Contents

I.    Name and address of the controller
II.   Contact details for the data protection office
III.  General information on data processing
IV.  Making the website available and creation of log files
V.   Use of cookies
1.   Technically necessary cookies
2.   Cookies to analyse surfing behaviour
3.   Cookies for advertising purposes and social media
VI.  Login/registration
VII. Contact form and e-mail contact
VIII.    Newsletter
IX.  Dissemination within the Group
X.   Your rights
1.    Right to withdraw consent to data processing (Article 7(3) GDPR)
2.    Right of access (Article 15 GDPR)
3.    Right to rectification (Article 16 GDPR)
4.    Right to erasure/"right to be forgotten” (Article 17 GDPR)
5.    Right to restriction of processing (Article 18 GDPR)
6.    Notification obligation (Article 19 GDPR)
7.    Right to data portability (Article 20 GDPR)
8.    Automated individual decision-making, including profiling (Article 22 GDPR)
9.    Right to object (Article 21 GDPR)
10.  Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

I.     Name and address of the controller

The controller, within the meaning of the European General Data Protection Regulation, is::
Borussia Dortmund GmbH & Co. KGaA 
Rheinlanddamm 207-209 
44137 Dortmund
Deutschland
Phone: 02 31 - 90 20 0
E-Mail: datenschutz@bvb.de
Website: www.bvb.de

II.    Contact details for the data protection officer

You can contact the data protection officer at:
The data protection officer
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207-209 
44137 Dortmund
Deutschland
Phone: 02 31 - 90 20 0
E-Mail: datenschutz@bvb.de
Website: www.bvb.de

III.    General information on data processing

Protecting your personal data is very important to us. We process your data primarily in order to provide a functional website that is easy to use. We want to make sure that you can use our content and the products and services we offer via these websites.
Furthermore, we only process your data if and to the extent that this is permitted by the statutory provisions. Please refer to the sections below for further information.

IV.    Making the website available and creation of log files

Every time you visit our website, our system automatically collects data and information concerning your computer system. The data collected includes the following::
(1)    Information on the browser type and the version used
(2)    Your operating system
(3)    Your IP address
(4)    Date and time of access
(5)    Websites from which your system accesses our website
(6)    Websites accessed by your system via our website

This data is saved in our system’s log files. The data referred to above is not saved together with other personal data.

Our system has to save your IP address temporarily so that the website can be displayed on your computer. Your IP address has to remain saved for the duration of your visit to the website. This means that storage in log files enhances the functionality of the website. We also use this data to optimise our website and protect our IT systems. The data is not used for marketing purposes within this context.  The legal basis for the temporary storage of the data and the log files is Article 6(1) (f) of the General Data Protection Regulation (hereinafter referred to as the “GDPR”). The data is stored for as long as is necessary to achieve the purpose for which it was collected. If data is required to make the website available, this data is deemed to no longer be required when the session in question ends. The data is then deleted automatically. As far as the storage of data in log files is concerned, this data is no longer required after seven days at the latest. If, however, we continue to save the data referred to above, your IP address will be erased or modified so that it can no longer be matched with the Internet connection that accessed the site.

The recording of data to make the website available and the storage of data in log files are absolutely essential for the operation of the website.

V. Use of cookies

We use what are known as “cookies” on our website. Cookies are text files that are stored in/by your Internet browser on your computer system. When you access our website, a cookie may be stored on your system. The cookie contains an individual character string that can be used to identify your browser the next time you visit the website.

Sections 1 (“Technically necessary cookies”) and 2 (“Cookies to analyse surfing behaviour”) below provide details on the types of cookies that we use and the data processed in each case.
Unless the sections below refer to different deletion periods, the following applies in summary to the storage period, irrespective of the type and purpose of the cookies:
You have full control over the use of cookies. They are saved on your computer and the data is then transmitted from your computer to us. While most browsers are configured to  accept cookies by default, you can change your browser settings to deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. You can also change your browser settings so that cookies are deleted automatically. If cookies are generally deactivated for our website, you may no longer be able to use all of the website functions in full.
When you visit our website, an information banner will draw your attention to the aforementioned use of cookies and to this Privacy Policy. We would ask you to consent to the use of cookies by clicking on the “I agree” button.

You can object to the use of cookies at any time. You can do this either by not agreeing to the use of cookies when the banner is displayed in the first place, or by changing your browser settings accordingly.

1.  Technically necessary cookies

Some functions of our website require your browser to be recognised again even after you move to a different site. It would be impossible to offer these functions without the use of cookies. The cookies save and transmit the following data:
(1)    Session-ID im Login-Cookie
Cookies are a technical requirement for the following purposes:
(1)    Login
If you object to the use of these cookies or configure your browser accordingly, our website will not recognise your browser and you may not be able to access certain content, or data (e.g. from an input mask) may be lost. The information set out in section V. applies with regard to the storage period for technically necessary cookies.

2.  Cookies to analyse surfing behaviour

Our website also uses cookies that allow your surfing behaviour to be analysed. Technical measures are in place to pseudonymise the data collected by these cookies. This means that the data can no longer be traced back to you. This data is not saved together with your other personal data.

The following data can be transmitted within this context:

(1)    Frequency of page views
(2)   Use of website functions

We use analysis cookies to improve the quality of our website and its content. The analysis cookies show us how the website is being used, allowing us to optimise the products and services we offer on an ongoing basis. These purposes also establish our legitimate interest in the processing of the personal data pursuant to Article 6(1) (f) GDPR.

If you object to the use of these cookies or configure your browser accordingly, this will not have any disadvantages for you. All of the website functions will remain available. The information set out in section V. applies with regard to the storage period for cookies to analyse surfing behaviour.

We use the following services based on analysis cookies on our website:

a)    Google Analytics

We use Google Analytics, a web analytics service provided by Google, 1600 Amphitheatre Parkway , Mountain View, CA 94043, USA (hereinafter referred to as: “Google”). This service uses cookies. Data generated by the cookie about your use of the website is usually transmitted to a Google server in the U.S. and stored there.

Google will use this information on our behalf to evaluate the use of our website, to compile reports on the activities within this website and to provide us with further services relating to the use of this website and the use of the Internet. Pseudonymous user profiles can be created using the data that is processed within this context.

We only use Google Analytics with IP anonymisation enabled. This means that Google truncates your IP address within Member States of the European Union or other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the U.S. and truncated there. The IP address transmitted from your browser is not merged with other data from Google. You can prevent the storage of cookies by configuring your browser software accordingly; you can also prevent Google from storing the data relating to your use of the website generated by the cookie and from processing this data by downloading and installing the browser plug-in that is available at the following link:

http://tools.google.com/dlpage/gaoptout?hl=de.

You can find further information on how Google uses data for advertising purposes, as well as on your options for configuring your settings and for raising objections, on Google’s website: https://www.google.com/intl/de/policies/privacy/partners/ (“How Google uses information from sites or apps that use our services”), http://www.google.com/policies/technologies/ads (“How Google uses cookies in advertising”), http://www.google.de/settings/ads (“Manage the information Google uses to show you ads”) and http://www.google.com/ads/preferences/ (“Choose which ads Google shows you”).

As an alternative to the browser add-on or within browsers on mobile devices, please follow this link to prevent Google Analytics from collecting data on this website in the future. This will store an opt-out cookie on your device. The opt-out cookie stores the information that we are not allowed to use your data for Google Analytics. If you delete the cookies you have saved, you will need to click on this link again. The information set out in section V. applies with regard to the storage period for the cookies.

3. Cookies for advertising purposes and social media

We use third-party cookies to learn more about your surfing behaviour (web tracking), so that we only show you the advertisements that you actually want to see. Within this context, the processing of your data is based on a legitimate interest and on Article 6(1) (f) GDPR. When you access our website, you will see a banner asking for your permission. This means that Article 6(1) (a) GDPR is an additional legal basis.
a) Google AdWords

Our website uses Google AdWords, an online advertising tool developed by Google that enables what is known as “remarketing”. This enables customised advertising based on your surfing habits on other websites in the Google Display Network (Google, “Google Ads” and other websites). Your surfing behaviour on our website is analysed so that advertisements matching your interests can be displayed on other websites. In order to achieve this, Google uses cookies to identify your browser on a specific computer, but not a specific individual or user. No personal data is stored.

We only use Google AdWords with IP anonymisation enabled. This means that Google truncates your IP address within Member States of the European Union or other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the U.S. and truncated there. The IP address transmitted from your browser is not merged with other data from Google. You can prevent the storage of cookies by configuring your browser software accordingly; you can also prevent Google from storing the data relating to your use of the website generated by the cookie and from processing this data by downloading and installing the browser plug-in that is available at the following link: https://policies.google.com/technologies/ads?hl=de. We also use what is known as “conversion tracking”, which is also part of Google AdWords. When you click on an ad placed by Google, a corresponding cookie is stored on your system. Once again, this does not involve the processing of any personal data or other data that can be used to identify the specific user or an individual. The cookie is used to generate statistics on “conversion rates”, which, to put it simply, show how visits to a page relate to the use of the services offered. Cookies for conversion tracking by Google AdWords become inactive after 30 days. You can find information on how to disable personalised advertising and conversion tracking by Google here:

https://support.google.com/ads/answer/2662922?hl=de

b) Facebook Retargeting Pixel

Due to our legitimate interests in the analysis, optimisation and commercial operation of our website, our website uses the “Custom Audiences Pixel” offered by Facebook Inc., 1 Hacker Way, 94025 Menlo Park, USA, or, if you are based in the EU, by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”). This allows interest-based advertisements to be shown to visitors to our website when they visit the social network Facebook. A Facebook pixel has been implemented on our website for this purpose. This pixel establishes a direct connection to the Facebook servers when you visit our website. The Facebook server is notified that you have visited our website, and Facebook assigns this information to your personal Facebook user account. For more information on how Facebook collects and uses our data, as well as on your rights and the options available to you to protect your privacy, please refer to Facebook's Data Policy at https://www.facebook.com/about/privacy/. You can object to interest-based advertising on Facebook at https://www.facebook.com/settings/?tab=ads#_=_. You need to be logged in to Facebook to do this.

c) Smart

We use "Smartadserver", an online tool for displaying interest-based advertising, on our website. The platform allows you to opt out so that your browser is no longer tracked by the system. Please note that a cookie is stored on your device in order to ensure the activation of your opt-out. In addition, the opt-out is only available for the device on which it was activated. If you want to switch off the tracking function, please click here. A blank page will open confirming that the opt-out process is complete and that Smart will no longer be saving any cookies on your computer.

You can withdraw your consent at any time directly on the website.

The cookie details are set out below:

The list below shows the cookie data that we use, its purpose, storage duration and content:

[http://www.smartadserver.com/diffx/optout/IABOptout.aspx]

VI. Log-In/Registrierung

You can use large parts of our website without registering and entering your personal data. We allow you to register for the login area voluntarily to receive access to exclusive content and information.

In order to do so, you have to enter your data in the input mask provided. The data is transmitted to, and saved by, us. The data is not transmitted to third parties. The following data is collected as part of the registration process:

(1)   Personal details (name, address, date of birth)

(2)   e-mail address

In addition, the following data is saved when you register:

(1)   Your IP address

(2)   Date and time of registration

Your registration also registers you for

  • the BVB FanShop, available at: www.shop.bvb.de – operated by BVB Merchandising GmbH, Rheinlanddamm 207-209, 44137 Dortmund, Germany, tel.: +49 231 90200, fax: +49 231 9020-3500, e-mail: service@bvb.de – (Read the FanShop privacy policy at: [LINK to FanShop data protection])
  • the BVB Ticketshop, available at: https://www.eventimsports.de/ols/bvb/, operated by CTS EVENTIM Sports GmbH, Hohe Bleichen 11, 20354 Hamburg, Germany, fax: +49 40 380 788-598, e-mail: info@eventimsports.de – (Read the BVB TicketShop privacy policy at: [LINK to TicketShop data protection]

BVB total!, available at: www.bvbtotal.de, operated by Sports & Bytes GmbH, Rheinlanddamm 207-209, 44137 Dortmund – (Read the BVB total! privacy policy at: www.bvbtotal.de in the section entitled “Datenschutz” (Data protection)). Borussia Dortmund is seen as a single entity by its fans and customers and not as a collection of individual legal entities. This is why Borussia Dortmund offers you an integrated package when you register. From a fan’s perspective, it does not make sense to register for several different services and have to remember several different login details simply because of the club and group structure.

If you decide not to provide the aforementioned data by registering, we will not be able to

-  grant you access to the exclusive consent offered by the login area of the www.BVB.de website,

-  insert your details automatically when you buy tickets or make purchases in the FanShop later on, send you offers that are tailored to suit your needs,

-  inform you of special offers and discounts.

You can cancel your registration at any time. You can also change the data you have saved at any time. You can also withdraw the consent you granted when you registered at any time. In order to do so, simply send us an informal message to this effect using the contact details set out above. Your data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. As far as the data collected in connection with your registration is concerned, this is generally the case if you cancel your registration/delete your account.

If this data is also required for the performance of a contract or in order to take steps prior to entering into a contract, however, the data can only be erased prematurely if this is permitted on the basis of contractual or statutory obligations. We may be under a contractual or statutory obligation to save data even after a contract has been terminated (e.g. for tax-related reasons). The storage periods that apply in this respect vary depending on the individual contracts and contracting parties.

VII. Contact form and e-mail contact

You can contact us using various contact forms on our website or by sending us an e-mail. If you enter data in the input mask provided for this purpose on the contact form, this data will be transmitted to, and processed by, us. This includes the following data.

(1)   Subject matter of/reason for the contact enquiry
(2)    Your Name
(3)    e-mail address
(4)   Message

As soon as your message is sent, the following other data is also saved:

(1)   Your IP address

(2)   Date and time at which the message was sent

To enable the processing of data for correspondence purposes, we ask for your consent before the message is sent and draw your attention to this Privacy Policy. In this respect, the legal basis for the data processing is Article 6(1) (a) GDPR.

The processing of other data (e.g. connection data) during the sending process is designed to prevent the misuse of the contact form and to ensure the security of our IT systems. In this respect, the legal basis is Article 6(1) (f) GDPR.

If you contact us using the e-mail address provided, the personal data transmitted along with your e-mail will be saved. In this respect, the legal basis for the processing of your data is Article 6(1) (f) GDPR, as we have a legitimate interest in this regard. If you contact us using the form or by e-mail in connection with the conclusion of a contract, Article 6(1) (b) GDPR also forms the basis for the processing. We only process personal data from the input mask or e-mails in order to process your enquiry. The data is not transmitted to third parties.

Your data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In cases involving personal data from the contact form input mask and data transmitted by e-mail, this applies when the correspondence with you has ended. The correspondence is deemed to have ended when the circumstances indicate that the matter in question has been resolved with definitive effect.Additional personal data collected during the sending process is erased after a period of seven days at the latest.

You can withdraw your consent to the processing of the personal data at any time. If you contact us by e-mail, you can object to your personal data being saved at any time. In order to do so, simply send us an informal message to this effect using the contact details set out on page 1.

If you object, however, we will not be able to process your e-mail.

If the data is required for the performance of a contract or in order to take steps prior to entering into a contract, the data can only be erased prematurely if this is permitted on the basis of contractual or statutory obligations. The storage periods that apply in this respect vary depending on the individual contracts and contracting parties.

VIII.    Newsletter

You can sign up for our free newsletter. To do so, you enter your data in the input mask provided and your data is transmitted to us. Your e-mail address is recorded when you sign up for the newsletter.

As soon as your message is sent, the following other data is also saved:

(1)  Your IP address
(2)  Date and time of registration

Before you submit your data, we ask you to consent to the processing of your data and draw your attention to this Privacy Policy. Your data is processed with your consent. In this respect, the legal basis is Article 6(1) (a) GDPR.

After you sign up, you will receive an e-mail asking you to confirm your subscription. This confirmation is necessary to ensure that nobody can subscribe using e-mail addresses that are not their own. Newsletter subscriptions are logged in order to be able to furnish evidence of the subscription process in accordance with the legal requirements. This includes saving the time of registration and confirmation and the IP address you used. Since the processing of the data is also necessary in order to deliver the newsletter you have subscribed to, Article 6(1) (b) and Article 6(1) (f) GDPR also serve as the legal basis.

You can cancel your subscription to the newsletter at any time or object to receiving further newsletters. Each newsletter contains a link to the form allowing you to unsubscribe. This means that we also allow you to withdraw your consent to the storage of your data at the same time. You can also, however, withdraw your consent by sending us an informal message to this effect using the contact details set out on page 1.

Your data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Your e-mail address is stored for as long as you remain subscribed to the newsletter. In general, we erase the other personal data collected as part of the subscription process seven days after it is collected.

If the data is required for the performance of a contract or in order to take steps prior to entering into a contract, however, the data can only be erased prematurely if this is permitted on the basis of contractual or statutory obligations. We may be under a contractual or statutory obligation to save data even after a contract has been terminated (e.g. for tax-related reasons). The storage periods that apply in this respect vary depending on the individual contracts and contracting parties.

IX.   Dissemination within the Group

Provided that you grant us your consent, address and order data will also be collected and processed for our own marketing purposes and for those of the group companies BVB Merchandising GmbH; Sports & Bytes GmbH; BVB Event & Catering GmbH; besttravel Dortmund GmbH, all based at Rheinlanddamm 207-209, 44137 Dortmund, and Ballspielverein Borussia 09 e.V. Dortmund, Strobelallee 50, 44139 Dortmund. The legal basis in this respect is Article 6(1) (a) GDPR. In certain circumstances, we can also process your data within the Group based on a legitimate interest. In this respect, the legal basis is Article 6(1) (f) GDPR.

You can object to the data processing based on the legitimate interest and/or withdraw your consent to data processing. In order to do so, simply send us an informal message to this effect using the contact details set out on page 1.

Your data is erased as soon as it is no longer required to achieve the purpose for which it was collected.

X. Your rights

The information below summarises your rights under the General Data Protection Regulation.

1. Right to withdraw consent to data processing (Article 7(3) GDPR)

You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, you will be informed thereof.

2. Right of access (Article 15 GDPR)

- the purposes of the processing;

- the categories of personal data concerned;

- to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;

- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

- the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you by us, or to object to such processing by us;

- the right to lodge a complaint with a supervisory authority;

- where the personal data is not collected from you, any available information as to its source;

- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and – in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Where personal data is transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards to ensure that the provisions of the GDPR are adhered to at the level of these recipients as well.

3. Right to rectification (Article 16 GDPR)

You can request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

4. Right to erasure/"right to be forgotten” (Article 17 GDPR)

You have the right to ask us to erase data where one of the following grounds applies:

  • The data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • You withdraw the consent on which the processing is based and there is no other legal ground for the processing.
  • You object to the processing pursuant to Article 21(1) GDPR on grounds relating to your particular situation and there are no overriding legitimate grounds for the processing.
  • You object to the process for direct marketing purposes pursuant to Article 21(2) GDPR
  • The data has been unlawfully processed;
  • The erasure of the data is required to comply with a legal obligation under European or German law.
  • The data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If we have made your data public and are obliged to erase it, then, taking account of available technology and the cost of implementation, we shall take reasonable steps to inform the controllers that you have requested the erasure.

5.  Right to restriction of processing (Article 18 GDPR)

Pursuant to Article 18 GDPR, we may only process data subject to restrictions in the following cases. This is the case if:

  • you contest the accuracy of your data, for a period enabling us to verify the accuracy of the data.
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  • we no longer need the data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
  • you objected to processing pursuant to Article 21(1) GDPR on grounds relating to your particular situation pending the verification whether our legitimate grounds for processing override your interests.

If processing has been restricted, we may only save this data. Data may then only be processed further with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

You can withdraw your consent granted in this regard at any time.

We will inform you before the restriction is lifted.

6.  Notification obligation (Article 19 GDPR)

We are obliged to communicate any rectification or erasure of your data or restriction of processing to all recipients to whom your data has been disclosed, unless this proves impossible or involves disproportionate effort. We shall inform you about those recipients if you request this.

7.  Right to data portability (Article 20 GDPR)

You have the right to receive the data concerning you which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to ask us to transmit this data to a third party where

  • the processing is based on consent or on a contract and
  • the processing is carried out by automated means.

You have the right to have the data transmitted directly to the third party where technically feasible. This right shall not adversely affect the rights and freedoms of others.

8. Automated individual decision-making, including profiling (Article 22 GDPR)

Your data is not used on our website for decisions made exclusively based on automated processing (e.g. profiling).

9. Right to object (Article 21 GDPR)

If we process your data based on a legitimate interest (Article 6 (1) (f) GDPR), you have the right to object to this on grounds relating to your particular situation. This also applies to profiling based on these provisions. In such cases, we will no longer process your data unless we demonstrate compelling legitimate grounds for doing so. These must override your interests, rights and freedoms, or the processing must serve the establishment, exercise or defence of legal claims. Where we process your data for direct marketing purposes, you have the right to object to the processing of the data. This includes profiling to the extent that it is related to such direct marketing. After you object, your data will no longer be processed for such purposes. In order to object, simply send us an informal message to this effect using the contact details set out on page 1.

10.  Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of the data relating to you infringes the General Data Protection Regulation. This shall not affect any other administrative or judicial redress to which you may be entitled.