members’ card is stored in a separate ERP/information system. Merging the data is partly possible but will be refrained from except if its is necessary to produce a hospitality receipt on your request. If, after visiting our stadium, you request a receipt for hospitality expenses in connection with any purchases you have made, we will register the following data in order to issue you with your receipt: name, address, card number and your specified payment date. To provide you with a receipt more quickly, at your request, we will also register your email address. We will transfer your data including the transaction breakdown to the stadium caterer in order to issue a receipt for hospitality expenses and provide you with this.

2.1.5. Legal action with regard to unauthorised ticket resales

The resale of our match-day and season tickets on the unauthorised secondary market is prohibited according to Clause 10 of our General Ticket Terms and Conditions and violates the terms and conditions of the purchase agreement concluded. These regulations are not only issued and obeyed by VfL Wolfsburg but also by other clubs we are competing with. To detect, investigate and prosecute we not only communicate with other clubs about the responsible people behind the sales, we also have authorized a law firm to discover, pursue and take legal action against any violations. In case of any suspicions, VfL Wolfsburg will provide this law firm with the name, postal address, email address and, where applicable, the telephone number of our contract partner, so that further action can be taken. Moreover, the data for the ticket that has been unlawfully offered online will be registered as evidence on the basis of a balancing of interests pursuant to Art. 6 (1) (f) GDPR. In particular, this includes the assertion of legal claims, the warranty of stadium safety (fan group separation, assertion of prohibitions to enter the stadium) and maintenance of a social pricing structure.

2.1.6. Free autographs

We will register your name and address as the recipient for any order of free signed autographs (three autograph cards per person per season). We will process this data so that we can send you these signed autographs without any problems. Moreover, as part of processing this data, we will document the date on which we received your request, the date on which we sent the relevant signed autograph to you and which signed autographs (i.e. which VfL players) you have been sent.

This is to avoid duplicate orders that exceed the contingent to which each fan is entitled and to ensure that each fan is able to receive signed autograph cards free of charge once a year.

2.2. Memberships

Membership of our “WölfeClub” or “WölfiClub” offers you a large number of benefits and services, e.g. discounts and exclusive club events. In return, parents and legal guardians pay a WölfiClub membership fee for their children, while adult members pay a membership fee for the WölfeClub. When you sign up for a membership, VfL Wolfsburg will register your name, address and date of birth (and, in case of an online application, your email address) for the classification and recording of your membership status and for the issuing and handover of your personalised, non-transferable membership card and your welcome package. We also record your gender in order to identify and address you correctly. If you provide us with your telephone number (mobile and/or landline number), we will also be able to contact you this way. For payment of your annual membership fee, your payment information (in this case, specifically your account details such as your IBAN and BIC) will be processed and transferred to our payment service provider. In case of minors, we will also request the name, address and payment information (cf. Clause B.2.6) of a parent or legal guardian.

In regard to the “WölfiClub”, the welcome package includes a t-shirt. For this reason, we also require your child’s clothing size. This data is thus necessary for the preparation and fulfilment of the membership contract pursuant to Art. 6 (1) (b) GDPR. VfL Wolfsburg will administer your data within its systems and notify you of your membership number. Your membership number and name will be printed on your membership card so that you can claim your advantages and discounts from our cooperation partners.

Through the “Members’ board” initiative of the “WölfiClub”, in return for a fee, a member can display his details on a permanent small sign on the membership board in the Volkswagen Arena and thus show that he is a VfL Wolfsburg fan. The name of the member and further information (place of residence, date on which the member joined the club and the member’s favourite player) will be printed and hung up here. If you object to the publication of your sign on the member’s board, we will remove it. Please send us your objection, with “Objection Member’s Board” in the subject line, using the contact details provided under Clause E.

In order to send you material from the club and members’ information (“WölfiClub” magazine, “WölfeClub 55plus programme”, etc.) by post, we will forward your name, membership number and address to a service provider that will handle the printing and mailing process for us.

2.3. Events and activities

VfL Wolfsburg organises a wide range of events and activities, such as children’s events (“VfL-KidsDay”, “Mini-Wölfis”, the opportunity to act as a match mascot, children’s birthdays, etc.), “WölfeClub 55plus” events or the home game experience (where you get a closer look behind the scenes of a match day), training camps for the VfL football school, the VfL writing competition, VfL Kick-Off, VfL-FußballWelt events, guided tours of the arena as well as other events that require registration.

Personal data that we process:

The following data must be recorded for preparation and fulfilment of the contract concluded with you for participation in an event (Art. 6 (1) (b) GDPR):

As part of the registration process, we will register for correct identification and addressing purposes your child’s name, address, and gender, or your own name, address and gender as a participant, or as the contact of a participating organisation (e.g. companies, schools, nurseries) or group and – where necessary for events for which a fee is charged – your payment information for this transaction (see Clauses 1.5 and 2.6 for more details). For minors, we will also request the name, address and, where applicable, the payment information of a parent or legal guardian. We will also request contact details such as your telephone number and email address. We will indicate mandatory fields and information that can be provided voluntarily on the registration forms.

For some events, we will request further details from the participant:

  • Membership number and date of birth
  • Clothing size and lettering to be printed on the back of a football shirt
  • Parents’ seats
  • Playing position and name of the football club

In the “Other information” section on our registration forms, you may voluntarily provide us with information that may be important for you, your child or for us during the event. For example, some events include meals together or guided tours of the arena. If you are a vegetarian, for example, if your child has a specific food intolerance or if your mobility is limited, we can take this into account when putting together a meal or a program. Please note that for this purpose, you would need to provide your consent for us to process health data such as this pursuant to Art. 6 (1) (a) GDPR. As outlined in Clause C, you may revoke this consent at any time.

Processing for a specific purpose:

VfL Wolfsburg requires the aforementioned data to be able to conclude a contract with you to enable the planning, implementation, billing and evaluation of an event. We will register your aforementioned contact details to be able to confirm your registration, in case of any queries or to provide you with further information on the program or any last-minute changes. We record a telephone number in particular for children’s events where the parent or legal guardian is not present, so that they can be contacted immediately in the event of an emergency. Some events are for members only, are discounted for members or for specific persons, or are intended for certain age groups. For some events, you or your child will receive clothing such as a t-shirt or football shirt that should fit well and will feature your chosen lettering. If you hand your child over to our childcare service while you watch a VfL game, we will also request your seat number to ensure that we are able to contact you in case of an emergency. When registering for VfL football school camps, we will request the participant’s playing position so that we can take this into consideration when putting together teams. We will also register the name of your football club, since players from our partner clubs will receive a discount on the registration fee.

Forwarding of data to third parties and publication:

The personal data of pupils participating in the VfL writing competition will generally not be registered. The sole exception here is the publication of the names of the winners on our VfL-Wiki site (our online knowledge platform for pupils). Prior to publication, we will obtain consent from you or, if you are under 16, from your parents/guardians (Art. 6 (1) (a) GDPR), which may be revoked at any time. Please see Clause C of this data protection declaration for further details on the revocation process.

For the “Home Match Day Stadium Child” event series we will forward the name of the “stadium child” (the winner of the promotion) to our event partners, Autostadt GmbH, and to our partner radio station. Autostadt GmbH requires the name in order to account for the voucher provided and for tax reasons, in other words in the context of performing the contract (Art. 6(1) (b) GDPR). The partner radio station requires the name, age and town of the “stadium child” for its public reporting. We will obtain consent within the meaning of Art. 6(1) (a) GDPR for this purpose when the child is registered for the promotional event.

If we offer an event involving an external overnight stay or tour, we will forward the names of the participants to the establishment where we will spend the night so that it can register these names for billing purposes. Participants will be notified of the forwarding of this data during the registration process.We will forward your name and address for invoicing purposes to caterers who provide food and drink at our events and activities at their own expense. However, we will only do this if you are an invoice recipient. We will generally already notify you of this during the registration process but will do so at the latest before we forward your data.

Specific Business operations:

In order to be able to participate in the walking football sporting activity, when you register, you will be required to provide a statement from your doctor confirming your physical fitness. VfL Wolfsburg requires this information to confirm your suitability for this sporting activity. Walking football places a strain on the cardiovascular and musculoskeletal systems. We offer this sport to our WölfeClub members aged 55 and above. Your health is very important to us and it is essential for us to ensure that you do not damage your health by taking part. We also want to be able to help or assist you quickly in an emergency. Therefore, we store the information about your health that you provide voluntarily when you register, e.g. about allergies, medicines and conditions for the duration of your participation in walking football. This is subject to your consent (Art. 6(1) (a) GDPR), which you can withdraw at any time. Please see Clause C of this data protection declaration for further details on the revocation process.

If institutions or private individuals request VfL modules (e.g. a bouncy castle or goalposts) or our mascot “Wölfi”, the following data is required from a contact person for the performance of the contract (Art. 6(1) (b) GDPR), especially for billing, procedural matters and enquiries at short notice, e.g. the exact address for delivery or performance: name, address, telephone number and email address. When we rent modules we transfer the data to the provider of the module, who is responsible for the delivery and installation on site.

2.4. VfL-FußballWelt

The VfL-FußballWelt service does not just include your visit but also other event services such as guided tours of the arena (see Clause B.2.3) and other combined tickets featured in our service portfolio (e.g. combined visit to VfL-FußballWelt and the Volkswagen plant) that you can purchase from us.

To enable you to use all of the VfL-FußballWelt functions and options and to fulfill the user agreement concluded with you (Art. 6 (1) (b) GDPR), registration of the following personal data is required during your visit to VfL-FußballWelt:

  • Your name
  • Audiovisual data that arise during your use of the relevant exhibits
  • Statistics/scores arising during your use of the exhibits (number of foot contacts, pace, shooting speed, reaction speed, number of passes, number of correct decisions, number of goals scored)
  • Billing address in the event of payment by invoice

Personal data will only be collected if you opt to notify us of these for the fulfilment of the contract for your visit to VfL-FußballWelt. For this purpose, you can create a profile at the counter and associate the chip number of your RFID bracelet with this. You can use the RFID bracelet that we will provide you with to identify yourself at certain activity points. No personal data will be stored on this RFID bracelet. All of the data that you provide and your performance data will be stored in encrypted form on our servers in your profile for subsequent retrieval. This data can be retrieved over the internet, using your individual URL. To protect your data against third-party access, your first and last names are required as well as your personal URL for access to your data. Your data will be automatically deleted after a period of seven days. Your data will not be passed on to third parties.

In case of invoicing, your name and billing address will also be requested. This applies not only for group inquiries but also for all of our VfL-FußballWelt services/offers.

2.5. Services for fans and customers

2.5.1. VfL Fanclubs -  initiation and information

We will save the data of all members newly founding a VfL Wolfsburg official fan club (OFC) for this purpose. An important precondition for this is that you sign the OFC agreement and the anti-violence declaration. The chairman or deputy chairman of the OFC and VfL Wolfsburg will sign this agreement and also the declaration on behalf of the members of the official fan club.

To provide our services, we will save your name, email address and date of birth as an OFC member. Providing your address and telephone number is optional. Membership of an official fan club offers you significant advantages, e.g. advance ticket sales and notification of internal club information (please see the OFC agreement for further details). The aforementioned data is required for this purpose. The OFC will provide us with its members’ data at the start of each season and the second half of the season. This ensures that the data is updated and also deleted.

2.5.2. Fan-contact management and service

When you contact our Fans department or Service Centre, our staff will ask for and store your name and possibly also your telephone number and/or email address in order to process your enquiry (service contract within the meaning of Art. 6(1) (b) GDPR). This data is collected when you contact our Fans department for communication and/or information purposes, e.g. as part of the fan movement for our teams’ home and away matches and for our football social network (consisting of fans, the club and the city). Once a year, the employees of our Fans department will review whether your contact details are required for the abovementioned purpose. If this is no longer the case, your data will be deleted.

For fans with a handicap, we will simplify access to the stadium on request. In order to provide personalized car parking and wheelchair access, tickets at the stadium on home match days, we process the name and address of the person making the request. Only in exceptional cases is it possible to drive right up to the stadium past the security gates. We therefore require a medical certificate and the vehicle registration number to issue a security pass. The medical certificate contains particularly sensitive data about your health, so in order to process it we need your consent in accordance with Art. 6(1) (a) GDPR. We consider that you grant your consent when you send us the certificate. You can withdraw your consent at any time.

2.5.3. Special and additional train journeys

Our fan department will organise special and/or additional trains as necessary. As well as tickets for the away match, our fans can also purchase train tickets from us. Registration takes place exclusively via an online form. Train tickets and tickets for the game will be sent to the person who places the order by post. Shortly before the start of the journey, the person placing the order and any accompanying persons will be notified of any important organisational details for the journey. This applies in particular to the code of conduct that applies during the train journey, for any damage claims in case of any damage identified in the allocated train compartments and handling of image rights.

Within the scope of fulfilment of the contract (Art. 6 (1) (b) GDPR), the name, address, payment information (see Items 1.5 and 2.6) and the email address of the person placing the order will be collected. The names and email addresses of any accompanying persons will also be collected. All of the aforementioned data will be deleted following the organisational completion of a special and/or additional train journey.

2.5.4. Fanclub- and football tournament

Our Fans department organises annual football tournaments for the members of our official fan clubs. The applicant’s name, email address and telephone number will be collected for registration purposes. The players’ names and dates of birth will be collected from the team members. Whether we are allowed to take photos and/or record video footage of you during the event depends on your consent, which you can provide when you register. All of the collected data will be deleted once the event has ended. Any further processing of images and/or video footage will be in accordance with the declaration of consent provided (Art. 6 (1) (a) GDPR), which you may revoke at any time.

2.5.5. Support for away fans

As part of the support that we provide for away fans and communication with the away team’s football network (consisting of the club, the city and the police) on home match days, our Fans department requires the contact details of officials/contacts for handling various fan-related issues. The following data is required to communicate with the football network: function, name, telephone number and email address. This data will be forwarded within VfL Wolfsburg and to the relevant partners in Wolfsburg’s football network. Names and vehicle registration numbers will be collected for the purpose of controlling access for away fans. This data will also be forwarded to the Wolfsburg police. Within the scope of a balancing of interests (Art. 6 (1) (f) GDPR), it is necessary for us to process your data to safeguard legitimate interests of ourselves and of third parties. For security reasons, we are obliged to ensure that the two groups of fans remain separated and thus also to ensure transparency for the police in terms of the details for away fans’ arrival. The football network must be able to plan the fans’ arrival and to make rapid arrangements in case of any incidents on match day.

The data collected for external partners will be saved for any future cooperation. The data collected from away fans will be deleted once the event has ended.

2.5.6. complaints management

We will register and save any complaints that we receive in our Service Centre and analyse them to improve the quality of our operational processes. If it is possible to link this complaint with your contact details/your account, we will establish this link so that we can respond to your enquiry and to your complaint more effectively. In order to be able to provide you with feedback to your complaint, where applicable, we will also register your telephone number or your email address.

2.5.7 Away - season Ticket

Within the sale of away season tickets, we collect your contact details and the kind of requested category to provide a right to presale for a specific away game. The tickets will be issued through a direct debit procedure, to be able to do so we collect your bank information in accordance with Item 2.6. Minors will be asked to submit an prior agreement of a parent  or legal guardian. The data will be processed to conclude the away- annual pass – agreement (Art. 6 (1) (b) DSGVO). 

2.6. Payment methods and outstanding items

We offer you various means of payment regarding a purchase, rental, service or event contracts concluded with VfL Wolfsburg and will record your payment information pursuant to Clause B.1.5. 

For the completion of the payment process and thus for fulfilment of the contract (Art. 6 (1) (b) GDPR), in case of direct debit (SEPA direct debit, online or offline) or credit card payment, we will forward your payment information to our payment service provider for implementation of the transaction.

We will contact you if it is not possible to complete this payment transaction, e.g. because you have insufficient funds in your account or we have not received notification from you of a change to your payment information, or you currently have an amount outstanding to us. If we are still unable to reach you as of our third attempt within the scope of this reminder procedure, we will be forced to assume that you do not wish to be contacted. Only then will we forward your name and address and the payment information used to our business information service, which will pursue this payment on our behalf (Art. 6 (1) (f) GDPR, legitimate interest: enforcement of payment claims).

2.7. Images taken at events and at fan activities

If you take part in events and fan activities pursuant to Clauses B.2.3 and B.2.5 of this data protection declaration, photos may be taken and/or video footage may be recorded. We will store these images and/or video footage following the events. VfL Wolfsburg will use a selection of images and/or videos for the purpose of reporting on the events and activities in its print and online media or for advertising purposes. 

If we publish an image or video in which you appear, or transfer it a third party, we will obtain your consent (Art. 6 (1) (a) GDPR), e.g. when you register for an event, which you may revoke at any time: see Clauses C and E of this data protection declaration for further details. Special conditions apply for visits to our stadium on home match days. During the event, images and videos (e.g. photographs, livestreams, broadcasts and/or other audiovisual recordings) are made by VfL Wolfsburg and accredited third parties (e.g. journalists and freelance photographers) in order to document the event (e.g. press commentary, reporting, club history), for commercial use (e.g. image films for social media channels, flyers, posters, catalogues of fan merchandise and for use in the VfL Wolfsburg sustainability report) and on the basis of our overriding interest (Art. 6(1) (f) GDPR). The respective purposes are in our legitimate interest. You are referred to your right to object defined in Art. 21 GDPR.

2.8. Sponsorship/licensee, supplier and merchant contacts

Execution of contractually agreed services, such as the implementation of advertising services or the organisation of customised events, may entail processing of personal data (pursuant to Art. 6 (1) (b) GDPR) within the scope of provision of the required service(s). VfL Wolfsburg notifies the contract partner in advance about the type, scope and purpose of the data processing, e.g. when contractually agreed advertising materials, season tickets or seats in the stadium are personalised (with a company or individual name). If the data required exceeds the name and the address of the contract partner (in the case of legal entities, the details of contacts will be recorded), VfL Wolfsburg will notify the contract partner of this in writing in advance. The contract partner’s separate consent will be required for provision of the required service. An objection to processing at this time may result in an inferior service or even non-fulfilment of the contractually agreed obligation. Compensation claims may not be asserted in this respect.

VfL Wolfsburg administers the contact details of sponsors, licensees, merchants and suppliers in it ERP/information systems as creditors for the supply chain process. For this purpose, processing the name and contact details of contacts (such as email addresses and telephone numbers) is required within the scope of fulfilment of the contract pursuant to Art. 6 (1) (b) GDPR.

2.9. raffles and surveys

If you wish to take part in a raffle, the following data must be processed for the performance of the competition contract (Art. 6 para. 1 lit. b) GDPR): We use your name, address, date of birth and, if applicable, your email address or telephone number for the purpose of running the raffle, in particular for the purpose of notifying you of the prize, sending you the prize and any age verification. This data regarding the raffle is processed on the basis of consent (Art. 6 para. 1 lit. a) GDPR) and for the fulfillment of a (raffle-) contract (Art. 6 para. 1 lit. b) GDPR). You will find detailed information on data processing in each specific case in the terms and conditions of our craffle.

For individual competitions, we also work together with service providers who process the competition for us.

2.10. VfL Website and Online-Shop

2.10.1. Tracking-measures (e.g.. „Cookies“) 

It is perfectly possible to visit VfL Wolfsburg websites without giving us any information about your identity. In this case, we will only automatically collect the following log data: 

  • An anonymous cookie ID that does not enable the identification of your IP address (different requirements, which are indicated in Clause B.2.10.3, apply for the use of our email newsletter, which are referred to in the aforementioned item).
  • The operating system and web browser you are using, and your selected screen resolution
  • The date and time of your visit
  • The (sub-)webpages you visit on our website
  • The website from which you visited us

When first visiting our website, we will ask for your consent regarding performance cookies and cookies of third parties. By clicking the “okay” button you consent to the use of third party cookies. This consent can be revoked at any point with effect for the future pursuant to Clause E. By accepting the terms displayed on our cookie banner you consent to the following tracking measures (Art. 6 (1) (a) GSGVO). You can always revoke your consent by using our cookie consent manager. It is noted that the withdrawal does not negotiate the legitimacy of the processing in the time before the withdrawal. 

Specific tracking measures: 

Google Tag Manager:

We use Google Tag Manager to administer each tracking measure. The tool Tag Manager itself is a cookie-less domain and does not collect personal data in itself. The tool does trigger other corresponding tags, which may then collect personal data. Google Tag Manager does not use this data. If a deactivation on a domain or cookie level is initiated, it remains for all existing tracking-tags which were implemented with Google Tag Manager. For more information see  

Google Ads: We integrated the service “google ads” on our website. Google ads is a Google Ireland Limited service which aims to provide users with targeted advertisement. Google ads uses cookies and other browser technologies to analyze user behavior and to recognize users. Google ads collects information on visitor behavior on different websites. This information is used to optimize the relevancy of the ads, especially to show targeted ads for our products on different websites within the Google network. This involves e.g. Google search and other Google- or Google-daughter operated sites as well as sites from Google webpartners. The information is thus conveyed to Google and its partners. Further processing only happens if you consent to Google that your Google browser history may be linked to your Google account and information from that Google account may be used to personalize shown ads. Google ads also provides targeted ads on basis of behavior profiles and geographical location. Your IP-adress and other identifying features like your user-agent will be submitted to our service provider. 

If you are registered with a Google Ireland Limited service, Google ads can link your visit with your account. Even if you did not register or log in, the service provider may still see and save your IP-adress and other identifying features. In this case your data will be shared with the operator of Google ads, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Please not that processing through Google LLC located in the US is also possible. Please see information on processing your personal data through google at

Google Analytics: Google Analytics is a Google Inc web analyzer service. Data processing will be used for advertisement, market research or a needs-based design of our website. The information produced through Google Analytics Cookies about your use of our website will generally submitted and saved to a Google server in the US.

The thus transmitted IP-adress will not be merged with other Google data. We also extended Google analytics on the website with the code „anonymizeIP“. This guarantees the masking of your IP-adress to ensure that all data is processed anonymously. Only in exceptional cases will the full IP-adress be submitted to a Google server in the US, where it will be shortend nevertheless. Google will use this information on our behalf, to evaluate your usage of the VfL-websites, to gather reports about your website activities and to perform other services linked to website and usage and internet usage. To prevent your data being stored you can opt to change your cookie settings accordingly. Please note that this may result in limited usage of the available website functions. Additionally, you can prevent processing of data to google and the processing by google by downloading and installing the following Browser-Plug-in

Google analytics is used in accordance with the preconditions set by the German protection offices.  

Third-party provider information:

Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. 
Data protection declaration: 

Meta “Pixel”/ "Custom Audiences": We implemented the “Conversion-Pixel“ /. „Meta Custom Audiences“, a service provided by Meta Platforms Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Meta”), to produce so called Custom Audiences, to segment visitor groups for our online presence and to calculate and thus optimize conversion rates, especially when you interact with ads specifically shown in cooperation with Facebook Ireland Ltd.

A Java Script-Code is used to initially save personal data about the usage of the website. This includes your IP-adress, the used browser in question and the start or final website. It will check for saved Meta-Cookies, if you are among the targeted people, Meta will show you our ads correspondingly. Note in no case, either through meta or us, you will be personally identified. 

Through the usage of pixels in your browser, meta can recognize, if a Facebook-ad was successful, e.g. if following the ad, a contract was concluded online. Meta will provide us with the statistic data without reference to a specific identity. This enables us to analyze the ads´ effectiveness for statistic and research purposes. 

Please note, that in this context the possibility of processing by Meta Platforms Inc, located in the US, may occur.

The meta "conversion pixel" pixel is also connected to Google Analytics (see above) in such a way that data from the meta "conversion pixel" pixel can be enriched with data from Google Analytics.

AWIN “Pixel”: VfL Wolfsburg uses the tracking pixel by AWIN AG, Eichhornstraße 3, 107875 Berlin, Germany to be able to provide you with benefits (e.g. discount or credit)  when buying a product of our website. The AWIN-Pixel will only be used if you visited one of our partner websites and consented to the use of cookies by clicking on a VfL Wolfsburg banner ad. We will only process your tracked data if you have previously clicked on a VfL Wolfsburg advertising banner on one of our partner sites and have agreed to the use of cookies on this other site. The processing of the tracking data is carried out on the basis of our overriding interest in understanding the granting of advantages via partner sites and managing the contractual relationships with our partners and on the basis of a balancing of interests (Art. 6 para. 1 lit. f GDPR). The privacy policy of AWIN´s privacy protection declaration can be found here: 

Recova: In connection with the AWIN Pixel (see above), we also use the software solution of the visitor recovery service provider Exceed Solutions GmbH, Schanzenstr. 12b 20357 Hamburg.

Session data (URL, referrer URL, time of page view and redirection, content information on the user session (e.g. products in the shopping cart; product price; categories, delivery price, time of purchase, etc.), session ID for identification) are used to present other interesting products. Insofar as we store this information on your end device or retrieve it from it and process it further, this is done on the basis of consent pursuant to Art. 6 para. 1 sentence 1 lit a GDPR in conjunction with § 25 para. 1 TTDSG. The data is stored for 40 days.

If we process this data on the basis of consent, you have the right to withdraw your consent at any time with effect for the future. This means that the lawfulness of the processing that has taken place on the basis of the consent until the revocation is not affected. The declaration of revocation can be made informally and does not require any justification. You can revoke your selection at any time via "Cookie settings" at the bottom of our website.

You can find all other information on Exceed Solutions GmbH relevant to data protection law at

etracker: We use the services provides by etracker GmbH from Hamburg, Germany ( to analyze user information. Etracker does not use Cookies for its Web-Analysis and the data will be exclusively processed within Germany.   

Data processing is carried out on the basis of of Art. 6 (1) (f) (legitimate interest) of the General Data Protection Regulation (GDPR). The interest within the meaning of the GDPR (legitimate interest) is the optimisation of our online offer and our website. Since the privacy of our visitors is important to us, the data that may allow a reference to a single person, such as the IP address, login or device identifiers, will be anonymized or pseudonymized as soon as possible. There will be no other use, merging with other data or passing it on to third parties.

You can object to the data processing described above at any time by clicking on the slider. The objection has no negative consequences. If no slider is displayed, data collection is already prevented by other blocking measures.

Further information on data protection at etracker can be found at

(further) Retargeting-technologies: To create needs-based advertisements VfL Wolfsburg produces pseudonymized user profiles to executed online campaigns in a way that fits its designated purpose. When pseudonymizing the data the name and other identifying criteria is replaced by an indictator to hinder or complicate identification by a third party. Cookies are used for this purpose, while collecting information about your activity on the visited websites (specific surfing behaviour, visited subpages of internet offers, clicked advertising banners etc.) Most web-browsers are defaulted to automatically have all cookies accepted.  

At any point you can revoke your consent to the creation of a pseudonymized user profile by adjusting your browser settings so that no or only specific cookies are enabled or so that you get notified if cookies are activated. Please note that this may result in limited usage of the available website functions.

Please see further information regarding cookies under or on the VfL Website.

2.10.2. VfL online account

To use the various services provided on the VfL-Website you can create an online-account for which we will collect the following data from you: e-mail-adress and user name, your name and address, since you will be able to purchase tickets, merchandise and other services through your account, as described in Clause B.2.1. We ask you to provide your date of birth to ensure you are above the age limit of 16 years and thus are legally permitted to open an account. If you voluntarily share your gender and your phone number, we will be able to correctly identify and address you, as well as contact you via phone communication. We naturally ensure that we do not know nor save your personal password. 

You can use your online-account to quickly and effortlessly buy tickets or merchandise, view your order history (if you chose to enable the link) or inquire about new credit for your VfL-Card. 

At any point you can request to have your account deleted, please submit your wish to the contact details described in Clauses A & E or to

The necessary care, maintenance, support, backup and recovery of your online media, databases and server is performed by IT- service providers, e.g. Hoster, by web-designers and multimedia-agencies. In this capacity they function as designated data processors.

2.10.3 accessible website 

To provide website content that is as accessible as possible, we are working on integrating a text-to-speech tool by Readspeaker, an intonation-service for internet content. By clicking on the “read aloud” button the corresponding text will be submitted via the User-IP to the ReadSpeakter-Server where an audio file is generated and then transferred back to the User-IP. Directly after the extradition of the File the data trail and the IP-adress is deleted from the ReadSpeaker-server. ReadSpeaker does not collect and save personal data, all services are realized in Europe (Sweden).

2.10.4. Social Media Plugins

We do not integrate Social-Media-PlugIns, which make it necessary to transfer your personal data directly to the social media provider when you visit our website. However, you have the option of clicking on the social media buttons to go directly to our website with the respective provider. As you leave our website and start a connection with the respective social media provider as soon as you click on the button, we would like to point out that the processing of your personal data by the social media provider is outside our responsibility under data protection law.

To display social media content on our website, we use the service Flockler, Flockler Oy Rautatienkatu 26 B 32, 33100, Tampere Finland, which aggregates relevant social media channels and displays them on our website. The privacy policy and further information about this service provider:

2.10.5. Termine und Kalender

We use the service calovo, calovo GmbH, Grafenberger Allee 32, 40237 Düsseldorf, to integrate event data on our website. If you would like to subscribe to the relevant service (e.g. to add VfL matches to your smartphone calendar), you will be taken to the service provider's website where you can subscribe. The privacy policy and further information about this service provider:

2.10.6. YouTube

Our website uses the provider YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for the integration of videos. The integration of videos is in the interest of an appealing presentation of our online offer and a high-performance provision of videos. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR.

Normally, when you access a page with embedded videos, your IP address is sent to YouTube and cookies are installed on your computer. However, we have integrated our YouTube videos with the extended data protection mode (in this case, YouTube still contacts Google's DoubleClick service, but according to Google's privacy policy, personal data is not evaluated). This means that YouTube no longer stores any information about visitors unless they watch the video. If you click on the video, your IP address is transmitted to YouTube and YouTube is informed that you have watched the video. If you are logged in to YouTube, this information will also be assigned to your user account (you can prevent this by logging out of YouTube before watching the video).

We have no knowledge of and no influence on the possible collection and use of your data by YouTube. You can find more information in YouTube's privacy policy at

2.11. further media and personalized advertisement

2.11.1. Signing up for our email newsletter

We need your e-mail address to register you. You can tell us your name, but you do not have to, unless you subscribe to the newsletter as part of creating an online account. If you provide us with your name, we will use it to address you personally.

After submitting the registration form, you will receive a confirmation e-mail from us. The registration only becomes effective once you have clicked on the link in the confirmation email. You can unsubscribe from the newsletter at any time. To do this, you can use the unsubscribe link at the end of each newsletter. Your e-mail address will then be deleted from the distribution system immediately.

We carry out the above processing on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR. We carry out the following processing of data for the purposes of market research, targeted advertising and to tailor the content of our newsletter to your needs:

  • If you open e-mails from us, click on links contained in them or submit a website form after clicking on a link, this is detected and this information is stored in your profile.
  • When you open e-mails from us or click on links contained in them, it is determined and stored which topics are of interest to you.
  • When you retrieve images in emails or click on links, the type of device used is determined and stored in your profile.
  • If you retrieve images in emails or click on links, the location from which the retrieval is made is determined by assigning your IP address and this is stored in your profile.
  • If the newsletter cannot be delivered because your email address has been deactivated, your mailbox is full or for other reasons, this will be determined and this information will be stored in your profile.

Receipt of the newsletter is only possible under the conditions listed above. If you do not want us to carry out such processing, please do not register for the newsletter or unsubscribe from the newsletter if you have already registered.

If you have registered for the newsletter, you have given the following declaration of consent:

Yes, I would like to subscribe to the free e-mail newsletter of VfL Wolfsburg-Fußball GmbH with content tailored to me personally and individualized advertising with the help of profiling. I have read the detailed description of profiling in the privacy policy and agree to the data processing described therein.

Right of withdrawl

You can withdraw your consent at any time by unsubscribing from the newsletter. A link to unsubscribe from the newsletter is included in every email, or by sending an email to with the subject "Withdrawal of consent" or by sending the withdrawal to the contact details provided in the legal notice or in the privacy policy.

You can revoke your consent at any time for the future.

We use a service provider to send the newsletter. Beyond this, your data will not be passed on to third parties. We store your data and the results of the surveys listed above in your profile for as long as you are subscribed to the newsletter.

You can unsubscribe from the newsletter at any time, either by sending a message to the contact option provided at the end of this privacy policy or via the link provided in the newsletter.

2.11.2. Customised advertising and market research

If you wish to receive information on our products, you may request receipt of this advertising online and/or offline by submitting a declaration of consent to the receipt of customised advertising and market research. Within the scope of your consent pursuant to Art. 6 (1) (a) GDPR, the following data will be processed for the purpose of the delivery of advertising: your name and, depending on your chosen method of communication, your email address, telephone number, mobile telephone number (contact via mobile phone, text message and/or WhatsApp Messenger) and/or your Facebook user account (contact via Facebook Messenger).

VfL Wolfsburg uses the double opt-in procedure to obtain your consent for the purpose of online communications. An email will be sent to the email address that you have provided asking you to confirm your consent.

You may unsubscribe at any time by sending a message to the contact details provided at the end of this data protection declaration.

Please remember that, if you choose WhatsApp Messenger or Facebook Messenger as a method of communication, your data will be processed outside of Europe, e.g. in the United States of America. Please note the following Item 2.10.5 in this respect. If you would prefer to avoid this processing, we offer you alternative methods of communication, as outlined above.

In the context of balancing interests (Article 6 (1) (f) GDPR), as necessary, we will process your data beyond the actual fulfilment of the contract in question in order to safeguard our legitimate interests or those of third parties.


  • Preparing, organising and processing marketing and market research activities across various channels, in order to look after our existing customer base, to acquire new customers and for the ongoing improvement of the overall VfL Wolfsburg-Fußball GmbH service portfolio,
  • Advertising or market and opinion research, unless you have objected to the use of your data,
  • Verifying and optimising needs-analysis processes for the purpose of direct customer notification,
  • Performing statistical evaluations or market analyses,
  • Measures for managing the business and enhancing services and products,
  • Enriching your profile by one or more service providers by means of probabilities based on statistical analysis and official records (for more details see 2.10.8) to optimise our form of address and improve our services. These characteristics will only be used for your benefit and explicitly not to your disadvantage. For example we will use these characteristics to suppress advertising that does not interest you. Furthermore, we will optimise our service offerings with the help of these characteristics.

2.11.3. Messaging services

If you have given VfL Wolfsburg your consent, you can receive messages and information from VfL Wolfsburg via the messaging services. To do this, you may need a messaging account with the respective provider. The respective data protection provisions of the messaging service provider then apply.

Your data will be stored by VfL Wolfsburg for as long as you are registered to receive messages.

Messages that you send to VfL Wolfsburg via a messenger are read and replied to by specially appointed employees and are therefore not confidential. The registration and deregistration for the receipt of messages and information differs depending on the messenger:

Individual Services


Broadcast channel

Instagram Broadcast channels are public channels that users can subscribe to. Private individuals can follow these channels and be informed about certain topics from us and thus stay up to date. Channels are therefore an optional, one-way broadcast function in Instagram. You can view and react to these so-called channel status messages and follow certain channels as a subscriber. Non-subscribers can also view and respond to channel status messages.

You can find more information about WhatsApp channels at:

VfL Wolfsburg collects your profile picture, if you have created one, any other profile information that you make publicly available and the reaction to our posts.

We do not see your telephone number. Other users viewing a channel cannot see whether you are following a channel or see any information from you. As soon as you are no longer a subscriber to our channels, we no longer have direct access to your profile and the data stored there.

Participation in our channels is voluntary. You can control whether you subscribe to a channel and can also leave it independently at any time. We therefore process your data within the scope of your consent, which you declare by voluntarily participating in our channel, in accordance with Art. 6 para. 1 lit. a GDPR.


To use the following WhatsApp services, you must already have a WhatsApp account. Within the EU, the services are provided by WhatsApp Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. You have therefore already concluded a contract of use with this company. As part of the use of our WhatsApp services, WhatsApp Ireland Ltd. processes personal data for the technical provision of services and possibly for other purposes of its own that are beyond our knowledge. The terms of use and general terms and conditions of WhatsApp, which you agreed to when creating a WhatsApp account, include, among other things, that you grant WhatsApp Inc, 1601 Willow Road, Menlo Park, California 94025, access to your telephone number and the contacts stored on your phone. The data may be stored on WhatsApp's servers in the USA. VfL Wolfsburg has no influence on this. WhatsApp Ireland Ltd. is responsible for this under data protection law. Further information on this can be found in WhatsApp's current privacy policy at Specific information on data protection and privacy in connection with WhatsApp communities can be found at

Our responsibility under data protection law in connection with the use of our WhatsApp community is limited to the data that we process for our own purposes and to these purposes.

If you have any concerns about using WhatsApp, you can alternatively use the email newsletter, for example.

Direct message newsletter

To register, we need your mobile phone number. You can tell us your name, but you don't have to. If you give us your name, we will use it to address you personally. We therefore process your telephone number, your user name (first name and surname if applicable), your profile picture, your user device and all messages sent to the service.

VfL Wolfsburg uses the opt-in procedure for registration. As a first step, you can save the WhatsApp number of VfL Wolfsburg in your smartphone. As a second step, you can send us a message with the word "Anpfiff". You can unsubscribe from the newsletter at any time. To do this, send us a message with the word "Abpfiff". The data you entered when ordering will then be deleted from the distribution system immediately.

Boradcast Channel

WhatsApp channels are public channels that users can subscribe to. Private individuals can follow these channels and be informed about certain topics from us and thus stay up to date. Channels are therefore an optional, one-way broadcast function in WhatsApp. You can view and react to these so-called channel status messages and follow certain channels as a subscriber. Non-subscribers can also view and respond to channel status messages.

You can find more information about WhatsApp channels at:

VfL Wolfsburg collects your profile picture, if you have created one, any other profile information that you make publicly available and the reaction to our posts. We do not see your telephone number. Other users viewing a channel cannot see whether you are following a channel or see any information from you. As soon as you are no longer a subscriber to our channels, we no longer have direct access to your profile and the data stored there.

Participation in our channels is voluntary. You can control whether you subscribe to a channel and can also leave it independently at any time. We therefore process your data within the scope of your consent, which you declare by voluntarily participating in our channel, in accordance with Art. 6 para. 1 lit. a GDPR.


WhatsApp Communities is a functionality offered as part of the WhatsApp messenger service for better organization of groups and addressing of group members. WhatsApp Communities is primarily, but not exclusively, intended for use by commercial users. You can find more information about WhatsApp Communities in the WhatsApp help section at

VfL Wolfsburg collects the telephone number under which you are registered with WhatsApp, your profile picture, if you have created one, any other profile information that you make publicly available, the content of the messages that you create within the community or send directly to us. We primarily process data in order to provide you with information within the community. As part of our community administration, we have the option of deleting inappropriate posts. If necessary, we may also be legally obliged to do so. In justified individual cases, we can therefore also delete posts from our Community members. As soon as you are no longer a member of our communities, we no longer have direct access to your profile and the data stored there. Contributions that you have posted in our community or in the groups there will remain stored until we delete them on a regular basis. We carry out this deletion annually for posts that are older than 6 months.

Participation in our community and the groups it contains is voluntary. You can control whether we can add you to our community and you can also leave it independently at any time. We therefore process your data within the scope of your consent, which you declare by voluntarily participating in our community, in accordance with Art. 6 para. 1 lit. a GDPR.


The "Signalize" service of etracker GmbH from Hamburg, Germany ( uses a function of your Internet browser or mobile operating system to provide you with notifications, if you have activated it. Data collected for the sending of messages, which may have a personal reference, is anonymized as soon as possible and then stored exclusively as anonymous data that does not allow any conclusions to be drawn about a specific person. This data is only processed in order to deliver the notifications you have subscribed to and to make notification-related settings. We ask for your consent to store this data. The legal basis for data processing in this case is Art. 6 para. 1 lit. a GDPR. You can object to receiving notifications at any time via the settings of your browser or mobile device. You can find information on how to unsubscribe from push notifications here.

In order to make the content of the push notifications meaningful for you, we use the preferences collected on the basis of an anonymous user profile using cookies and merge your notification ID with the user profile of the website solely for the purpose of sending personalized messages. The tracking technology is also used for statistical analysis of the notifications on our behalf. This makes it possible to determine whether a notification was delivered and whether it was clicked on. The data generated in this way is processed and stored exclusively in Germany.

Data processing to control the invitation to the notification service and to statistically analyze the registration or rejection is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR in order to make the notification service user-friendly and effective. Here, too, the data that may allow a reference to an individual person, such as the IP address, login or device identifiers, are anonymized as early as possible. This excludes the possibility of direct personal references. No other use, merging with other data or forwarding to third parties takes place.

You can object to the data processing described above at any time by clicking on the slider. The objection has no negative consequences. If no slider is displayed, data collection has already been prevented by other blocking measures.

2.11.4. Social media channels and fan pages

In this section we tell you about processing your personal data in regard to your usage of  VfL Wolfsburg’s social media channels and fan pages on Instagram, Facebook, Google+, YouTube and Twitter. 

The fan page or social media channel that you visit gives you the opportunity to react to our articles, comment on them, write a user post yourself and send us private messages with personal enquiries. The data that you provide and which may be accessible to us in this context (e.g. user name, address, date of birth, pictures, interests) are only used by us for the purpose of communicating with customers and potential customers on the basis of an overriding legitimate interest (Art. 6(1) (f) GDPR). Our interest is to offer you a platform on which we show you current information and which enables you to send us your enquiry and us to respond to it as quickly as possible. Your enquiry is processed by means of a data processor. To the extent that we are able to do so, your data will be deleted when the fan page ceases operation. 

In its ruling of 5 June 2018 ( the European Court of Justice confirmed that the operator of the fan page and Facebook are joint controllers. VfL Wolfsburg concurs with this ruling and applies it to all the social media channels and fan pages it operates. Provider-specific information on data processing can be found in their respective privacy policies at: 

Facebook Ireland Limited, 4 Grand Canal Square, Dublin2, Ireland, 

Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA,

Meta Platforms Inc. 1 Meta Way, Menlo Park, CA 94025, USA,

Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA,

Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA,

VfL Wolfsburg also uses a social media management tool from another service provider on the basis of overriding legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR and an order processing contract pursuant to Art. 28 para. 3 GDPR. The tool is used at VfL Wolfsburg for the purpose of planning and writing posts for the social media channels and fan pages used, monitoring channels and fan pages, conducting market research and statistical analyses and optimizing our communication strategy on this basis. With the help of the tool, we can publish network-, platform- and channel-specific content, process user reactions, search the social networks and platforms for mentions and analyze all interactions with us and our measures.

Every time you interact with our online presences within social networks and fan pages, the data that is stored in the profiles you use is saved. These are, for example, name, gender, profile picture, profile URL, handle/user name. The times of your interactions with our online presences are also recorded.

Please note that providers such as Facebook or Instagram may use their own tracking tools and cookies independently of the use of the fan page by VfL Wolfsburg. You can also find information on this in their privacy policies.

3. Further information

3.1. Data enrichment by third parties

VfL Wolfsburg reserves the right to enrich your data using service providers from the direct and geomarketing sector. Your master data will be supplemented by probability values on the basis of statistical surveys and official directories in order to be able to send you even more tailored advertising (legal basis Art. 6 para. 1 lit. f GDPR). This includes data from the areas of socio-demographics (e.g. purchasing power, age, family structure), interests (e.g. affinity for sport, affinity for bonus programs, affinity for green electricity), building information (e.g. number of households, building age, location), technology (e.g. Internet use, willingness to switch landline/Internet providers, Internet speed) or generational typology.

3.2. Automated decision-making and profiling

In principle, we do not use fully automated decision-making in accordance with Article 22 GDPR to establish and conduct the business relationship. If we use these procedures in individual cases, we will inform you of this separately if this is required by law.

We sometimes process your data automatically with the aim of evaluating certain personal aspects (profiling). For example, we use profiling in the following cases:

  • Due to legal requirements, we are obliged to combat money laundering, terrorist financing and criminal offenses that endanger assets. This also involves evaluating data (e.g. in payment transactions). These measures also serve to protect you.
  • We use evaluation tools to provide you with targeted information and advice on products. These enable needs-based communication and advertising, including market and opinion research; for more information, see section 2.10.4
  • We use scoring to assess your creditworthiness. This involves calculating the probability that a customer will meet their payment obligations in accordance with the contract. The calculation may include, for example, income, expenditure, existing liabilities, occupation, employer, length of employment, experience from the previous business relationship, contractual repayment of previous loans and information from credit agencies. The scoring is based on a mathematically and statistically recognized and proven procedure. The calculated score values help us to make decisions when concluding product contracts and are included in ongoing risk management.

3.3 Transfer to third countries

If we transfer your personal data to processors or other controllers in countries outside the European Economic Area (EEA) (e.g. in the USA), we implement the legally required standards and security mechanisms.

When using the services of YouTube and Google, personal data is transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When using Meta services (including Facebook, Instagram, Threads), personal data is transferred to Meta Platforms Inc. 1 Meta Way, Menlo Park, CA 94025, USA.

In the context of the use of Twitter services (including "X"), personal data is transmitted to Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

In the context of the use of Microsoft services, personal data is transmitted to Microsoft Corp. One Microsoft Way Redmond, WA 98052-7329. USA.

The US-based companies mentioned in this privacy policy have also been certified in accordance with the EU-US Data Privacy Framework (EU-US-DPF), for which the EU published an adequacy decision on July 10, 2023, e.g:

  • Google LLC.
  • Meta Platforms Inc.
  • Twitter Inc.
  • Microsoft Corp.

C. Your rights

You can assert the following rights against VfL Wolfsburg at any time free of charge:

Right to information in accordance with Art. 15 GDPR in conjunction with. §§ Sections 29, 34 Federal Data Protection Act (BDSG): You have the right to receive information from us about the processing of your personal data.

Right to rectification in accordance with Art. 16 GDPR: You have the right to obtain from us the rectification of inaccurate or incomplete personal data concerning you.

Right to erasure in accordance with Art. 17 GDPR in conjunction with § Section 35 BDSG: You have the right to request the erasure of your data if the conditions specified in Art. 17 GDPR are met. For example, you can request the erasure of your data if it is no longer necessary for the purposes for which it was collected. You can also request erasure if we process your data on the basis of your consent and you withdraw this consent.

Right to restriction of processing in accordance with Art. 18 GDPR in conjunction with § Section 35 BDSG: You have the right to request the restriction of the processing of your data if the requirements of Art. 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can then request the restriction of processing for the duration of the verification of the accuracy of the data.

Right to object: If the processing is based on an overriding interest or your data is used for the purpose of direct marketing, you have the right to object to the processing of your data. An objection is permissible if the processing is either in the public interest or in the exercise of official authority or on the basis of a legitimate interest of VfL Wolfsburg or a third party. In the event of an objection, we ask you to inform us of your reasons for objecting to the data processing. You also have the right to object to data processing for direct marketing purposes. This also applies to profiling insofar as it is related to direct advertising.

Right to data portability under Art. 20 GDPR: If the data processing is based on consent or contract fulfillment and is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data processor.

Right to withdraw consent: If data processing is based on consent, you have the right to withdraw your consent to data processing with effect for the future at any time free of charge at or via the contact details provided in the legal notice. Please note that even in the event of revocation, processing of your data on a legal basis is not excluded.

Right to lodge a complaint pursuant to Art. 77 GDPR: You also have the right to complain to a supervisory authority (e.g. the State Commissioner for Data Protection of Lower Saxony) about our processing of your data.

To assert your rights, please use our online form regarding data subject rights available under:

D. Changes to this privacy policy

We reserve the right to update this Privacy Policy from time to time. Updates to this Privacy Policy will be published on our website. Changes will apply from the time they are published on our website. We therefore recommend that you visit this page regularly to check for any updates.

E. Your contact persons for data protection

VfL Wolfsburg-Fußball GmbH is your first point of contact for all data protection-related concerns and for exercising your rights. However, you also have the option of contacting our Data Protection Officer directly at Data Protection Officer of VfL Wolfsburg-Fußball GmbH, Volkswagen AG, Berliner Ring 2, P.O. Box 8091, 38440 Wolfsburg or via

We recommend that you first address your request to our direct contact person:

VfL Wolfsburg Fußball GmbH
“Data protection“
In den Allerwiesen 1
38446 Wolfsburg

Data protection declaration of VfL Wolfsburg-Fußball GmbH