DATA PROTECTION STATEMENT OF VFL WOLFSBURG-FUSSBALL GMBH (AS OF 20/07/2023

A. Controller

This data protection statement has been published by VfL Wolfsburg-Fußball GmbH, In den Allerwiesen 1, 38446 Wolfsburg, Germany, service@vfl-wolfsburg.de, entered in the commercial register held by the District Court of Braunschweig under No. HRB 100486. Any references in the following document to “VfL Wolfsburg”, “we” or “us” are references to VfL Wolfsburg-Fußball GmbH.

B. Processing your personal data

1. General information

This data protection statement provides you as a fan, member, season ticket holder, contact of an organisation or company, event participant, user of our online media or as our customer who purchases or uses VfL Wolfsburg products and services with information on how your personal data are processed.

1.1. What are personal data?

Pursuant to Art. 4 (1) of the European General Data Protection Regulation (GDPR), personal data are any information from which conclusions could be drawn about your identity. Personal data include your name (this refers hereinafter to your first and last names), your address (including your billing address and your delivery address), your telephone number, your email address, payment information, such as your IBAN or credit card number, and your date of birth. Personal data do not include information that cannot be directly associated with your actual identity (e.g. favourited websites or the number of users of a website).

1.2. Which activities does the term “processing” cover?

Data processing within the meaning of article 4 (2) GDPR is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

1.3. What does processing of personal data for the purpose of business transactions entail?  

VfL Wolfsburg processes personal data for the purpose of various business transactions. For instance, this includes areas such as tickets, merchandising, memberships, events, advertising or online media (VfL website or email newsletter, etc.) that are outlined in detail in Item 2. Each of these business transactions is implemented for at least one purpose. In case of the purchase of a VfL product, this may be delivery and payment or, in case of events, for example, the holding of the event in question. Moreover, any operation through which personal data are processed has a basis in law, e.g. the need to prepare or perform a contract (Art. 6 (1) (b) GDPR), the need to comply with a legal obligation to which VfL Wolfsburg is subject (Art. 6 (1) (c) GDPR), on the basis of a legitimate interest of VfL Wolfsburg following an appropriate balancing of interests (Art. 6 (1) (f) GDPR) or on the basis of consent (Art. 6 (1) (a) GDPR).

1.4. How long will VfL Wolfsburg store your personal data?

We will process and store your personal data for as long as is necessary for the fulfilment of our contractual and statutory obligations. It should be noted that in the case of a season ticket subscription contract, our business relationship is a continuing obligation over a number of years.

Data that are no longer needed for the fulfilment of contractual or statutory obligations are regularly deleted, except when they require further processing – for a limited period – for the following purposes:

• Compliance with the retention requirements stipulated in commercial and tax law: this includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention or documentation periods specified therein are between two and ten years.
• Preservation of evidence in accordance with statutory limitation periods. According to sections 195 et seq. of the German Civil Code (BGB), these limitation periods can last for up to 30 years, though the standard limitation period is three years.

Required to fulfil the purposes listed. In these cases, we may store and, if necessary, use your data for a duration appropriate for these purposes even after our business relationship or our pre-contractual legal relationship has ended.

1.5. Further definitions

Stadium: covers all of VfL Wolfsburg’s venues such as the Volkswagen Arena, the AOK Stadion, the VfL-Stadion am Elsterweg and the Porschestadion.

Address: an address will be requested for many business transactions. By default, this consists of your street, house number, postcode, place of residence and country.

Payment information: this includes account details such as your IBAN and BIC as well as credit card details (card number and card expiry date), depending on the forms of payment that are offered for the business transaction in question.

Tickets: this refers to tickets for all of our teams’ matches, in particular our men’s and women’s professional football teams and our U23 team.  

VfL website: this covers all of the websites operated by VfL Wolfsburg. As well as the main website www.vfl-wolfsburg.de and its sub-pages, e.g. Fans, Tickets, Shop and FußballWelt, this also includes the “WölfiClub” site, www.woelficlub.de.     

Online shops: this refers to the online ticket shop and “Wölfeshop” (fan merchandise), which are accessible via www.vfl-wolfsburg.de.

2. Processing operations through which personal data are processed

In the following, VfL Wolfsburg notifies you of the business transactions through which it will register your personal data, the concrete purposes for which it processes these data and its legal basis for doing so. If you cannot find any specific information regarding the duration of storage, please refer to Item 1.4. If you have any queries, you may submit these to us in accordance with Sections C and E of this data protection statement. We have defined the following categories for individual business transactions:

• Tickets and merchandising
• Memberships
• Events
• VfL-FußballWelt
• Fans department
• Payment methods and outstanding items
• Images from events
• Sponsorship/licensee, supplier and merchant contacts
• Competitions and surveys
• Online media and personalised advertising
• Complaints management
• Automated decision-making and profiling

2.1. Tickets and merchandising

2.1.1. Day ticket/season ticket and fan merchandise

When you purchase a day and/or an (away) season ticket for public and VIP areas or purchase fan merchandise, as your contract partner, we will collect your name and address, your gender in order to identify and address you correctly, and – where applicable – your customer number (optionally also your telephone number) as well as your payment information for this transaction. We provide you with further information on payment details in Items 1.5 and 2.6. When you make a purchase via our online shops, your VfL account or as a guest, we will also request your email address so that we can send you your order confirmation. We require your data in order to produce tickets, for delivery and to pay for merchandise. These data are thus necessary for the smooth execution of the contract of sale that has been concluded (Art. 6 (1) (b) GDPR). This includes season ticket subscription contracts and sponsorship contracts where a ticket or fan merchandise quota has been agreed. We will also notify you of any changes relevant to your contract, such as the price of season tickets for the new season. We will store your data in our system and record you as a contact in our system, including a personal customer number that we will communicate to you.

In order to grant discounts and to check that children are appropriately supervised, for concessionary tickets for children up to the age of six or 15 years old, we will also request the date of birth of the ticket holder/user. Further concessionary rates may also be claimed according to the ticket price list. Here, we will merely register an entitlement to a concessionary rate and not the precise reason for this.

When you purchase day tickets or fan merchandise through our ticket booths on a match day or through our fan shops, your data will generally only be recorded if you wish to claim a discount as a member, for instance. You will find more information on membership in Item 2.2.

If you have purchased an away season ticket and thus have a guaranteed right of first refusal for tickets for our away games, we will always request your email address, your date of birth and, where applicable, your customer number. Before every away game, we will ask you by email whether you wish to make use of your right of first refusal.

If a season ticket subscription for our home matches consists of more than one season ticket, by selecting the “personalised season ticket” option, we will also collect the name and address of other ticket holders who are not contract partners/subscription holders. In the event that ticket holders do not have full legal capacity, we will also collect the same personal data for a parent or legal guardian. Pursuant to Art. 14 GDPR, each ticket holder or his parent or legal guardian must be notified in writing – indicating the name and address of the subscription holder – that the aforementioned data have been provided to VfL Wolfsburg to issue a season ticket. VfL Wolfsburg will notify ticket holders of this following the conclusion of the season ticket subscription contract. 

A service provider finishes football shirts on our behalf. If you would like your name printed on your football shirt, we will send this to our service provider for flock printing.

2.1.2. Replacement of match-day ticket and surcharge

If you wish to transfer your match-day ticket or your season ticket to a third party along with the associated contractual right to enter the stadium, you may request the production of a replacement match-day ticket through our online ticket shop. If this third party is not eligible for the concessionary rate associated with your ticket, a surcharge may be paid, which will be taken into consideration when the replacement match-day ticket is issued. Payment information (see Items 1.5 and 2.6) will be requested for payment of the surcharge and for any fees arising.  

2.1.3. Transfer of tickets through the VfL ticket exchange

If a season ticket seat is successfully sold through the VfL ticket exchange for a specific match day within the scope of fulfilment of the season ticket subscription contract (Art. 6 (1) (b) GDPR), the ticket holder will be credited a portion of the overall price. This will be in the form of a voucher, or else this amount will be credited to the ticket holder’s bank account. Depending on the form of reimbursement chosen, VfL Wolfsburg will also register the payment information of the season ticket holder for this transaction.

2.1.4. Use of a VfL Card as a means of payment

The login details for your personal VfL account (see Item 2.10.2 for further details) are required for identification purposes in order to top up your VfL Card (girogo “GeldKarte”) with credit through our online shop. The system will subsequently request your ten-digit card number to ensure that your card is correctly topped up. The process of topping up a card and using it in the stadium is generally anonymous. In this case, we will only register your card number and the top-up/payment amount. If you pay your top-up amount by direct debit or credit card, we will register your payment information for this transaction and transfer these details to our payment service provider for completion of the transaction. We require this information for the smooth execution of the contract concluded for the purchase of top-up credit and the related payment (Art. 6 (1) (b) GDPR).

When you use your VfL Card for payment at the stadium kiosk, we will register the sales receipt and the number of the card used. VfL Wolfsburg is the system operator, while our stadium caterer is your contract partner.
Any purchase made will generally be anonymous. Our catering system will exclusively administer card numbers and the related sales and item receipts. Your personal data resulting from the purchase of VfL Cards as a season ticket/membership card are held in a separate merchandise management system. While it is possible to combine some of these data, this will only take place, where necessary, to issue receipts for hospitality expenses at your request.    

If, after visiting our stadium, you request a receipt for hospitality expenses in connection with any purchases you have made, we will register the following data in order to issue you with your receipt: name, address, card number and your specified payment date. To provide you with a receipt more quickly, at your request, we will also register your email address. We will transfer your data including the transaction breakdown to the stadium caterer in order to issue a receipt for hospitality expenses and provide you with this.

2.1.5. Legal action with regard to unauthorised ticket sales

The resale of our match-day and season tickets on the unauthorised secondary market is prohibited according to Item 8 of our General Ticket Terms and Conditions and violates the terms and conditions of the purchase agreement concluded. VfL Wolfsburg has authorised a law firm to discover, pursue and take legal action against any violations. In case of any violations, VfL Wolfsburg will provide this law firm with the name, postal address, email address and, where applicable, the telephone number of our contract partner, so that further measures can be taken. Moreover, the data for the ticket that has been unlawfully offered online will be registered on the basis of a balancing of interests pursuant to Art. 6 (1) (f) GDPR. In particular, this includes the assertion of legal claims.

2.1.6. Free signed tickets

We will register your name and address as the recipient for any order of free signed tickets (three tickets per person per season). We will process these data so that we can send you these signed tickets without any problems. Moreover, as part of processing these data, we will document the date on which we received your request, the date on which we sent the relevant signed ticket to you and which signed tickets (i.e. which VfL players) you have been sent.

This is in order to avoid duplicate orders that exceed the contingent to which each fan is entitled and to ensure that each fan is able to receive signed tickets free of charge once a year.

2.1.7. Subscription/shipping of our magazine “Unter Wölfen”

In order to take out a subscription for VfL Wolfsburg’s magazine “Unter Wölfen”, which is published 10 times a year, you must complete a pre-prepared order form. We will record your name and address, your year of birth and the payment information that you have provided (see Items 1.5 and 2.6), including your consent to the annual subscription fee to be charged on a one-time basis. You may optionally also provide your email address. If you have provided us with your email address, you thus agree to us notifying you before the start of a season of the price of a repeat subscription to our magazine. All of these details are thus required for preparation and fulfilment of the subscription contract (Art. 6 (1) (b) GDPR).

Any data collected will be deleted after the end of a season, following the automatic end of your subscription, and will not be used for other purposes. Your email address will be deleted after 14 months at the latest if, as a current subscriber, you have not reacted to our email notifying you of the possibility of taking out a new subscription. For the duration of your subscription, the collected payment information will exclusively be confidentially held in VfL Wolfsburg’s database. We will forward your name and address to the shipping company commissioned by us to ensure delivery of the “Unter Wölfen” magazine.

2.2. Memberships

Membership of our “WölfeClub” or “WölfiClub” offers you a large number of benefits and services, e.g. discounts and exclusive club events. In return, parents and legal guardians pay a WölfiClub membership fee for their children, while adult members pay a membership fee for the WölfeClub. When you sign up for membership, VfL Wolfsburg will register your name, address and date of birth (and, in case of an online application, your email address) for the classification and recording of your membership status and for the issuing and handover of your personalised, non-transferable membership card and your welcome package. We also record your gender in order to identify and address you correctly. If you provide us with your telephone number (mobile and/or landline number), we will also be able to contact you this way. For payment of your annual membership fee, your payment information (in this case, specifically your account details such as your IBAN and BIC) will be processed and transferred to our payment service provider. In case of minors, we will also request the name, address and payment information (cf. Item 2.6) of a parent or legal guardian.

In the “WölfiClub”, the welcome package includes a t-shirt. For this reason, we also require your child’s clothing size. These data are thus necessary for the preparation and fulfilment of the membership contract pursuant to Art. 6 (1) (b) GDPR. VfL Wolfsburg will administer your data within its systems and notify you of your membership number. Your membership number and name will be printed on your membership card so that you can claim your advantages and discounts from our cooperation partners.

Through the “Membership board” initiative of the “WölfiClub”, in return for a fee, a member can display his details on a permanent small sign on the membership board in the Volkswagen Arena and thus show that he is a Wolfsburg fan. The name of the member and further information (place of residence, date on which the member joined the club and the member’s favourite player) will be printed and hung up here. If you object to the publication of your sign on the membership board, we will remove it. Please send us your objection, with “Objection Membership Board” in the subject line, using the contact details provided under E. 

In order to send you material from the club and members’ information (“WölfiClub” magazine, “WölfeClub 55plus programme”, etc.) by post, we will forward your name, membership number and address to a service provider that will handle the printing and mailing process for us.

2.3. Events and activities

VfL Wolfsburg organises a wide range of events and activities, such as children’s events (“VfL-KidsDay”, “Mini-Wölfis”, the opportunity to act as a match mascot, children’s birthdays, etc.), “WölfeClub 55plus” events or the home game experience (where you get a closer look behind the scenes of a match day), training camps for the VfL football school, the VfL writing competition, VfL Kick-Off, VfL-FußballWelt events, guided tours of the arena as well as other events that require registration. The following data must be recorded for preparation and fulfilment of the contract concluded with you for participation in an event (Art. 6 (1) (b) GDPR):

Personal data that we process:
As part of the registration process, we will register for correct identification and addressing purposes your child’s name, address, and gender, or your own name, address and gender as a participant, or as the contact of a participating organisation (e.g. companies, schools, nurseries) or group and – where necessary for events for which a fee is charged – your payment information for this transaction (see Items 1.5 and 2.6 for more details). For minors, we will also request the name, address and, where applicable, the payment information of a parent or legal guardian. We will also request contact details such as your telephone number and email address. We will indicate mandatory fields and information that can be provided voluntarily on the registration forms.   

For some events, we will request further details from the participant:

• Membership number and date of birth
• Clothing size and lettering to be printed on the back of a football shirt
• Parents’ seats
• Playing position and name of the football club

In the “Other information” section on our registration forms, you may voluntarily provide us with information that may be important for you, your child or for us during the event. For example, some events include meals together or guided tours of the arena. If you are a vegetarian, for example, if your child has a specific food intolerance or if your mobility is limited, we can take this into account when putting together a meal or a programme. Please note that for this purpose, you would need to provide your consent for us to process health data such as this pursuant to Art. 6 (1) (a) GDPR. As outlined in Section C, you may revoke this consent at any time.

Processing for a specific purpose:
VfL Wolfsburg requires the aforementioned data so as to be able to conclude a contract with you to enable the planning, implementation, billing and evaluation of an event. We will register your aforementioned contact details so as to be able to confirm your registration, in case of any queries or to provide you with further information on the programme or any last-minute changes. We record a telephone number in particular for children’s events at which the parent or legal guardian is not present, so that they can be contacted immediately in the event of an emergency. Some events are for members only, are discounted for members or for other groups of persons, or are intended for certain age groups. For some events, you or your child will receive clothing such as a t-shirt or football shirt that should fit well and will feature your chosen lettering. If you hand your child over to our childcare service while you watch a VfL game, we will also request your seat number to ensure that we are able to contact you in case of an emergency. When registering for VfL football school camps, we will request the participant’s playing position so that we can take this into consideration when putting together teams. We will also register the name of your football club, since players from our partner clubs will receive a discount on the registration fee.

Forwarding of data to third parties and publication:   
The personal data of pupils participating in the VfL writing competition will generally not be registered. The sole exception here is the publication of the names of the winners on our VfL-Wiki site (our online knowledge platform for pupils). Prior to publication, we will obtain consent from you or, if you are under 16, from your parents/guardians (Art. 6 (1) (a) GDPR), which may be revoked at any time. Please see Section C of this data protection statement for further details on the revocation process.

For the “Home Match Day Stadium Child” event series we will forward the name of the “stadium child” (the winner of the promotion) to our event partners, Autostadt GmbH, and to our partner radio station. Autostadt GmbH needs the name in order to account for the voucher provided and for tax reasons, in other words in the context of performing the contract (Art. 6(1) (b) GDPR). The partner radio station needs the name, age and town of the “stadium child” for its public reporting. We will obtain consent within the meaning of Art. 6(1) (a) GDPR for this purpose when the child is registered for the promotional event.

If we offer an event involving an external overnight stay or tour, we will forward the names of the participants to the establishment where we will spend the night so that it can register these names for billing purposes. Participants will be notified of the forwarding of these data during the registration process.

We will forward your name and address for invoicing purposes to caterers who provide food and drink at our events and activities at their own expense. However, we will only do this if you are an invoice recipient. We will generally already notify you of this during the registration process, but will do so at the latest before we forward your data.   

Special features:
In order to be able to participate in the walking football sporting activity, when you register, you will be required to provide a statement from your doctor confirming your physical fitness. VfL Wolfsburg needs this information to confirm your suitability for this sporting activity. Walking football places a strain on the cardiovascular and musculoskeletal systems. We offer this sport to our WölfeClub members aged 55 and above. Your health is very important to us and it is essential for us to ensure that you do not damage your health by taking part. We also want to be able to help or assist you quickly in an emergency. Therefore, we store the information about your health that you provide voluntarily when you register, e.g. about allergies, medicines and conditions for the duration of your participation in walking football. This is subject to your consent (Art. 6(1) (a) GDPR), which you can withdraw at any time. Please see Section C of this data protection statement for further details on the revocation process.

If institutions or private individuals request VfL modules (e.g. a bouncy castle or goalposts) or our mascot “Wölfi”, the following data are required from a contact person for the performance of the contract (Art. 6(1) (b) GDPR), especially for billing, procedural matters and enquiries at short notice, e.g. the exact address for delivery or performance: name, address, telephone number and email address. When we rent modules we transfer the data to the provider of the module, who is responsible for the delivery and installation on site.

2.4. VfL-FußballWelt

The VfL-FußballWelt service includes not just your visit but also other event services such as guided tours of the arena (see Item 2.3) and other combined tickets featured in our service portfolio (e.g. combined visit to VfL-FußballWelt and the Volkswagen plant) that you can purchase from us.

To enable you to use all of the VfL-FußballWelt functions and options and for fulfilment of the user agreement concluded with you (Art. 6 (1) (b) GDPR), registration of the following personal data is required during your visit to VfL-FußballWelt:

• Your name
• Audiovisual data that arise during your use of the relevant exhibits
• Statistics/scores arising during your use of the exhibits (number of foot contacts, pace, shooting speed, reaction speed, number of passes, number of correct decisions, number of goals scored)
• Billing address in the event of payment by invoice

Personal data will only be collected if you opt to notify us of these for the fulfilment of the contract for your visit to VfL-FußballWelt. For this purpose, you can create a profile at the counter and associate the chip number of your RFID bracelet with this. You can use the RFID bracelet that we will provide you with to identify yourself at certain activity points. No personal data will be stored on this RFID bracelet. All of the data that you provide and your performance data will be stored in encrypted form on our servers in your profile for subsequent retrieval. These data can be retrieved over the internet, using your individual URL. To protect your data against third-party access, your first and last names are required as well as your personal URL for access to your data. Your data will be automatically deleted after a period of seven days. Your data will not be passed on to third parties.

In case of invoicing, your name and billing address will also be requested. This applies not only for group inquiries but also for all of our VfL-FußballWelt services/offers.

2.5. Services for fans and customers

2.5.1. VfL fan club set-up and information

We will save the data of all members in order to set up a VfL Wolfsburg official fan club (OFC). An important precondition for your official membership is that you sign the OFC agreement and the anti-violence declaration. The chairman or deputy chairman and VfL Wolfsburg will sign this agreement and also the declaration on behalf of the members of the official fan club.

To provide our services, we will save your name, email address and date of birth as an OFC member. Providing your address and telephone number is optional. Membership of an official fan club offers you significant advantages, e.g. advance ticket sales and notification of internal club information (please see the OFC agreement for further details). The aforementioned data are required for this purpose. The OFC will provide us with its members’ data at the start of each season and the second half of the season. This ensures that these data are updated and also deleted.

2.5.2. Fan contact management and customer service

When you contact our Fans department or Service Centre, our staff will ask for and store your name and possibly also your telephone number and/or email address in order to process your enquiry (service contract within the meaning of Art. 6(1) (b) GDPR). These data are collected when you contact our Fans department for communication and/or information purposes, e.g. as part of the fan movement for our teams’ home and away matches and for our football social network (consisting of fans, the club and the city). Once a year, the employees of our Fans department will review whether your contact details are required for the above purpose. If this is no longer the case, your data will be deleted.

For fans with a handicap we will simplify access to the stadium on request. In order to issue personalised car parking and wheelchair access tickets at the stadium on home match days we process the name and address of the person making the request. Only in exceptional cases is it possible to drive right up to the stadium past the security gates. We therefore require a medical certificate and the vehicle registration number to issue a security pass. The medical certificate contains particularly sensitive data about your health, so in order to process it we need your consent in accordance with Art. 6(1) (a) GDPR. We consider that you grant your consent when you send us the certificate. You can withdraw your consent at any time.

2.5.3. Special and additional train journeys

Our Fans department will organise special and/or additional trains as necessary. As well as tickets for the away match, our fans can also purchase train tickets from us. Registration takes place exclusively via an online form. Train tickets and tickets for the game will be sent to the person who places the order by post. Shortly before the start of the journey, the person placing the order and any accompanying persons will be notified of any important organisational details for the journey. This applies in particular to the code of conduct that applies during the train journey, for any damages claims in case of any damage identified in the allocated train compartments and handling of image rights.

Within the scope of fulfilment of the contract (Art. 6 (1) (b) GDPR), the name, address, payment information (see Items 1.5 and 2.6) and the email address of the person placing the order will be collected. The names and email addresses of any accompanying persons will also be collected. All of the aforementioned data will be deleted following the organisational completion of a special and/or additional train journey.

2.5.4. Fan club and football tournament

Our Fans department organises annual football tournaments for the members of our official fan clubs. The applicant’s name, email address and telephone number will be collected for registration purposes. The players’ names and dates of birth will be collected from the team members. Whether we are allowed to take photos and/or record video footage of you during the event depends on your consent, which you can provide when you register. All of the collected data will be deleted once the event has ended. Any further processing of images and/or video footage will be in accordance with the declaration of consent provided (Art. 6 (1) (a) GDPR), which you may revoke at any time.

2.5.5. Support for away fans

As part of the support that we provide for away fans and communication with the away team’s football network (consisting of the club, the city and the police) on home match days, our Fans department requires the contact details of officials/contacts for handling various fan-related issues. The following data are required to communicate with the football network: function, name, telephone number and email address. These data will be forwarded within VfL Wolfsburg and to the relevant partners in Wolfsburg’s football network. Names and vehicle registration numbers will be collected for the purpose of controlling access for away fans. These data will also be forwarded to the Wolfsburg police. Within the scope of a balancing of interests (Art. 6 (1) (f) GDPR), it is necessary for us to process your data to safeguard legitimate interests of ourselves and of third parties. For security reasons, we are obliged to ensure that the two groups of fans remain separated and thus also to ensure transparency for the police in terms of the details for away fans’ arrival. The football network must be able to plan fans’ arrival and to make rapid arrangements in case of any incidents on the day of the match.

The data collected for external partners will be saved for any future cooperation. The data collected from away fans will be deleted once the event has ended.

2.5.6. Complaints management

We will register and save any complaints that we receive in our Service Centre and analyse them to improve the quality of our operational processes. If it is possible to link this complaint with your contact details/your account, we will establish this link so that we can respond to your enquiry and to your complaint more effectively. So as to be able to provide you with feedback to your complaint, where applicable, we will also register your telephone number or your email address.

2.5.7 Away Game Season Ticket

When selling season tickets for away games, we collect your contact details and the desired ticket category in order to be able to grant you your right of first refusal for the respective away game. The tickets will be booked by SEPA direct debit upon a timely request. For this purpose, we collect your account details in accordance with section 2.6 of this data protection declaration. In the case of minors, we also collect the consent of someone with parental authority which is required for the conclusion of the contract. The data processing is conducted for the execution of the contract (Art. 6 para. 1 lit. b) DSGVO) of the away games season ticket contract.

2.6. Payment methods and outstanding items

We offer you various means of payment with regard to a purchase, rental, service or event agreement concluded with VfL Wolfsburg and will record your payment information pursuant to Item 1.5.

For the completion of the payment process and thus for fulfilment of the contract (Art. 6 (1) (b) GDPR), in case of direct debit (SEPA direct debit, online or offline) or credit card payment, we will forward your payment information to our payment service provider for implementation of the transaction.

We will contact you if it is not possible to complete this payment transaction, e.g. because you have insufficient funds in your account or we have not received notification from you of a change to your payment information, or you currently have an amount outstanding to us. If we are still unable to reach you as of our third attempt within the scope of this reminder procedure, we will be forced to assume that you do not wish to be contacted.  Only then will we forward your name and address and the payment information used to our business information service, which will pursue this payment on our behalf (Art. 6 (1) (f) GDPR, legitimate interest: enforcement of payment claims).

2.7. Images taken at events and fan activities

If you take part in events and fan activities pursuant to Items 2.3 and 2.5 of this data protection statement, photos may be taken and/or video footage may be recorded. We will store these images and/or video footage following the events. VfL Wolfsburg will use a selection of images and/or videos for the purpose of reporting on the events and activities in its print and online media or for advertising purposes. If we publish an image or video in which you appear, or transfer it a third party, we will obtain your consent (Art. 6 (1) (a) GDPR), e.g. when you register for an event, which you may revoke at any time: see Sections C and E of this data protection statement for further details. Special conditions apply for visits to our stadium on home match days. Section 4 of our Stadium Rules covers the processing of images on which you may appear:

During the event, images (e.g. photographs, livestreams, broadcasts and/or other audiovisual recordings) are made by VfL Wolfsburg and accredited third parties (e.g. journalists and freelance photographers) in order to document the event (e.g. press commentary, reporting, club history), for commercial use (e.g. image films for social media channels, flyers, posters, catalogues of fan merchandise and for use in the VfL Wolfsburg sustainability report) and on the basis of our overriding interest (Art. 6(1) (f) GDPR). The respective purposes are in our legitimate interest. You are referred to your right to object defined in Art. 21 GDPR.

2.8. Sponsorship/licensee, supplier and merchant contacts

Provision of contractually agreed services, such as the implementation of advertising services or the organisation of customised events, may entail processing of personal data (pursuant to Art. 6 (1) (b) GDPR) within the scope of provision of the required service(s). VfL Wolfsburg notifies the contract partner in advance about the type, scope and purpose of the data processing, e.g. when contractually agreed advertising materials, season tickets or seats in the stadium are personalised (with a company or individual name). If the data required exceed the name and the address of the contract partner (in the case of legal entities, the details of contacts will be recorded), VfL Wolfsburg will notify the contract partner of this in writing in advance. The contract partner’s separate consent will be required for provision of the required service. In case of an objection to processing at this time, this may result in an inferior service or even non-fulfilment of the contractually agreed obligation. Compensation claims may not be asserted in this respect.

VfL Wolfsburg administers the contact details of sponsors, licensees, merchants and suppliers in merchandise management systems as creditors for the supply chain process. For this purpose, processing the name and contact details of contacts (such as email addresses and telephone numbers) is required within the scope of fulfilment of the contract pursuant to Art. 6 (1) (b) GDPR. 

2.9. Competitions and surveys

Should you wish to participate in a competition, this will necessitate processing the following data for implementation of the competition contract (Art. 6 (1) (b) GDPR): we will use your name, address, date of birth and, where applicable, your email address or telephone number to notify you if you are a winner, to send you your prize, for age verification purposes (competition participants must be 18 or over) and, insofar as you have provided your consent (Art. 6 (1) (a) GDPR), for advertising of further offers. You will find detailed information in our terms and conditions for participation in the competition in question.

VfL Wolfsburg will also use and process your personal data for market and opinion research pertaining to its own purposes (cf. Item 2.10.4). You may object to this processing at any time, either in its entirety or in relation to specific measures, without incurring any transmission costs other than those according to standard rates. A notification in text form sent to the contact details indicated in Section A (e.g. email, letter) is sufficient for this purpose.

In case of smaller competitions on the social media channels of VfL Wolfsburg (Facebook, Twitter, Instagram, YouTube) in which a signed football shirt or similar prizes can be won, personal data (name, address and, where appropriate, age) will only be requested if the participant is drawn as the winner of this competition. Data will be collected exclusively for the purpose of shipping the prize and will not be saved.

2.10. Online media and personalised advertising

2.10.1. VfL websites and cookies

It is perfectly possible to visit VfL Wolfsburg websites without giving us any information about your identity. In this case, we will only automatically collect the following log data:

• An anonymous cookie ID that does not enable the identification of your IP address (different requirements, which are indicated in Item 2.10.3, apply for the use of our email newsletter, which are referred to in the aforementioned item)
• The operating system and web browser you are using, and your selected screen resolution
• The date and time of your visit
• The webpages you visit on our website
• The website from which you visited us

When you visit our website for the first time, we ask for your consent to use performance cookies and third-party cookies, especially tracking cookies from Google Analytics as well as other tracking tools. By clicking “Okay”, you consent to the use of third-party cookies. This consent can be revoked by you at any time for future use in accordance with point E of this data protection declaration.

By giving your consent through our cookie banner, you give your consent (Art. 6 para. 1 lit. a) DSGVO) to the following tracking measures:

Google Tag Manager: We use the Google Tag Manager to manage the individual tracking measures. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool caters for the activation of other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been executed at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager. http://www.google.de/tagmanager/use-policy.html

Google Analytics: Google Analytics, a web analytics service provided by Google Inc (“Google”). The data is processed for the purpose of advertising, market research or to tailor our website to your needs.

The information generated by the Google Analytics cookie about your use of our website is generally transmitted to a Google server in the USA and stored there.

In this case, VfL Wolfsburg uses the Privacy Shield that was negotiated between the European Union and the USA to ensure an adequate level of data protection.

The IP address transmitted by your browser as part of Google Analytics will not be amalgamated with other Google data. We have also added the code “anonymizeIP” to Google Analytics on this website. This guarantees the masking of your IP address so that all data is collected anonymously. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the VfL websites, to compile reports on website activity and to provide us with other services relating to website activity and internet use.

You may refuse the use of cookies by selecting the appropriate settings on your browser; however please note that if you do this you may not be able to use the full functionality of VfL websites. You can also prevent the collection of data generated by the cookie and relating to your use of the VfL websites (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in found at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

Google Analytics is used in accordance with the conditions agreed with Google by the German data protection authorities.

Third-party provider information:

Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Data protection declaration: http://www.google.de/intl/de/policies/privacy

Facebook “Conversion Pixel”: We use the “conversion pixel” or visitor action pixel from Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). By summoning this pixel from your browser, Facebook can subsequently recognise whether a Facebook advertisement was successful, e.g., led to an online purchase. We only receive statistical data from Facebook for this purpose without any reference to a specific person. This enables us to record the effectiveness of the Facebook ads for statistical and market research purposes.
Please go to www.facebook.com/settings?tab=ads if you wish to withdraw your consent to the Conversion Pixel.

You can find out more about the use of tracking tools on social media channels in section 2.10.9 of this data protection policy.

AWIN “Pixel”: VfL Wolfsburg uses the tracking pixel supplied by AWIN AG, Eichhornstraße 3, 107875 Berlin, Germany. Tracking enables us to provide you with benefits (e.g., discounts or credits) when you purchase products on our website. The AWIN pixel is only used if you have previously clicked on a VfL Wolfsburg advertising banner on one of our partner websites and have consented to the use of cookies on this other website. Tracking data is processed on the basis of our prevailing interest in tracking the awarding of benefits via partner websites and managing the contractual relationships with our partners and on the basis of a balancing of interests (Art. 6 para. 1 lit. f DSGVO). You can find AWIN's data protection policy here: https://www.awin.com/de/datenschutzerklarung.

etracker: VfL Wolfsburg uses the services of etracker GmbH from Hamburg, Germany (https://www.etracker.com) to analyse usage data. etracker does not use cookies for web analysis and data is processed exclusively in Germany.

The data processing is conducted on the basis of the legal provisions of Art. 6 para. 1 lit. f (legitimate interest) of the German Data Protection Regulation (DSGVO). The concern in terms of the DSGVO (legitimate interest) is the optimisation of our online offer and our web presence. Since the privacy of our visitors is important to us, data that may allow a connection to an individual person, such as the IP address, login, or device identifiers, are anonymised or pseudonymised at the earliest possible stage. No other use is made of the data, nor is it merged with other data or passed on to third parties.

You can reject the aforementioned data processing at any time by clicking on the slider. This objection has no negative consequences. If no slider is displayed, the data collection has already been prevented by other blocking measures.
Further information on data protection at etracker can be found at  https://www.etracker.com/datenschutz. 

2.10.2. VfL online account

You may opt to create an online account in order to use a large range of services on the VfL website www.vfl-wolfsburg.de. In this case, we will register the following personal data: your email address and username, as well as your name and address, since you will be able to use your account to purchase tickets and fan merchandise and to use other services, as indicated in Item 2.1. We will also record your date of birth, since you must be at least 16 years old to create a VfL Wolfsburg account. If you also voluntarily notify us of your gender and provide us with a telephone number, we will be able to address you correctly and to contact you by telephone. Of course, we will not store your personal password and we will not know what your password is.

You can use your online account to quickly purchase tickets or fan merchandise, to check your order history or your VfL-FußballWelt statistics (if you have created a link to this) or to check the balance on your VfL Card.   

You may opt to delete your account at any time. In this case, please contact us via the contact details indicated in Section A or by sending an email to datenschutz@vfl-wolfsburg.de.

For the maintenance, servicing and support, back-up and recovery of data on our online media, databases and servers we use IT service providers, e.g. web hosting providers, web designers, multimedia agencies as processors.

2.10.3 Website Accessibility

In order to provide the most barrier-free access possible to the content of our website, we work with the text-to-speech tool from the provider ReadSpeaker. ReadSpeaker is a reading service for internet content. When the user clicks on the "Read aloud" button, the corresponding text is transferred to the ReadSpeaker server via the user's IP, where an audio file is generated and streamed back to the user's IP. Immediately after delivery of the audio file, the process and the user's IP address are deleted from the ReadSpeaker server. ReadSpeaker does not collect and store any data that can be used to identify a person. All services are executed in Europe (Sweden).

2.10.4. Signing up for our email newsletter

We require your email address for registration. You may opt to notify us of your name but you are not obliged to do so unless you subscribe to our newsletter when creating an online account. If you notify us of your name, we will use this to address you personally.

You will receive a confirmation email from us after submitting the registration form. This registration will only become valid once you have clicked on the link in our confirmation email. You can unsubscribe from our newsletter at any time. You can use the unsubscribe link at the end of each newsletter for this purpose. Your email address will then be immediately deleted from our distribution system.

We will implement the above processing on the basis of the consent you have provided pursuant to Art. 6 (1) (a) GDPR. We will process the following data for the purpose of market research, for targeted advertising and to design the content of our newsletters in accordance with your needs.

• If you open emails from us, click on links in these emails or submit a website form after clicking on a link, these actions will be recorded and this information will be stored in your profile.
• If you open emails from us or click on links in these emails, information about topics of interest to you will be recorded and stored.
• If you download images from emails or click on links, the type of end device that you are using will be recorded and this information will be stored in your profile.
• If you download images from emails or click on links, your IP address will be used to determine the location from which you have downloaded this material and this information will be stored in your profile.
• If our newsletter cannot be delivered because your email address has been deactivated, your inbox is full or for other reasons, this will be recorded and this information will be stored in your profile.

The receipt of our newsletter is only possible subject to the above preconditions. If you would prefer us not to process these data, please do not register for our newsletter or else unsubscribe from it if you have already registered for it.
 
In subscribing for our newsletter, you have provided the following declaration of consent:

Yes, I wish to subscribe to the free email newsletter of VfL Wolfsburg-Fußball GmbH with contents tailored to my personal needs and customised advertising on the basis of profiling. I have read the data protection statement, which provides a detailed description of the profiling used, and agree to the processing of data outlined therein.

Right to revoke consent:
You may revoke this consent at any time by unsubscribing from our newsletter. A link to unsubscribe from our newsletter is included in every email. Alternatively, you can send an email to datenschutz@vfl-wolfsburg.de with the subject line “Revocation of consent” or send a notice of revocation to the contact details included in the legal notice or in the data protection statement.

You may revoke your consent at any time with future effect.

A service provider handles sending our newsletter on our behalf. Other than this, we will generally not forward your data to third parties. We will store your data and the aforementioned collected information in your profile for as long as you remain subscribed to our newsletter.

You may unsubscribe from our newsletter at any time, either by sending a message to the contact details provided at the end of this data protection statement or by using the link provided for this purpose in our newsletter.

2.10.5. Customised advertising and market research

If you wish to receive information on our products, you may request receipt of this advertising online and/or offline by submitting a declaration of consent to the receipt of customised advertising and market research. Within the scope of your consent pursuant to Art. 6 (1) (a) GDPR, the following data will be processed for the purpose of the delivery of advertising: your name and, depending on your chosen method of communication, your email address, telephone number, mobile telephone number (contact via mobile phone, text message and/or WhatsApp Messenger) and/or your Facebook user account (contact via Facebook Messenger).

VfL Wolfsburg uses the double opt-in procedure to obtain your consent for the purpose of online communications. An email will be sent to the email address that you have provided asking you to confirm your consent.

You may unsubscribe at any time by sending a message to the contact details provided at the end of this data protection statement.

Please remember that, if you choose WhatsApp Messenger or Facebook Messenger as a method of communication, your data will be processed outside of Europe, e.g. in the United States of America. Please note the following Item 2.10.5 in this respect. If you would prefer to avoid this processing, we offer you alternative methods of communication, as outlined above.

In the context of balancing interests (Article 6 (1) (f) GDPR),

as necessary, we will process your data beyond the actual fulfilment of the contract in question in order to safeguard our legitimate interests or those of third parties.
Examples:

• Preparing, organising and processing marketing and market research activities across various channels, in order to look after our existing customer base, to acquire new customers and for the ongoing improvement of the overall VfL Wolfsburg-Fußball GmbH service portfolio
• Advertising or market and opinion research, unless you have objected to the use of your data
• Verifying and optimising needs-analysis processes for the purpose of direct customer notification
• Performing statistical evaluations or market analyses
• Measures for managing the business and enhancing services and products
• Enriching your profile by one or more service providers by means of probabilities based on statistical analysis and official records (for more details see 2.10.8) to optimise our form of address and improve our services. These characteristics will only be used for your benefit and explicitly not to your disadvantage. For example we will use these characteristics to suppress advertising that does not interest you. Furthermore, we will optimise our service offerings with the help of these characteristics.

2.10.6. Messaging services

If you have provided VfL Wolfsburg with consent in this respect, you may receive messages and information from VfL Wolfsburg via the messaging services WhatsApp Messenger or Facebook Messenger. You will require a messaging account from the relevant provider for this purpose. The data protection provisions of the relevant messaging service provider apply.

WhatsApp: the data protection provisions of WhatsApp Inc. apply; see: www.whatsapp.com/legal/#Privacy

Facebook Messenger: the data policies of Facebook Inc. apply; see: www.facebook.com/about/privacy

For the purpose of using a messaging service, the following types of data will be transmitted to VfL Wolfsburg and stored, depending on the messenger in question:

WhatsApp: your telephone number, your username (where applicable, your first and last name), your end device and any messages sent to this service.

Facebook Messenger: your Facebook ID, your first and last name, your profile picture, your location, your time zone, your gender and any messages sent to this service.

VfL Wolfsburg will store your data for as long as you remain registered to receive messages.

Any messages that you send to VfL Wolfsburg by way of a messaging client will be read and replied to by employees specifically responsible for this. These messages are therefore not confidential. The process for registering to receive messages and information and for deregistering from this varies, depending on the messenger type.

WhatsApp:
We require your mobile telephone number for registration. You may provide us with your name, but you are not obliged to do so. If you notify us of your name, we will use this to address you personally.

VfL Wolfsburg uses the opt-in procedure for registration. For this purpose, as a first step, you may save VfL Wolfsburg’s WhatsApp telephone number in your smartphone. As a second step, you may send us a message consisting of the word “Start”. You can unsubscribe from our newsletter at any time. Send us a message consisting of the word “Stop” for this purpose. The data that you have provided will then be immediately deleted from our distribution system.

Please note WhatsApp’s terms of use. In installing and using WhatsApp on your mobile device, you agree to WhatsApp’s general terms and conditions. This includes granting WhatsApp Inc., 1601 Willow Road, Menlo Park, California 94025, access to your telephone number and to the contacts saved in your telephone. These data will be stored on WhatsApp’s servers. VfL Wolfsburg does not have any influence over this. No adequacy decision has been issued by the European commission. However, WhatsApp, Inc. is a member of the EU-US Privacy Shield. You will find more information about the EU-US Privacy Shield at the URL: www.privacyshield.gov or

If you have any concerns regarding the use of WhatsApp, our email newsletter is available to you as an alternative.

Facebook Messenger:
VfL Wolfsburg uses the opt-in procedure for the receipt of messages. For this purpose, you can send VfL Wolfsburg’s Facebook account a message consisting of the word “Start”. You can unsubscribe from our newsletter at any time. Send us a message consisting of the word “Stop” for this purpose. The data that you have provided will then be immediately deleted from our distribution system.

Signalize:
The "Signalize" service by etracker GmbH from Hamburg, Germany (https://www.etracker.com), if activated by you, uses a function of your internet browser or mobile operating system to provide notifications to you. Data collected for the sending of messages, which may have a personal connection to you, will be anonymised at the earliest possible stage and then stored exclusively in the form of anonymous data, which do not allow any connections to a specific person to be made. This data is only processed in order to deliver the notifications you have subscribed to and to make notification-related settings. We ask for your consent to save this data. In this case, the legal basis for data processing is Art. 6 para. 1 lit. a DSGVO. You can object to receiving notifications at any time via the settings of your browser or mobile device. You can find information about opting out for push notifications here.

In order to make push notifications tailored to you in terms of content, we use preferences collected from an anonymous user profile via cookies and merge your notification ID with the website user profile for the sole purpose of personalised messaging. Tracking technology is also used to statistically analyse notifications on our behalf. This enables us to determine whether a notification has been delivered and whether it has been clicked on. The data generated in this way is processed and stored exclusively in Germany.

The processing of data for the purpose of modulating the invitation to the notification service as well as for the statistical analysis of the registration or rejection is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f DSGVO in order to make the notification service user-friendly and effective. Here, too, the data that may allow for a connection to an individual person, such as the IP address, login, or device identifiers, are made anonymous at the earliest possible stage. A direct connection to a person is therefore excluded. No other use is made of the data, nor is it merged with other data or passed on to third parties.

You can reject the aforementioned data processing at any time by clicking on the slider. This objection has no negative consequences. If no slider is displayed, the data collection is already prevented by other blocking measures.

2.10.7. Web analysis/tracking tools

On its websites and in its VfL app, VfL Wolfsburg uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Data is processed for the purposes of advertising, market research or appropriate design of our websites (in accordance with section 15 (3) of the German Teleservices Act). Google Analytics uses cookies, text files that are stored on your computer and enable your use of our website to be analysed. The information generated by the cookie about your use of our website is generally sent to a Google server in the USA and stored there.

In this case, to ensure an adequate level of data protection, VfL Wolfsburg will use the privacy shield negotiated between the European Union and the USA.

However, if IP anonymisation is activated on our websites, Google will first truncate your IP address within Member States of the European Union or within other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. Google will use this information on our behalf to analyse your use of the VfL websites, to compile reports on website activities and to provide us with further services associated with website and internet use.

Your IP address, which your browser forwards to Google Analytics, will not be pooled with other Google data. You can adjust the settings in your browser software to prevent cookies from being stored, but we wish to point out that in this case, you may not be able to use all the functions of the VfL websites to their full extent. In addition, you can prevent the data generated by the cookie relating to your use of the VfL websites (including your IP address) being sent to Google and processing of these data by Google by downloading and installing the browser plug-in available through the following link: http://tools.google.com/dlpage/gaoptout?hl=en. As an alternative to this browser add-on, in particular for browsers on mobile end devices, you can prevent Google Analytics collecting these data by clicking on this link. An opt-out cookie will be stored, which will prevent future collection of your data when you visit this website. The opt-out cookie only applies to this browser and only to our website, and will be stored on your device. If you delete the cookies in your browser, you will need to store this opt-out cookie again.

Our websites use Google Analytics with the extension “_anonymizeIp()”. IP addresses are thus processed in truncated form and therefore cannot be directly linked to any particular individual. The use of Google Analytics is subject to agreeing to the preconditions that the German data protection authorities agreed upon with Google.

Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Data protection statement: http://www.google.de/intl/en/policies/privacy.

You can read more about the use of tracking tools on social media channels in section 2.10.9 of this privacy policy.

2.10.8. Retargeting technologies

VfL Wolfsburg produces pseudonymised user profiles for the purposes of targeted advertising (in accordance with section 15 (3) of the German Teleservices Act). This enables online campaigns to be initiated and managed in a targeted way. Pseudonymisation refers to the replacement of the name and other identifying features with an indicator in order to make it considerably more difficult or impossible for third parties to identify the person concerned. Cookies are used for this purpose. Cookies are small files containing configuration information and are saved on your device. The cookie tracks information about your activities on the website(s) in question (for example, your browsing habits, which pages you visit, which ad banners you click on, etc.). Most web browsers automatically accept cookies by default.

You can object to the creation of a pseudonymised user profile at any time with future effect by changing your browser settings so that no cookies, or only certain cookies, are accepted or so that you are notified as soon as cookies are transmitted. This may mean that you cannot use all of the features of the VfL Wolfsburg website to their full extent. For further information on cookies, please refer to the cookie information section on the VfL website.

2.10.9. Data enhancement by third parties

VfL Wolfsburg reserves the right to enhance your data by means of service providers for direct and geomarketing. This entails adding probability values based on statistical analysis and official registers to your basic data in order to send you more appropriate advertising (legal basis: Art. 6(1) (f) GDPR). These may include data relating to your socio-demographics (e.g. purchasing power, age, family structure), interests (e.g. affinity for sport, affinity for bonus programmes, affinity for green power), property information (e.g. number of households, age of building, location), technology (e.g. internet use, willingness to switch telecom/internet providers, internet speed) or generational typology.

2.10.10 Social media channels and fan pages

In this section we tell you about the processing of your personal data when you use VfL Wolfsburg’s social media channels and fan pages on Instagram, Facebook, Google+, YouTube and Twitter.

The fan page or social media channel that you visit gives you the opportunity to react to our articles, comment on them, write a user post yourself and send us private messages with personal enquiries. The data that you provide and which may be accessible to us in this context (e.g. user name, address, date of birth, pictures, interests) are only used by us for the purpose of communicating with customers and potential customers on the basis of an overriding legitimate interest (Art. 6(1) (f) GDPR). Our interest is to offer you a platform on which we show you current information and which enables you to send us your enquiry and us to respond to it as quickly as possible. Your enquiry is processed by means of a data processor. To the extent that we are able to do so, your data will be deleted when the fan page ceases operation.

In its ruling of 5 June 2018 (http://curia.europa.eu/juris/document/document.jsf?text=&docid=202543&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=298398) the European Court of Justice confirmed that the operator of the fan page and Facebook are joint controllers. VfL Wolfsburg concurs with this ruling and applies it to all the social media channels and fan pages it operates. Provider-specific information on data processing can be found in their respective privacy policies at:

Facebook Ireland Limited, 4 Grand Canal Square, Dublin2, Ireland, https://de-de.facebook.com/about/privacy/update.
Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA, , https://help.instagram.com/155833707900388
Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, https://www.google.de/intl/en/policies/privacy/.
Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA ,  https://twitter.com/privacy.

VfL Wolfsburg also uses a social media management tool from another service provider on the basis of its overriding legitimate interests in accordance with Art. 6(1) (f) GDPR and a data processing contract in accordance with Art. 28(3) GDPR. The tool is used at VfL Wolfsburg to plan and draft articles for the social media channels and fan pages, to monitor the channels and fan pages, to carry out market research and statistical analyses and to optimise our communication strategy based on the findings. With the help of the tool we can publish specific contents for various networks, platforms and channels, process user responses, search social networks and platforms for mentions and analyse all interactions with us and our communications activities.

Every time you interact with our online activities within social networks and fan pages the data that is saved in the profiles you use are stored. They include for example your name, gender, profile picture, profile URL, handle/user name. The times of your interactions with our online offerings are also recorded.

Please note that providers such as Facebook and Instagram may use their own tracking tools and cookies, regardless of how VfL Wolfsburg uses the fan page. Further information can also be found in their respective privacy policies.

2.11. Automated decision-making and profiling

Pursuant to Art. 22 GDPR, we generally do not use fully automated decision-making processes to establish and fulfil business relationships. Should we use such processes in isolated cases, we will notify you about them separately where we are required by law to do so.

We will process some of your data automatically with the aim of assessing certain personal characteristics (profiling). For example, we use profiling in the following cases:

• We are legally required to combat money laundering, the financing of terrorism and crimes endangering property. This includes the analysis of data (including during payment transactions). These measures also serve to protect you.
• We use analytical tools to enable us to inform and advise you in a targeted manner about products; these tools allow for targeted communication and advertising, including market and opinion research; see Item 2.10.4 for further details.
• We use scoring to assess your creditworthiness. In this process, we calculate the probability that customers will fulfil their contractual payment obligations. The calculation may involve income levels, spending, existing liabilities, profession, employer, duration of employment, experiences from the business relationship thus far, contractual repayment of earlier loans, and information from credit agencies. Scoring is based on an acknowledged and proven mathematical statistical method. The calculated scores help us in making decisions on product sales and are incorporated into our ongoing risk management processes.

2.12 VfL Wireless Network

VfL Wolfsburg provides a public wireless network for you as a guest in the Volkswagen Arena. For the provision of the network, it is necessary to log your confirmation of the terms of use. For this purpose, we store the MAC address of the terminal device used. The MAC address is stored for a period of one year. In addition, we collect the traffic data in accordance with § 96 of the Telecommunications Act (TKG) as far as this is necessary for the provision of the service; it is not stored.

C. Your rights

You may exercise the following rights in relation to VfL Wolfsburg at any time and at no cost:

Right of access under Art. 15 GDPR in conjunction with sections 29 and 34 of the German Federal Data Protection Act (BDSG): you are entitled to receive information from us on processing of your personal data.

Right to rectification under Art. 16 GDPR: you are entitled to insist that we rectify personal data pertaining to yourself that is incorrect or incomplete.

Right to erasure (“right to be forgotten”) under Art. 17 GDPR in conjunction with section 35 BDSG: you are entitled to insist on the erasure of your data, subject to the preconditions indicated in Art. 17 GDPR. For example, you may require the erasure of your data if they are no longer required for the purposes for which they were collected. You may also request that your data be erased if we process your data on the basis of your consent and you subsequently revoke this consent.

Right to restriction of processing under Art. 18 GDPR in conjunction with section 35 BDSG: you are entitled to require restriction of processing of your data subject to the preconditions contained in Art. 18 GDPR. For example, these preconditions will be fulfilled if you dispute the correctness of your data. You may then require the restriction of processing while the correctness of these data is reviewed.

Right to object: you are entitled to object to the processing of your data if they are being processed for an overriding interest or for the purpose of direct advertising. An objection is permitted if data are processed either in the public interest or in the exercise of public authority or on the basis of a legitimate interest of VfL Wolfsburg or a third party. If you object to data processing, please specify the reasons why you object to this data processing. You also have the right to object to data processing for direct advertising purposes. The same applies to profiling, provided that it is related to direct marketing.

Right to data portability under Art. 20 GDPR: you have the right to receive your data in a structured, commonly used and machine-readable format and to transfer these data to another data processor, provided that data processing is based on consent or contract fulfilment and that automated processing methods are used.

Right to revoke consent: If a data processing activity is based on your consent, you are entitled to revoke your consent to data processing at any time, with future effect and free of charge, by contacting datenschutz@vfl-wolfsburg.de or using the contact details provided in the legal notice. Please note that, even in case of a revocation, processing your data where this is required by law is not excluded.

Right to lodge a complaint with a supervisory authority under Art. 77 GDPR: you also have the right to complain to a supervisory authority (e.g. the data protection officer for Lower Saxony) regarding our processing of your data.

D. Changes to this data protection statement

We reserve the right to update this data protection statement from time to time. Any updates to this data protection statement will be published on our website. Any amendments will come into effect following their publication on our website. We therefore advise you to regularly visit this website in order to check whether this data protection statement has been updated.

E. Your data protection contacts

VfL Wolfsburg-Fußball GmbH is your initial contact for any data protection-related matters and in order to exercise your data protection rights. However, you can also directly contact our data protection officer at the following address: Data protection officer of VfL Wolfsburg-Fußball GmbH, Volkswagen AG, Berliner Ring 2, Brieffach 2, 38440 Wolfsburg or by sending an email to konzerndatenschutz@volkswagen.de.

We advise you to initially refer your enquiry to our direct contact:

VfL Wolfsburg Fußball GmbH
“Datenschutz“
In den Allerwiesen 1
38446 Wolfsburg
Germany
datenschutz@vfl-wolfsburg.de

> Data protection statement of VfL Wolfsburg-Fußball GmbH (as of 25 May 2018) (PDF, 677 KB)