Terms of use and privacy policy

Protecting your privacy when using our app is particularly important to us. For this reason, we would like to inform you in detail below about the collection, processing and use of anonymous and personal data within the scope of our app offer.

Terms of use for VfL CONNECT

1. Data controller, scope and purpose

The VfL Wolfsburg Business App "VfL CONNECT" (hereinafter referred to as "App" or "VfL CONNECT") is an offer of VfL Wolfsburg-Fußball GmbH (hereinafter referred to as "VfL Wolfsburg"), In den Allerwiesen 1, 38446 Wolfsburg, service@vfl-wolfsburg.de, registered in the Commercial Register of the District Court of Braunschweig under HRB No. 100486. 

VfL Wolfsburg enables the users of VfL CONNECT to use the content and functions provided in the app on the basis of a usage agreement within which these terms of use and the other applicable legal provisions apply for the period of operation of this app.

2. Changes to the terms of use and the scope of services of VfL CONNECT

a. VfL Wolfsburg reserves the right to change the terms of use in a manner that is reasonable for the user and only with effect for the future. The user will be expressly notified of any changes to the terms of use via the app and asked to agree to any changes to the terms of use. In this regard, the user must observe the respective current version of the Terms of Use.

b. Furthermore, VfL Wolfsburg reserves the right to expand or shorten the scope of services of the app or to change functionalities at any time. This is because the rapid development of the internet in particular makes it necessary for VfL Wolfsburg to make adjustments to the app in terms of technology and content from time to time.

3. Unauthorised use

All contents of VfL CONNECT such as text, graphics, logos, button icons, images, audio or video clips as well as digital downloads are the property of VfL Wolfsburg or third parties who provide these contents to VfL Wolfsburg and are protected by copyright. When using the app, the rights of VfL Wolfsburg and third parties (in particular their personal rights) must be observed. Users are prohibited from using the app in breach of these terms of use or legal provisions. The user must refrain from any improper use of the app; in particular, he/she may not integrate the app or any part thereof into other services, neither private nor commercial, or use the app for his/her own commercial purposes.

4. Performance and exclusion of warranty

VfL Wolfsburg endeavours to ensure the smooth operation of the app. However, VfL Wolfsburg cannot guarantee that the app will function without technical errors at all times or that the telecommunications network required to transmit the data will be available.

5. Liability of VfL Wolfsburg

VfL Wolfsburg is liable for intent, gross negligence and for guarantees / warranties expressly granted by VfL Wolfsburg. VfL Wolfsburg shall only be liable for simple negligence in the event of a breach of a material obligation, whereby the amount of compensation claims shall be limited to the foreseeable, direct damage and if this app is offered against payment.

Any liability of VfL Wolfsburg for indirect damage (including loss of profit) is excluded. The same applies to contributions uploaded by the user or posted by other means, insofar as this content infringes the rights of third parties and VfL Wolfsburg has no knowledge of this and, in the case of claims for damages, no facts or circumstances are known from which the infringement of the rights of third parties can be inferred, or VfL Wolfsburg has taken immediate action to remove illegal content or to block access to it as soon as VfL Wolfsburg has become aware of the illegal content.

6. Final provisions

The use of the contents of VfL CONNECT and these Terms of Use shall be governed by German law with the exception of its conflict of law provisions. The place of jurisdiction, insofar as this can be permissibly agreed, is the court responsible for the registered office of VfL Wolfsburg-Fußball GmbH.

Version: 01.08.2021

Privacy policy for VfL CONNECT

1.    General information

In the following, we inform users of VfL CONNECT about the processing of their personal data in the context of using the app. The VfL Wolfsburg business app "VfL CONNECT" (hereinafter referred to as "App" or "VfL CONNECT") is an offer of VfL Wolfsburg-Fußball GmbH (hereinafter referred to as "VfL Wolfsburg"), In den Allerwiesen 1, 38446 Wolfsburg, service@vfl-wolfsburg.de, registered in the Commercial Register of the District Court of Braunschweig under HRB No. 100486.

The app is obtained via platforms operated by independent data controllers ("App Stores"). In this respect, the data protection provisions of the respective App Store apply:

iOS App Store: https://www.apple.com/legal/privacy/de-ww/
Google Play: https://policies.google.com/privacy

2.    Collection of personal data when using VfL CONNECT

2.1    Usage data and tracking

When downloading or acessing the VfL CONNECT app, this app transmits data to our data server, which stores this data in so-called log files:

As a matter of principle, personal user data is only collected and used to the extent necessary to provide a functioning app and our content and services.

The registration of accesses is carried out for reasons of data security and to ensure the stability and operational security of our system and to protect against possible attacks from outside. In addition, the data is statistically analysed to optimise the offer. The logged data cannot be used to trace which content you have accessed or which files you have retrieved.

The temporary collection of the data is necessary to enable delivery of the content to the end devices and to ensure their display. This data is not merged with other data sources.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the storage of data in log files after seven days at the latest. Additional storage by our technical service providers is possible for statistical purposes, among other things. In this case, the IP address is deleted or alienated so that it is no longer possible to assign the calling device.

The collection of data for the provision of the app and its storage is mandatory for the operation of the offer (Art. 6 para. 1 lit b) GDPR).
In addition, we may also use usage data for statistical evaluation, error analysis and to ensure the security and stability of the VfL CONNECT App on the basis of our legitimate interests (Art. 6 para. 1 lit. f) GDPR). Our legitimate interests here are to ensure and improve the stability and functionality of the VfL CONNECT App and to detect and prevent cases of misuse and attacks in order to ensure the security of the VfL CONNECT App and our other systems.

The VfL CONNECT app optionally uses Firebase Crashlytics. The user can select whether Firebase Crashlytics should be used when the app is first started. The user can deactivate the use of Firebase Crashlytics in the app at any time.

The information generated about the use of the VfL CONNECT app is transmitted with an anonymised IP address to a Google server in the USA and stored there. The IP anonymisation function in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses in memory to zero. This means that the exact IP address of the user is not stored.

Google will use this information to evaluate your use of the VfL CONNECT app in order to compile reports on activity for VfL Wolfsburg. If the user consents to the use of Firebase Crashlytics in the VfL CONNECT app, he or she consents to the processing of data about him or her by Google in the manner and for the purposes set out above.

This usage data forms the basis for statistical, anonymous evaluations so that trends can be identified, which can be used to improve the offer accordingly.

The integration is based on explicit consent (Art. 6 para. 1 lit. a GDPR).

2.2    Registration and inventory data

When using the VfL CONNECT app as a registered and logged-in user, data is transferred to our data server, processed there and - depending on the respective service - stored in your user account.

2.2.1    User account and profile photo

We process the following data to generate a user account and to manage individual user settings:

The processing is carried out to provide the functions of the user account and is necessary for the secure login and the storage of the settings (Art. 6 para. 1 lit b) GDPR).

Further personal data of the user, e.g. company, address, telephone number, profile photo, can be optionally provided by the user and deleted at any time. In this respect, the processing is based on consent (Art. 6 para. 1 lit. a) GDPR).

In order to use the profile photo function, authorisation to access the camera of the device or the recordings stored on the device must also be granted once. The authorisation is requested by the device the first time the function is used and can then be revoked at any time in the device settings. Uploaded profile photos can be deleted directly in the VfL CONNECT app at any time. Profile photos are visible to the respective ticket holder within the framework of ticket management if the user has accepted the invitation and claims a managed ticket.

2.2.2    Business directory and digital business card

Users who are listed as contact persons of a partner company have the option of voluntarily entering their contact data in the digital business directory. There, these contact details are visible to registered app users in the respective company entry. In this respect, the processing is based on consent (Art. 6 para. 1 lit. a) GDPR).

The user can revoke the consent at any time in his profile settings by removing his contact data from the business directory.

2.2.3    Ticket management

a)    VfL Business Customers

As purchasers of digital hospitality tickets, users can use the ticket management in the VfL CONNECT app and, among other things, claim digital tickets and parking tickets for VfL Wolfsburg home matches themselves or make them available to third parties. The following data of the respective ticket holder is processed:

The data is processed to fulfil the right to visit embodied in the ticket in accordance with the VfL Wolfsburg General Terms and Conditions and Stadium Regulations and to send the digital ticket to the ticket holder by e-mail (Art. 6 Para. 1 lit. b) GDPR).

b)    Special case of personalised tickets

Due to special requirements imposed by legislation, the organising football association or the competent authorities, it may be necessary for tickets to be issued exclusively on a personalised basis and for further data to be collected on the ticket holder (e.g. names and contact details for tracking purposes due to infection control measures). The data is then collected and stored based on and under the conditions of the respective obligation under association regulations or public law to which VfL Wolfsburg is subject (Art. 6 Para. 1 lit. b) or c) GDPR).

2.3    Invitations

Via the ticket management, users can invite third parties to VfL Wolfsburg home matches with tickets they have purchased and provide them with a digital ticket. The guest receives an e-mail and can accept or decline the invitation. The processing of the guest's data is carried out in the legitimate interest of VfL Wolfsburg and the respective business customer to be able to send invitations via digital ticketing and to be able to offer digital tickets to guests (Art. 6 para. 1 lit. f) GDPR). If the guest declines the invitation, he or she can object to the possibility of receiving future invitations. If the guest accepts the invitation, his/her data will be further processed for the purpose of fulfilling the contract (Art. 6 para. 1 lit. b) GDPR).

2.4    Ticket enquiries, General enquiries

Users have the option to send ticket requests or other requests for individual home matches to VfL Wolfsburg via the app. In doing so, the user's contact details (name and email address, telephone number if applicable) as well as the content of the request (number of tickets requested and message) are transmitted to the responsible VfL Wolfsburg sales staff to process the request (Art. 6 (1) lit. b) GDPR).

2.5    Raffles

By requesting to participate in a competition, the processing of the following data is necessary for the implementation of the competition contract (Art. 6 para. 1 lit. b) GDPR): Name, address, date of birth, possibly also e-mail address or telephone number are used for the purpose of prize notification, sending the prize, age verification (competitions are only open to persons over 18 years of age) and possibly also, insofar as the user has given us consent (Art. 6 para. 1 lit. a) GDPR), for the advertising of further offers. Detailed information can be found in our conditions of participation for the respective competition.

2.6    Push messages

When the app is opened for the first time, the user is asked whether he or she would like to receive push messages on topics related to VfL Wolfsburg. Push technology or server push describes a type of communication in which data is transmitted even though the receiving app is running in the background. In this context, the user can freely choose whether he or she wants to receive push messages for each category of topics (Art. 6 para. 1 lit. a) GDPR). Push messages with important information for ticket holders are automatically sent to all users with a digital ticket for the respective match (Art. 6 para. 1 lit. b) GDPR).

Users can specify in the settings of both the app and their end device whether the app is allowed to send them push messages. The delivery of the messages requires the storage of a push token of the users' mobile device on our server.

3.    Data security

In accordance with the legal requirements of Art. 32 GDPR, we have taken appropriate technical and organisational measures to ensure a level of protection for the personal data processed in the context of the use of VfL CONNCET that is appropriate to the risk. These include, among others:

4.    Disclosure of personal data

4.1    Receiver

Personal data is only passed on to third parties if this is necessary for the execution of the contract, in particular for the provision of the services. We use service providers from the IT services and hosting sector to provide the app. We have concluded agreements with these service providers regarding the processing of data on our behalf.

VfL Wolfsburg uses Google's Firebase service to provide the app.

You can find more information on data processing at Google at: https://firebase.google.com/support/privacy

The hosting of the servers required for the operation of the app is carried out by:

Claranet GmbH
Hanauer Landstrasse 196
60314 Frankfurt am Main
datenschutz@de.clara.net 

4.2    Third country transfer of personal data

For the purposes of the above-mentioned data processing, we also transfer your personal data to recipients and, where applicable, processors who are based outside the EU/EEA. To ensure an adequate level of protection for your personal data, VfL Wolfsburg concludes EU standard contractual clauses with these recipients. In addition, to the extent required by applicable data protection laws, further protective measures (e.g. encryption and additional contractual arrangements) are taken to ensure an adequate level of protection for your personal data.

You can access the EU standard contractual clauses used via the URL https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0087.

5.    Data subjects' rights

Users can assert their following rights against VfL Wolfsburg free of charge at any time:
Right to information according to Art. 15 GDPR in conjunction with. §§ 29, 34 Federal Data Protection Act (BDSG): The right to receive information from us about the processing of your personal data.

Right to rectification according to Art. 16 GDPR: The right to demand that we correct incorrect or incomplete personal data concerning the user.

Right to deletion according to Art. 17 GDPR in conjunction with. Section 35 BDSG: The right to demand the deletion of data relating to the user if the conditions set out in Art. 17 GDPR are met. According to this, for example, the deletion of data can be demanded insofar as it is no longer necessary for the purposes for which it was collected. In addition, deletion can be requested if we process the data on the basis of consent and this consent has been revoked by the user.

Right to restriction of processing according to Art. 18 GDPR in conjunction with. Section 35 BDSG: The right to demand the restriction of the processing of the user's data if the requirements of Art. 18 GDPR are met. This is the case, for example, if the accuracy of the data is disputed by the user. The user can then demand the restriction of processing for the duration of the verification of the accuracy of the data.

Right to object: If the processing is based on an overriding interest or the data is used for the purpose of direct marketing, users have the right to object to the processing of their data. An objection is permissible if the processing is either in the public interest or is carried out in the exercise of official authority or on the basis of a legitimate interest of VfL Wolfsburg or a third party. In the event of an objection, reasons must be given for objecting to the data processing. In addition, users have the right to object to data processing for direct advertising purposes. This also applies to profiling, insofar as it is related to direct advertising.

Right to data portability from Art. 20 GDPR: Where data processing is based on consent or the performance of a contract and is also carried out using automated processing, users have the right to receive their data in a structured, common and machine-readable format and to transfer it to another data processor.

Right of revocation: If the data processing is based on consent, the user has the right to revoke the data processing within the scope of consent with effect for the future at any time free of charge at datenschutz@vfl-wolfsburg.de or via our data subject rights portal www.vfl-wolfsburg.de/betroffenenrechte. Even in the event of a revocation, processing of the user's data on a legal basis is not excluded.
Right of complaint according to Art. 77 GDPR: The right to complain about our processing of users' data to a supervisory authority (e.g. the State Commissioner for Data Protection of Lower Saxony).

6.    Adaptation of this privacy policy

We reserve the right to update this privacy policy from time to time.

7.    Contact person for data protection

VfL Wolfsburg-Fußball GmbH is the user's first point of contact for all data protection-related concerns and for exercising rights. We recommend that you first address any concerns to our direct contact person:

VfL Wolfsburg Football GmbH
"Data Protection"
In the Allerwiesen 1
38446 Wolfsburg
datenschutz@vfl-wolfsburg.de

Users also have the option of contacting our data protection officer directly, who can be contacted at Data Protection Officer of VfL Wolfsburg-Fußball GmbH, Volkswagen AG, Berliner Ring 2, Brieffach 8091, 38440 Wolfsburg, Germany, or at konzerndatenschutz@volkswagen.de.