Data protection statement of VfL Wolfsburg-Fußball GmbH (as of 25 May 2018)
A. Responsible entity
This data protection statement has been published by VfL Wolfsburg-Fußball GmbH, In den Allerwiesen 1, 38446 Wolfsburg, Germany, email@example.com, entered in the commercial register held by the District Court of Braunschweig under No. HRB 100486. Any references in the following document to “VfL Wolfsburg”, “we” or “us” are references to VfL Wolfsburg-Fußball GmbH.
B. Processing your personal data
1. General information
This data protection statement provides you as a fan, member, season ticket holder, contact of an organisation or company, event participant, user of our online media or as our customer who purchases or uses VfL Wolfsburg products and services with information on how your personal data are processed.
1.1. What are personal data?
Pursuant to Art. 4 (1) of the European General Data Protection Regulation (GDPR), personal data are any information from which conclusions could be drawn about your identity. Personal data include your name (this refers hereinafter to your first and last names), your address (including your billing address and your delivery address), your telephone number, your email address, payment information, such as your IBAN or credit card number, and your date of birth. Personal data do not include information that cannot be directly associated with your actual identity (e.g. favourited websites or the number of users of a website).
1.2. Which activities does the term “processing” cover?
Data processing within the meaning of Art. 4 (2) GDPR is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
1.3. What does processing of personal data for the purpose of business transactions entail?
VfL Wolfsburg processes personal data for the purpose of various business transactions. For instance, this includes areas such as tickets, merchandising, memberships, events, advertising or online media (VfL website or email newsletter, etc.) that are outlined in detail in Item 2. Each of these business transactions is implemented for at least one purpose. In case of the purchase of a VfL product, this may be delivery and payment or, in case of events, for example, the holding of the event in question. Moreover, any operation through which personal data are processed has a basis in law, e.g. the need to prepare or perform a contract (Art. 6 (1) (b) GDPR), the need to comply with a legal obligation to which VfL Wolfsburg is subject (Art. 6 (1) (c) GDPR), on the basis of a legitimate interest of VfL Wolfsburg following an appropriate balancing of interests (Art. 6 (1) (f) GDPR) or on the basis of consent (Art. 6 (1) (a) GDPR).
1.4. How long will VfL Wolfsburg store your personal data?
We will process and store your personal data for as long as is necessary for the fulfilment of our contractual and statutory obligations. It should be noted that in the case of a season ticket subscription contract, our business relationship is a continuing obligation over a number of years.
Data that are no longer needed for the fulfilment of contractual or statutory obligations are regularly deleted, except when they require further processing – for a limited period – for the following purposes:
- Compliance with the retention requirements stipulated in commercial and tax law: this includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention or documentation periods specified therein are between two and ten years.
- Preservation of evidence in accordance with statutory limitation periods. According to sections 195 et seq. of the German Civil Code (BGB), these limitation periods can last for up to 30 years, though the standard limitation period is three years.
Required to fulfil the purposes listed. In these cases, we may store and, if necessary, use your data for a duration appropriate for these purposes even after our business relationship or our pre-contractual legal relationship has ended.
1.5. Further definitions
Stadium: covers all of VfL Wolfsburg’s venues such as the Volkswagen Arena, the AOK Stadion, the VfL-Stadion am Elsterweg and the Porschestadion.
Address: an address will be requested for many business transactions. By default, this consists of your street, house number, postcode, place of residence and country.
Payment information: this includes account details such as your IBAN and BIC as well as credit card details (card number and card expiry date), depending on the forms of payment that are offered for the business transaction in question.
Tickets: this refers to tickets for all of our teams’ matches, in particular our men’s and women’s professional football teams and our U23 team.
VfL website: this covers all of the websites operated by VfL Wolfsburg. As well as the main website www.vfl-wolfsburg.de and its sub-pages, e.g. Fans, Tickets, Shop and FußballWelt, this also includes the “WölfiClub” site, www.woelficlub.de.
Online shops: this refers to the online ticket shop and “Wölfeshop” (fan merchandise), which are accessible via www.vfl-wolfsburg.de.
2. Processing operations through which personal data are processed
In the following, VfL Wolfsburg notifies you of the business transactions through which it will register your personal data, the concrete purposes for which it processes these data and its legal basis for doing so. If you cannot find any specific information regarding the duration of storage, please refer to Item 1.4. If you have any queries, you may submit these to us in accordance with Sections C and E of this data protection statement. We have defined the following categories for individual business transactions:
- Tickets and merchandising
- Fans department
- Payment methods and outstanding items
- Images from events
- Sponsorship/licensee, supplier and merchant contacts
- Competitions and surveys
- Online media and personalised advertising
- Complaints management
- Automated decision-making and profiling
2.1. Tickets and merchandising
2.1.1. Day ticket/season ticket and fan merchandise
When you purchase a day and/or an (away) season ticket for public and VIP areas or purchase fan merchandise, as your contract partner, we will collect your name and address and – where applicable – your customer number (optionally also your gender and telephone number) as well as your payment information for this transaction. We provide you with further information on payment details in Items 1.5 and 2.6. When you make a purchase through our online shops, we will also request your email address so that we can send you your order confirmation. We require your data in order to produce tickets, for delivery and to pay for merchandise. These data are thus necessary for the smooth execution of the contract of sale that has been concluded (Art. 6 (1) (b) GDPR). This includes season ticket subscription contracts and sponsorship contracts where a ticket or fan merchandise quota has been agreed. We will store these data in our system and record you as a contact in our system, including a personal customer number that we will communicate to you.
In order to grant discounts and to check that children are appropriately supervised, for concessionary tickets for children up to the age of six or 15 years old, we will also request the date of birth of the ticket holder/user. Further concessionary rates may also be claimed according to the ticket price list. Here, we will merely register an entitlement to a concessionary rate and not the precise reason for this.
When you purchase day tickets or fan merchandise through our ticket booths on a match day or through our fan shops, your data will generally only be recorded if you wish to claim a discount as a member, for instance. You will find more information on membership in Item 2.2.
If you have purchased an away season ticket and thus have a guaranteed right of first refusal for tickets for our away games, we will always request your email address, your date of birth and, where applicable, your customer number. Before every away game, we will ask you by email whether you wish to make use of your right of first refusal.
If a season ticket subscription for our home matches consists of more than one season ticket, by selecting the “personalised season ticket” option, we will also collect the name and address of other ticket holders who are not contract partners/subscription holders. In the event that ticket holders do not have full legal capacity, we will also collect the same personal data for a parent or legal guardian. Pursuant to Art. 14 GDPR, each ticket holder or his parent or legal guardian must be notified in writing – indicating the name of the subscription holder – that the aforementioned data have been provided to VfL Wolfsburg to issue a season ticket. VfL Wolfsburg will notify ticket holders of this following the conclusion of the season ticket subscription contract.
A service provider finishes football shirts on our behalf. If you would like your name printed on your football shirt, we will send this to our service provider for flock printing.
2.1.2. Replacement of match-day ticket and surcharge
If you wish to transfer your match-day ticket or your season ticket to a third party along with the associated contractual right to enter the stadium, you may request the production of a replacement match-day ticket through our online ticket shop. If this third party is not eligible for the concessionary rate associated with your ticket, a surcharge may be paid, which will be taken into consideration when the replacement match-day ticket is issued. Payment information (see Items 1.5 and 2.6) will be requested for payment of the surcharge and for any fees arising.
2.1.3. Transfer of tickets through the VfL ticket exchange
If a season ticket seat is successfully sold through the VfL ticket exchange for a specific match day within the scope of fulfilment of the season ticket subscription contract (Art. 6 (1) (b) GDPR), the ticket holder will be credited a portion of the overall price. This will be in the form of a voucher, or else this amount will be credited to the ticket holder’s bank account. Depending on the form of reimbursement chosen, VfL Wolfsburg will also register the payment information of the season ticket holder for this transaction.
2.1.4. Use of a VfL Card as a means of payment
The login details for your personal VfL account (see Item 2.10.2 for further details) are required for identification purposes in order to top up your VfL Card (girogo “GeldKarte”) with credit through our online shop. The system will subsequently request your ten-digit card number to ensure that your card is correctly topped up. The process of topping up a card and using it in the stadium is generally anonymous. In this case, we will only register your card number and the top-up/payment amount. If you pay your top-up amount by direct debit or credit card, we will register your payment information for this transaction and transfer these details to our payment service provider for completion of the transaction. We require this information for the smooth execution of the contract concluded for the purchase of top-up credit and the related payment (Art. 6 (1) (b) GDPR).
When you use your VfL Card for payment at the stadium kiosk, we will register the sales receipt and the number of the card used. VfL Wolfsburg is the system operator, while our stadium caterer is your contract partner.
Any purchase made will generally be anonymous. Our catering system will exclusively administer card numbers and the related sales and item receipts. Your personal data resulting from the purchase of VfL Cards as a season ticket/membership card are held in a separate merchandise management system. While it is possible to combine some of these data, this will only take place, where necessary, to issue receipts for hospitality expenses at your request.
If, after visiting our stadium, you request a receipt for hospitality expenses in connection with any purchases you have made, we will register the following data in order to issue you with your receipt: name, address, card number and your specified payment date. To provide you with a receipt more quickly, at your request, we will also register your email address. We will transfer your data including the transaction breakdown to the stadium caterer in order to issue a receipt for hospitality expenses and provide you with this.
2.1.5. Legal action with regard to unauthorised ticket sales
The resale of our match-day and season tickets on the unauthorised secondary market is prohibited according to Item 8 of our General Ticket Terms and Conditions and violates the terms and conditions of the purchase agreement concluded. VfL Wolfsburg has authorised a law firm to discover, pursue and take legal action against any violations. In case of any violations, VfL Wolfsburg will provide this law firm with the name, postal address, email address and, where applicable, the telephone number of our contract partner, so that further measures can be taken. Moreover, the data for the ticket that has been unlawfully offered online will be registered on the basis of a balancing of interests pursuant to Art. 6 (1) (f) GDPR. In particular, this includes the assertion of legal claims.
2.1.6. Free signed tickets
We will register your name and address as the recipient for any order of free signed tickets (three tickets per person per season). We will process these data so that we can send you these signed tickets without any problems. Moreover, as part of processing these data, we will document the date on which we received your request, the date on which we sent the relevant signed ticket to you and which signed tickets (i.e. which VfL players) you have been sent.
This is in order to avoid duplicate orders that exceed the contingent to which each fan is entitled and to ensure that each fan is able to receive signed tickets free of charge once a year.
2.1.7. Subscription/shipping of our stadium magazine “Unter Wölfen”
In order to take out a subscription for VfL Wolfsburg’s stadium magazine “Unter Wölfen”, you must complete a pre-prepared order form. We will record your name and address, your year of birth and the payment information that you have provided (see Items 1.5 and 2.6), including your consent to the annual subscription fee to be charged on a one-time basis. You may optionally also provide your email address. If you have provided us with your email address, you thus agree to us notifying you before the start of a season of the price of a repeat subscription to our magazine. All of these details are thus required for preparation and fulfilment of the subscription contract (Art. 6 (1) (b) GDPR).
Any data collected will be deleted after the end of a season, following the automatic end of your subscription, and will not be used for other purposes. Your email address will be deleted after 14 months at the latest if, as a current subscriber, you have not reacted to our email notifying you of the possibility of taking out a new subscription. For the duration of your subscription, the collected payment information will exclusively be confidentially held in VfL Wolfsburg’s database. We will forward your name and address to the shipping company commissioned by us to ensure delivery of the magazine “Unter Wölfen”.
Membership of our “WölfeClub” or “WölfiClub” offers you a large number of benefits and services, e.g. discounts and exclusive club events. In return, parents and legal guardians pay a WölfiClub membership fee for their children, while adult members pay a membership fee for the WölfeClub. When you sign up for membership, VfL Wolfsburg will register your name, address and date of birth (and, in case of an online application, your email address) for the classification and recording of your membership status and for the issuing and handover of your personalised, non-transferable membership card and your welcome package. If you also voluntarily notify us of your gender, we will be able to address you correctly. If you also provide us with your telephone number (mobile and/or landline number), we will also be able to contact you this way. For payment of your annual membership fee, your payment information (in this case, specifically your account details such as your IBAN and BIC) will be processed and transferred to our payment service provider. In case of minors, we will also request the name, address and payment information (cf. Item 2.6) of a parent or legal guardian.
In the “WölfiClub”, the welcome package includes a t-shirt. For this reason, we also require your child’s clothing size. These data are thus necessary for the preparation and fulfilment of the membership contract pursuant to Art. 6 (1) (b) GDPR. VfL Wolfsburg will administer your data within its systems and notify you of your membership number. Your membership number and name will be printed on your membership card so that you can claim your advantages and discounts from participating institutions.
Through the “Membership board” initiative of the “WölfiClub”, in return for a fee, a member can display his details on a permanent small sign on the membership board in the Volkswagen Arena and thus show that he is a Wolfsburg fan. The name of the member and further information (place of residence, date on which the member joined the club and the member’s favourite player) will be printed and hung up here.
In order to send you material from the club and members’ information (“WölfiClub” magazine, “WölfeClub 55plus”, etc.) by post, we will forward your name, membership number and address to a service provider that will handle the printing and mailing process for us.
2.3. Events and activities
VfL Wolfsburg organises a wide range of events and activities, such as children’s events (“VfL-Kidsday”, “Mini-Wölfis”, the opportunity to act as a match mascot, children’s birthdays, etc.), “WölfeClub 55Plus” events or the home game experience (where you get a closer look behind the scenes of a match day), training camps for the VfL football school, the VfL writing competition, VfL Kick-Off, VfL-FußballWelt events, guided tours of the arena as well as other events that require registration. The following data must be recorded for preparation and fulfilment of the contract concluded with you for participation in an event (Art. 6 (1) (b) GDPR):
Personal data that we process:
As part of the registration process, we will register your child’s name and address, or your own name and address, as a participant, or else your name and address as the contact of a participating organisation (e.g. companies, schools, nurseries) or group and – where necessary for events for which a fee is charged – your payment information for this transaction (see Items 1.5 and 2.6 for more details). For minors, we will also request the name, address and, where applicable, the payment information of a parent or legal guardian. We will also request contact details such as your telephone number and email address. We will indicate mandatory fields and information that can be provided voluntarily on the registration forms.
For some events, we will request further details from the participant:
- Membership number and date of birth
- Clothing size and lettering to be printed on the back of a football shirt
- Parents’ seats
- Playing position and name of participant’s football club
In the “Other information” section on our registration forms, you may voluntarily provide us with information that may be important for you, your child or for us during the event. For example, some events include meals together or guided tours of the arena. If you are a vegetarian, for example, if your child has a specific food intolerance or if your mobility is limited, we can take this into account when putting together a meal or a programme. Please note that for this purpose, you would need to provide your consent for us to process health data such as this pursuant to Art. 6 (1) (a) GDPR. As outlined in Section C, you may revoke this consent at any time.
Processing for a specific purpose:
VfL Wolfsburg requires the aforementioned data so as to be able to conclude a contract with you to enable planning, implementation, billing and evaluation of an event. We will register your aforementioned contact details so as to be able to confirm your registration, in case of any queries or to provide you with further information on the programme or any last-minute changes. Some events are for members only, are discounted for members or for other groups of persons, or are intended for certain age groups. For some events, you or your child will receive clothing such as a t-shirt or football shirt that should fit well and will feature your chosen lettering. If you hand your child over to our childcare service while you watch a VfL game, we will also request your seat number to ensure that we are able to contact you in case of an emergency. When registering for VfL football school camps, we will request the participant’s playing position so that we can take this into consideration when putting together teams. We will also register the name of your football club, since players from our partner clubs will receive a discount on the registration fee.
Forwarding of data to third parties and publication:
The personal data of pupils participating in the VfL writing competition will generally not be registered. The sole exception here is the publication of the names of the winners on our VfL-Wiki site (our online knowledge platform for pupils). Prior to publication, we will obtain consent from you or, if you are under 16, from your parents/guardians (Art. 6 (1) (a) GDPR), which may be revoked at any time. Please see Section C of this data protection statement for further details on the revocation process.
For the “Home Match Day Stadium Child” event series, within the scope of fulfilment of the contract in question, we will forward the name of the “stadium child” or the winner to our event partners, Autostadt GmbH, and to our partner radio station. We will notify you of this during the registration process. Autostadt GmbH requires your name for billing purposes regarding the issued voucher and for tax reasons. Since our partner ratio station requires your name for its public reporting, we will obtain your consent to this pursuant to Art. 6 (1) (a) GDPR.
If we offer an event involving an external overnight stay or tour, we will forward the names of the participants to the establishment where we will spend the night so that it can register these names for billing purposes. Participants will be notified of the forwarding of these data during the registration process.
We will forward your name and address for invoicing purposes to caterers who provide food and drink at our events and activities at their own expense. However, we will only do this if you are an invoice recipient. We will generally already notify you of this during the registration process, but will do so at the latest before we forward your data.
In order to be able to participate in the walking football sporting activity, when you register, you will be required to provide a declaration of consent from your doctor confirming your physical fitness. VfL Wolfsburg needs this information to confirm your suitability for this sporting activity. Walking football places a strain on the cardiovascular and musculoskeletal systems. We offer this sporting activity to members of our “WölfeClub 55Plus”, which is for persons aged 55 or older. Your health is very important to us and it is essential for us to ensure that you do not damage your health by taking part. With your consent (Art. 6 (1) (a) GDPR), which you may revoke at any time, we will save your doctor’s permission for the duration of your participation in walking football. Please see Section C of this data protection statement for further details on the revocation process.
Whenever institutions request VfL modules (e.g. a bouncy castle or a goal wall) from us, the following data of a contact person must be recorded for the purpose of fulfilling the contract (Art. 6 (1) (b) GDPR), in particular to clarify the arrangements: name, telephone number and, where applicable, email address. Together with the name and address of the institution, we will forward these data to a service provider from which we rent these modules and which will set up the activity in question.
The VfL-FußballWelt service includes not just your visit but also other event services such as guided tours of the arena (see Item 2.3) and other combined tickets featured in our service portfolio (e.g. combined visit to VfL-FußballWelt and the Volkswagen plant) that you can purchase from us.
To enable you to use all of the VfL-FußballWelt functions and options and for fulfilment of the user agreement concluded with you (Art. 6 (1) (b) GDPR), registration of the following personal data is required during your visit to VfL-FußballWelt:
- Your name
- Audiovisual data that arise during your use of the relevant exhibits
- Statistics/scores arising during your use of the exhibits (number of foot contacts, pace, shooting speed, reaction speed, number of passes, number of correct decisions, number of goals scored)
- Billing address in the event of payment by invoice
Personal data will only be collected if you opt to notify us of these for the fulfilment of the contract for your visit to VfL-FußballWelt. For this purpose, you can create a profile at the counter and associate the chip number of your RFID bracelet with this. You can use the RFID bracelet that we will provide you with to identify yourself at certain activity points. No personal data will be stored on this RFID bracelet. All of the data that you provide and your performance data will be stored in encrypted form on our servers in your profile for subsequent retrieval. These data can be retrieved over the internet, using your individual URL. To protect your data against third-party access, your first and last names are required as well as your personal URL for access to your data. Your data will be automatically deleted after a period of seven days. Your data will not be passed on to third parties.
In case of invoicing, your name and billing address will also be requested. This applies not only for group inquiries but also for all of our VfL-FußballWelt services/offers.
2.5. Fans department
2.5.1. VfL fan club set-up and information
We will save the data of all members in order to set up a VfL Wolfsburg official fan club (OFC). An important precondition for your official membership is that you sign the OFC agreement and the anti-violence declaration. The chairman or deputy chairman and VfL Wolfsburg will sign this agreement and also the declaration on behalf of the members of the official fan club.
To provide our services, we will save your name, email address and date of birth as an OFC member. Providing your address and telephone number is optional. Membership of an official fan club offers you significant advantages, e.g. advance ticket sales and notification of internal club information (please see the OFC agreement for further details). The aforementioned data are required for this purpose. The OFC will provide us with its members’ data at the start of each season and the second half of the season. This ensures that these data are updated and also deleted.
2.5.2. Fan contact management
If you contact the employees of our Fans department, our fan representatives will store your name, telephone number and/or email address. These data will be collected for communication and/or information purposes, e.g. as part of the fan movement for our teams’ home and away matches and for our football social network (consisting of fans, the club and the city). Once a year, the employees of our Fans department will review whether your contact details are required for the above purpose. If this is no longer the case, your data will be deleted.
2.5.3. Special and additional train journeys
Our Fans department will organise special and/or additional trains as necessary. As well as tickets for the away match, our fans can also purchase train tickets from us. Registration takes place exclusively via an online form. Train tickets and tickets for the game will be sent to the person who places the order by post. Shortly before the start of the journey, the person placing the order and any accompanying persons will be notified of any important organisational details for the journey. This applies in particular to the code of conduct that applies during the train journey, for any damages claims in case of any damage identified in the allocated train compartments and handling of image rights.
Within the scope of fulfilment of the contract (Art. 6 (1) (b) GDPR), the name, address, payment information (see Items 1.5 and 2.6) and the email address of the person placing the order will be collected. The names and email addresses of any accompanying persons will also be collected. All of the aforementioned data will be deleted following the organisational completion of a special and/or additional train journey.
2.5.4. Fan club and football tournament
Our Fans department organises annual football tournaments for the members of our official fan clubs. The applicant’s name, email address and telephone number will be collected for registration purposes. The players’ names and dates of birth will be collected from the team members. You can provide us with your consent for us to take photos and/or record video footage of you during the event when you register. All of the collected data will be deleted once the event has ended. Any further processing of images and/or video footage will be in accordance with the declaration of consent provided (Art. 6 (1) (a) GDPR), which you may revoke at any time.
2.5.5. Support for away fans
As part of the support that we provide for away fans and communication with the away team’s football network (consisting of the club, the city and the police) on home match days, our Fans department requires the contact details of officials/contacts for handling various fan-related issues. The following data are required to communicate with the football network: function, name, telephone number and email address. These data will be forwarded within VfL Wolfsburg and to the relevant partners in Wolfsburg’s football network. Names and vehicle registration numbers will be collected for the purpose of controlling access for away fans. These data will also be forwarded to the Wolfsburg police. Within the scope of a balancing of interests (Art. 6 (1) (f) GDPR), it is necessary for us to process your data to safeguard legitimate interests of ourselves and of third parties. For security reasons, we are obliged to ensure that the two groups of fans remain separated and thus also to ensure transparency for the police in terms of the details for away fans’ arrival. The football network must be able to plan fans’ arrival and to make rapid arrangements in case of any incidents on the day of the match.
The data collected for external partners will be saved for any future cooperation. The data collected from away fans will be deleted once the event has ended.
2.6. Payment methods and outstanding items
We offer you various means of payment with regard to a purchase, rental, service or event agreement concluded with VfL Wolfsburg and will record your payment information pursuant to Item 1.5.
For the completion of the payment process and thus for fulfilment of the contract (Art. 6 (1) (b) GDPR), in case of direct debit (SEPA direct debit, online or offline) or credit card payment, we will forward your payment information to our payment service provider for implementation of the transaction.
We will contact you if it is not possible to complete this payment transaction, e.g. because you have insufficient funds in your account or we have not received notification from you of a change to your payment information, or you currently have an amount outstanding to us. If we are still unable to reach you as of our third attempt within the scope of this reminder procedure, we will be forced to assume that you do not wish to be contacted. Only then will we forward your name and address and the payment information used to our business information service, which will pursue this payment on our behalf (Art. 6 (1) (f) GDPR, legitimate interest: enforcement of payment claims).
2.7. Images taken at events and fan activities
If you take part in events and fan activities pursuant to Items 2.3 and 2.5 of this data protection statement, photos may be taken and/or video footage may be recorded. We will store these images and/or video footage following the events. VfL Wolfsburg will use a selection of images and/or videos for the purpose of reporting on the events and activities in its print and online media or for advertising purposes. If we publish an image or video in which you appear, we will obtain your consent (Art. 6 (1) (a) GDPR), which you may revoke at any time: see Sections C and E of this data protection statement for further details.
2.8. Sponsorship/licensee, supplier and merchant contacts
Provision of contractually agreed services, such as the implementation of advertising services or the organisation of customised events, may entail processing of personal data (pursuant to Art. 6 (1) (b) GDPR) within the scope of provision of the required service(s). VfL Wolfsburg will notify its contract partner in advance of the nature, scope and purpose of the data to be processed. If the data required exceed the name and the address of the contract partner (in the case of legal entities, the details of contacts will be recorded), VfL Wolfsburg will notify the contract partner of this in writing in advance. The contract partner’s separate consent will be required for provision of the required service. In case of an objection to processing at this time, this may result in an inferior service or even non-fulfilment of the contractually agreed obligation. Compensation claims may not be asserted in this respect.
VfL Wolfsburg administers the contact details of sponsors, licensees, merchants and suppliers in merchandise management systems as creditors for the supply chain process. For this purpose, processing the name and contact details of contacts (such as email addresses and telephone numbers) is required within the scope of fulfilment of the contract pursuant to Art. 6 (1) (b) GDPR.
2.9. Competitions and surveys
Should you wish to participate in a competition, this will necessitate processing the following data for implementation of the competition contract (Art. 6 (1) (b) GDPR): we will use your name, address, date of birth and, where applicable, your email address or telephone number to notify you if you are a winner, to send you your prize, for age verification purposes (competition participants must be 18 or over) and, insofar as you have provided your consent (Art. 6 (1) (a) GDPR), for advertising of further offers. You will find detailed information in our terms and conditions for participation in the competition in question.
VfL Wolfsburg will also use and process your personal data for market and opinion research pertaining to its own purposes (cf. Item 2.10.4). You may object to this processing at any time, either in its entirety or in relation to specific measures, without incurring any transmission costs other than those according to standard rates. A notification in text form sent to the contact details indicated in Section A (e.g. email, letter) is sufficient for this purpose.
In case of smaller competitions on the social media channels of VfL Wolfsburg (Facebook, Twitter, Instagram, YouTube) in which a signed football shirt or similar prizes can be won, personal data (name, address and, where appropriate, age) will only be requested if the participant is drawn as the winner of this competition. Data will be collected exclusively for the purpose of shipping the prize and will not be saved.
2.10. Online media and personalised advertising
2.10.1. VfL websites and cookies
It is perfectly possible to visit VfL Wolfsburg websites without giving us any information about your identity. In this case, we will only automatically collect the following log data:
- An anonymous cookie ID that does not enable the identification of your IP address (different requirements, which are indicated in Item 2.10.3, apply for the use of our email newsletter, which are referred to in the aforementioned item)
- The operating system and web browser you are using, and your selected screen resolution
- The date and time of your visit
- The webpages you visit on our website
- The website from which you visited us
Unless the following Item 2.10 specifies otherwise, data will be processed solely by VfL Wolfsburg. Individual cookies will be designated. You can obtain further information in our cookie information section on www.vfl-wolfsburg.de.
2.10.2. VfL online account.
You may opt to create an online account in order to use a large range of services on the VfL website www.vfl-wolfsburg.de. In this case, we will register the following personal data: your email address and username, as well as your name and address, since you will be able to use your account to purchase tickets and fan merchandise and to use other services, as indicated in Item 2.1. We will also record your date of birth, since you must be at least 16 years old to create a VfL Wolfsburg account. If you also voluntarily notify us of your gender and provide us with a telephone number, we will be able to address you correctly and to contact you by telephone. Of course, we will not store your personal password and we will not know what your password is.
You can use your online account to quickly purchase tickets or fan merchandise, to check your order history or your VfL-FußballWelt statistics (if you have created a link to this) or to check the balance on your VfL Card.
You may opt to delete your account at any time. In this case, please contact us via the contact details indicated in Section A or by sending an email to firstname.lastname@example.org.
2.10.3. Signing up for our email newsletter
We require your email address for registration. You may opt to notify us of your name but you are not obliged to do so unless you subscribe to our newsletter when creating an online account. If you notify us of your name, we will use this to address you personally.
You will receive a confirmation email from us after submitting the registration form. This registration will only become valid once you have clicked on the link in our confirmation email. You can unsubscribe from our newsletter at any time. You can use the unsubscribe link at the end of each newsletter for this purpose. Your email address will then be immediately deleted from our distribution system.
We will implement the above processing on the basis of the consent you have provided pursuant to Art. 6 (1) (a) GDPR. We will process the following data for the purpose of market research, for targeted advertising and to design the content of our newsletters in accordance with your needs.
- If you open emails from us, click on links in these emails or submit a website form after clicking on a link, these actions will be recorded and this information will be stored in your profile.
- If you open emails from us or click on links in these emails, information about topics of interest to you will be recorded and stored.
- If you download images from emails or click on links, the type of end device that you are using will be recorded and this information will be stored in your profile.
- If you download images from emails or click on links, your IP address will be used to determine the location from which you have downloaded this material and this information will be stored in your profile.
- If our newsletter cannot be delivered because your email address has been deactivated, your inbox is full or for other reasons, this will be recorded and this information will be stored in your profile.
The receipt of our newsletter is only possible subject to the above preconditions. If you would prefer us not to process these data, please do not register for our newsletter or else unsubscribe from it if you have already registered for it.
In subscribing for our newsletter, you have provided the following declaration of consent:
Yes, I wish to subscribe to the free email newsletter of VfL Wolfsburg-Fußball GmbH with contents tailored to my personal needs and customised advertising on the basis of profiling. I have read the data protection statement, which provides a detailed description of the profiling used, and agree to the processing of data outlined therein.
Right to revoke consent:
You may revoke this consent at any time by unsubscribing from our newsletter. A link to unsubscribe from our newsletter is included in every email. Alternatively, you can send an email to email@example.com with the subject line “Revocation of consent” or send a notice of revocation to the contact details included in the legal notice or in the data protection statement.
You may revoke your consent at any time with future effect.
A service provider handles sending our newsletter on our behalf. Other than this, we will generally not forward your data to third parties. We will store your data and the aforementioned collected information in your profile for as long as you remain subscribed to our newsletter.
You may unsubscribe from our newsletter at any time, either by sending a message to the contact details provided at the end of this data protection statement or by using the link provided for this purpose in our newsletter.
2.10.4. Customised advertising and market research
If you wish to receive information on our products, you may request receipt of this advertising online and/or offline by submitting a declaration of consent to the receipt of customised advertising and market research. Within the scope of your consent pursuant to Art. 6 (1) (a) GDPR, the following data will be processed for the purpose of the delivery of advertising: your name and, depending on your chosen method of communication, your email address, telephone number, mobile telephone number (contact via mobile phone, text message and/or WhatsApp Messenger) and/or your Facebook user account (contact via Facebook Messenger).
VfL Wolfsburg uses the double opt-in procedure to obtain your consent for the purpose of online communications. An email will be sent to the email address that you have provided asking you to confirm your consent.
You may unsubscribe at any time by sending a message to the contact details provided at the end of this data protection statement.
Please remember that, if you choose WhatsApp Messenger or Facebook Messenger as a method of communication, your data will be processed outside of Europe, e.g. in the United States of America. Please note the following Item 2.10.5 in this respect. If you would prefer to avoid this processing, we offer you alternative methods of communication, as outlined above.
In the context of balancing interests (Article 6 (1) (f) GDPR), as necessary, we will process your data beyond the actual fulfilment of the contract in question in order to safeguard our legitimate interests or those of third parties.
- Preparing, organising and processing marketing and market research activities across various channels, in order to look after our existing customer base, to acquire new customers and for the ongoing improvement of the overall VfL Wolfsburg-Fußball GmbH service portfolio
- Advertising or market and opinion research, unless you have rejected use of your data
- Verifying and optimising needs-analysis processes for the purpose of direct customer notification
- Performing statistical evaluations or market analyses
- Measures for managing the business and enhancing services and products
2.10.5. Messaging services
If you have provided VfL Wolfsburg with consent in this respect, you may receive messages and information from VfL Wolfsburg via the messaging services WhatsApp Messenger or Facebook Messenger. You will require a messaging account from the relevant provider for this purpose. The data protection provisions of the relevant messaging service provider apply.
WhatsApp: the data protection provisions of WhatsApp Inc. apply; see: www.whatsapp.com/legal/#Privacy
Facebook Messenger: the data policies of Facebook Inc. apply; see: www.facebook.com/about/privacy
For the purpose of using a messaging service, the following types of data will be transmitted to VfL Wolfsburg and stored, depending on the messenger in question:
WhatsApp: your telephone number, your username (where applicable, your first and last name), your end device and any messages sent to this service.
Facebook Messenger: your Facebook ID, your first and last name, your profile picture, your location, your time zone, your gender and any messages sent to this service.
VfL Wolfsburg will store your data for as long as you remain registered to receive messages.
Any messages that you send to VfL Wolfsburg by way of a messaging client will be read and replied to by employees specifically responsible for this. These messages are therefore not confidential. The process for registering to receive messages and information and for deregistering from this varies, depending on the messenger type.
We require your mobile telephone number for registration. You may provide us with your name, but you are not obliged to do so. If you notify us of your name, we will use this to address you personally.
VfL Wolfsburg uses the opt-in procedure for registration. For this purpose, as a first step, you may save VfL Wolfsburg’s WhatsApp telephone number in your smartphone. As a second step, you may send us a message consisting of the word “Start”. You can unsubscribe from our newsletter at any time. Send us a message consisting of the word “Stop” for this purpose. The data that you have provided will then be immediately deleted from our distribution system.
VfL Wolfsburg uses the opt-in procedure for the receipt of messages. For this purpose, you can send VfL Wolfsburg’s Facebook account a message consisting of the word “Start”. You can unsubscribe from our newsletter at any time. Send us a message consisting of the word “Stop” for this purpose. The data that you have provided will then be immediately deleted from our distribution system.
2.10.6. Web analysis/tracking tools
In this case, to ensure an adequate level of data protection, VfL Wolfsburg will use the privacy shield negotiated between the European Union and the USA.
However, if IP anonymisation is activated on our websites, Google will first truncate your IP address within Member States of the European Union or within other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. Google will use this information on our behalf to analyse your use of the VfL websites, to compile reports on website activities and to provide us with further services associated with website and internet use.
Your IP address, which your browser forwards to Google Analytics, will not be pooled with other Google data. You can adjust the settings in your browser software to prevent cookies from being stored, but we wish to point out that in this case, you may not be able to use all the functions of the VfL websites to their full extent. In addition, you can prevent the data generated by the cookie relating to your use of the VfL websites (including your IP address) being sent to Google and processing of these data by Google by downloading and installing the browser plug-in available through the following link: http://tools.google.com/dlpage/gaoptout?hl=en. As an alternative to this browser add-on, in particular for browsers on mobile end devices, you can prevent Google Analytics collecting these data by clicking on this link. An opt-out cookie will be stored, which will prevent future collection of your data when you visit this website. The opt-out cookie only applies to this browser and only to our website, and will be stored on your device. If you delete the cookies in your browser, you will need to store this opt-out cookie again.
Our websites use Google Analytics with the extension “_anonymizeIp()”. IP addresses are thus processed in truncated form and therefore cannot be directly linked to any particular individual. The use of Google Analytics is subject to agreeing to the preconditions that the German data protection authorities agreed upon with Google.
Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Data protection statement: http://www.google.de/intl/en/policies/privacy.
2.10.7. Retargeting technologies
VfL Wolfsburg produces pseudonymised user profiles for the purposes of targeted advertising (in accordance with section 15 (3) of the German Teleservices Act). This enables online campaigns to be initiated and managed in a targeted way. Pseudonymisation refers to the replacement of the name and other identifying features with an indicator in order to make it considerably more difficult or impossible for third parties to identify the person concerned. Cookies are used for this purpose. Cookies are small files containing configuration information and are saved on your device. The cookie tracks information about your activities on the website(s) in question (for example, your browsing habits, which pages you visit, which ad banners you click on, etc.). Most web browsers automatically accept cookies by default.
You can object to the creation of a pseudonymised user profile at any time with future effect by changing your browser settings so that no cookies, or only certain cookies, are accepted or so that you are notified as soon as cookies are transmitted. This may mean that you cannot use all of the features of the VfL Wolfsburg website to their full extent. For further information on cookies, please refer to the cookie information section on the VfL website.
2.10.8. Data enhancement by third parties
VfL Wolfsburg reserves the right to enhance your data through service providers. In this case, your master data will be supplemented with further attributes so as to be able to provide you with even more appropriate advertising. Since these data are not collected from the data subject, in this case, we will notify you in advance pursuant to Art. 14 (4) GDPR of the person in relation to whom we are processing these data and for what purpose.
2.10.9. Social media
VfL Wolfsburg uses social media plug-ins (“plug-ins”) pertaining to the following social networks: Instagram, Facebook, Google+, YouTube, Spotify and Twitter. These are indicated by way of the well-known icons of each social network. These plug-ins are deactivated on the VfL websites by default, which means that the personal data of a user is not initially transmitted to the plug-in provider when a webpage is accessed. Simply by clicking on one of the greyed-out icons and subsequently confirming a prompt, you will activate the plug-in. This amounts to consent in accordance with Art. 6 (1) (a) GDPR. Following activation, the content of this social network plug-in will be transmitted directly to your browser and integrated into the website from there (the two-click solution). Plug-ins can be deactivated at any time by clicking on them again.
The integration of a plug-in causes data to be transmitted automatically to the respective provider, which can then be saved by this provider. The provider will receive a notification that you have accessed our website. This occurs irrespective of whether you have created a user account for this social network and are logged in there. If you are logged into the social network, the provider will be able to associate these data directly with your user account. It is possible that this plug-in provider will use the data to generate user profiles. VfL Wolfsburg has no influence on the collection and processing of data by this provider. Information regarding the purpose and scope of data collection and the further processing and use of the data by the plug-in providers, as well as your associated rights and settings options for the protection of your privacy, can be found in the data protection statements of the respective provider:
Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA https://help.instagram.com/155833707900388
Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA
Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA https://www.google.de/intl/en/policies/privacy/
Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden
2.11. Complaints management
We will register and save any complaints that we receive and analyse them to improve the quality of our operational processes. If it is possible to link this complaint with your contact details/your account, we will establish this link so that we can respond to your enquiry and to your complaint more effectively. So as to be able to provide you with feedback to your complaint, where applicable, we will also register your telephone number or your email address.
2.12. Automated decision-making and profiling
Pursuant to Art. 22 GDPR, we generally do not use fully automated decision-making processes to establish and fulfil business relationships. Should we use such processes in isolated cases, we will notify you about them separately where we are required by law to do so.
We will process some of your data automatically with the aim of assessing certain personal characteristics (profiling). For example, we use profiling in the following cases:
- We are legally required to combat money laundering, the financing of terrorism and crimes endangering property. This includes the analysis of data (including during payment transactions). These measures also serve to protect you.
- We use analytical tools to enable us to inform and advise you in a targeted manner about products; these tools allow for targeted communication and advertising, including market and opinion research; see Item 2.10.4 for further details.
- We use scoring to assess your creditworthiness. In this process, we calculate the probability that customers will fulfil their contractual payment obligations. The calculation may involve income levels, spending, existing liabilities, profession, employer, duration of employment, experiences from the business relationship thus far, contractual repayment of earlier loans, and information from credit agencies. Scoring is based on an acknowledged and proven mathematical statistical method. The calculated scores help us in making decisions on product sales and are incorporated into our ongoing risk management processes.
C. Your rights
You may exercise the following rights in relation to VfL Wolfsburg at any time and at no cost:
Right of access under Art. 15 GDPR in conjunction with sections 29 and 34 of the German Federal Data Protection Act (BDSG): you are entitled to receive information from us on processing of your personal data.
Right to rectification under Art. 16 GDPR: you are entitled to insist that we rectify personal data pertaining to yourself that is incorrect or incomplete.
Right to erasure (“right to be forgotten”) under Art. 17 GDPR in conjunction with section 35 BDSG: you are entitled to insist on the erasure of your data, subject to the preconditions indicated in Art. 17 GDPR. For example, you may require the erasure of your data if they are no longer required for the purposes for which they were collected. You may also request that your data be erased if we process your data on the basis of your consent and you subsequently revoke this consent.
Right to restriction of processing under Art. 18 GDPR in conjunction with section 35 BDSG: you are entitled to require restriction of processing of your data subject to the preconditions contained in Art. 18 GDPR. For example, these preconditions will be fulfilled if you dispute the correctness of your data. You may then require the restriction of processing while the correctness of these data is reviewed.
Right to object: you are entitled to object to the processing of your data if they are being processed for an overriding interest or for the purpose of direct advertising. An objection is permitted if data are processed either in the public interest or in the exercise of public authority or on the basis of a legitimate interest of VfL Wolfsburg or a third party. If you object to data processing, please specify the reasons why you object to this data processing. You also have the right to object to data processing for direct advertising purposes. The same applies to profiling, provided that this is related to direct advertising.
Right to data portability under Art. 20 GDPR: you have the right to receive your data in a structured, commonly used and machine-readable format and to transfer these data to another data processor, provided that data processing is based on consent or contract fulfilment and that automated processing methods are used.
Right to revoke consent: If a data processing activity is based on your consent, you are entitled to revoke your consent to data processing at any time, with future effect and free of charge, by contacting firstname.lastname@example.org or using the contact details provided in the legal notice. Please note that, even in case of a revocation, processing your data where this is required by law is not excluded.
Right to lodge a complaint with a supervisory authority under Art. 77 GDPR: you also have the right to complain to a supervisory authority (e.g. the data protection officer for Lower Saxony) regarding our processing of your data.
D. Changes to this data protection statement
We reserve the right to update this data protection statement from time to time. Any updates to this data protection statement will be published on our website. Any amendments will come into effect following their publication on our website. We therefore advise you to regularly visit this website in order to check whether this data protection statement has been updated.
E. Your data protection contacts
The data protection coordinator of VfL Wolfsburg-Fußball GmbH is your initial contact for any data protection-related matters and in order to exercise your data protection rights. However, you can also directly contact our data protection officer at the following address: Data protection officer of VfL Wolfsburg-Fußball GmbH, Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg or by sending an email to email@example.com.
We advise you to initially refer your issue to our direct contact:
VfL Wolfsburg Fußball GmbH
Data protection coordinator
In den Allerwiesen 1