Privacy Statement

DFL Deutsche Fußball Liga GmbH, Guiollettstrasse 44-46, D-60325 Frankfurt am Main ("DFL") collects, processes and uses personal data which has been captured from visits to the websites www.bundesliga.de and www.bundesliga.com (hereinafter together: the "Website") in compliance with the applicable data privacy provisions in the Federal Republic of Germany. This Privacy Statement sets out which data of the visitor ("User") is captured on the Website and how this information is processed and used.

 

1. Personal data

Personal data are all information which relate to an identified or identifiable natural person. A natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, for example, the name, personalized email addresses, the residential address, the telephone number or the date of birth.

 

2. Data collection, processing and use when accessing the Website

Each time a User accesses the Website, the User’s Internet browser, for technical reasons, automatically supplies the following data to DFL’s web server:

 

  • IP address of the end device
  • date and time of access
  • name and URL of accessed page
  • transferred data volume
  • access status (data file transmitted, data file not found, etc.)
  • recognition data of the used browser and operating system of the User's end device
  • name of the User’s Internet service provider
  • website from which the access was made

 

The collection, processing and use of these data occur for the purposes of enabling the use of the Website (connection set-up), system security and technical administration of the network infrastructure. A comparison with other data sets or a transmission to third parties, even in excerpts, does not take place.

 

The legal basis for processing is Art. 6 para. 1 b) General Data Protection Regulation (“GDPR”)].

 

With regard to data collection, processing, and use for the purpose of optimizing the Website through web analytics and the creation of User profiles, additional reference is made to Section 4 of this Privacy Statement.

 

3. Data collection, processing and use within the scope of the Services offered on the Website

The use of certain services on the Website, especially the Bundesliga Newsletter, the Official Fantasy Bundesliga and the Official Bundesliga Predictor, as well as newsletters with product information and other information from partners and licensees of DFL, requires prior registration, including the submission of personal data (name, residential address, telecommunications data, etc.) by the User ("Services").

 

The collection, processing and use of these personal data are carried out solely for the purpose of providing the User with the information and Services and only in the manner and extent to which the User has given prior express consent.

 

Any further use of such personal data for the purpose of sending additional product and service offerings, especially by DFL's cooperation partners, only takes place if the User has given prior express consent. The User can withdraw his or her issued consent at any time with effect for the future.

 

The following is a description of the basis of the data processing for the Services that are subject to registration:

 

3.1 Registration and Login

DFL uses the Customer Identity Management Platform provided by Gigya Inc. (USA) ("Gigya") for the registration for the Services and the login. The use of these data will only be processed for the purposes of enabling the use and the technical administration of the Service(s) selected by the User. The legal basis for processing is Art. 6 para. 1 a) GDPR and Art. 6 para. 1 b) GDPR.

 

3.2 Social Logins

The social login function which is also provided by Gigya allows the User to log in with his/her social media account at Facebook or Twitter. The legal basis for processing is Art. 6 para. 1 a) GDPR. The following privacy notices regarding the data transmission apply in addition to Clause 6 of this Privacy Statement for sharing the Website's content and to Clause 8 for the official Bundesliga Facebook fan page. 

3.2.1 Facebook

If the User logs in using Facebook, the following data transfers will take place:

 

- The transmission of information and user data (visited pages, activated fields) to Facebook, with the possibility for Facebook to merge these data with the data relating to the User. Data will then also be transmitted to the US with possible data access by national security authorities without ensuring an European level of data protection. Facebook is a registered member of the EU-US Privacy Shield.

- The transmission of certain information from the User’s Facebook account to DFL with the consequence that in addition to the data outlined in this Privacy Statement (IP address), the following information is transmitted to DFL:

-       Profile picture,

-       first name and last name,

-       email address,

-       gender,

-       language and

-       time zone.

 

IF THE USER DOES NOT WANT TO SHARE THIS INFORMATION, THE USER SHOULD USE THE REGULAR LOGIN VIA THE PASSWORD GENERATED BY HIM OR HER.

 

3.2.2 Twitter

If the User logs in using Twitter, the following data transfers will take place:

 

·         The transmission of information and user data (visited pages, activated fields) to Twitter with the possibility for Twitter to merge these data with the data relating to the User. Data will then also be transmitted to the US with possible data access by national security authorities without ensuring an European level of data protection. Twitter is a registered member of the EU-US Privacy Shield.

·         The transmission of certain information from the User’s Twitter account to DFL with the consequence that in addition to the data (IP address) outlined in this Privacy Statement (IP address) the following information is transmitted to DFL:

-       Profile picture, as well as

-       first name and last name.

 

IF THE USER DOES NOT WANT TO SHARE THIS INFORMATION THE USER SHOULD USE THE REGULAR LOGIN VIA THE PASSWORD GENERATED BY HIM OR HER.

 

3.3 "Keep me logged in" Function

When the User selects the function "Remember me", his/her login (email address, password) will be stored. After the end of a session (either through logging out or by clearing the User's browser’s history and cache) or at least after six months, the User must log in again. In order to prevent unauthorized account access, the User should not choose this function on a computer or device also used by others. If the User does not select this function, the User will be logged out automatically when closing his/her browser.

 

3.4 Special terms and conditions for specific Services

3.4.1 Bundesliga Newsletter

The User has been informed in detail about the nature, scope, location and purpose of the collection, processing and use of the personal data. The Users of the Bundesliga Newsletter are assigned a UserID, which allows DFL to determine when the respective Bundesliga Newsletter was opened and which links or functions from the respective Bundesliga Newsletter were activated. This tracking (tracing) takes place for the internal optimization of the Bundesliga Newsletter. These data will not be disclosed. The legal basis for this data processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in optimizing such services. Secondly, the User will not incur any particular disadvantages when comparing the User’s reasonable expectations based on his or her relation to DFL as the Website operator and newsletter provider.

 

If the User of the Bundesliga Newsletter does not want this tracking to take place, he/she can unsubscribe from the Bundesliga Newsletter.

 

3.4.2 Official Fantasy Bundesliga and Official Bundesliga Predictor

The User has agreed that in a case of winning, his/her first name and the first letter of his/her surname, as well as the country will be published in the official tele-media and/or social media of DFL, as well as that the ranking lists of the Official Fantasy Bundesliga and the Official Bundesliga Predictor are publicly available on the Website. Regarding the Official Bundesliga Predictor this also applies to the Users' predictions.

 4. Data collection, processing and use in the context of web analytics, creation of user profiles and measuring range

4.1 Web analysis with Google Analytics  

On the Website, DFL uses Google Analytics, a web analytics service provided by Google LLC (USA) ("Google"). Google Analytics uses cookies. Cookies are text files which are stored on a User’s end device and make it possible to analyze the use of the Website by its Users.

 

The information about the use of the Website by a User produced by the cookie is normally transmitted to a server of Google in the USA and stored there.

 

However, DFL has expanded Google Analytics with the code “gat._anonymizeIp();“ in order to assure anonymized collection of IP addresses (so-called IP masking). This means that the IP addresses of Users are shortened within the Member States of the European Union or in other States which are a party to the Convention on the European Economic Area before the transmission to the USA. So, the full IP address is transmitted to a server of Google in the USA and shortened there only in exceptional situations. Google is a registered member of the EU-US Privacy Shield.

 

Upon request of DFL, Google will use this information in order to analyze the use of the Website by the Users for the purpose of compiling reports about the Website activity to provide additional services to DFL which are related to the use of the Website and Internet use. Google does not combine the IP address of a User's browser with other data under Google Analytics.

 

The User can prevent the storage of cookies with a corresponding setting on the User's browser software. Furthermore, the User can prevent Google from collecting the data generated by the cookie and relating to his/her use of the Website (including the User’s IP address) by downloading and installing the browser plugin available via the following link. The User can also refuse the use of Google Analytics by clicking on the following link. An opt-out cookie which prevents the future collection of his/her data when visiting the Website will be placed: Disable Google Analytics. However, DFL hereby informs the User that in this case it is possible that the User cannot completely use all functions of the Website.

 

Further information about the terms and conditions of use and data protection are available in the Google Analytics Terms of Service and Google Analytics Overview .

 

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in evaluating the Website data for purposes of its optimization. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs (especially the above-mentioned measures).

 

4.2 Google Ad Manager for the insertion of online advertising

DFL uses Google Ad Manager (formerly: DoubleClick for Publishers (Small Business)) by Google to insert online advertising in the Website. This helps DFL to serve online advertisements to Users. DFL does only insert advertising marketed directly by DFL and no interest-related advertising of third party networks.

Google uses cookies which do not contain or store any personal data. Further information are available under the following link. The use of cookies by Google can be objected under the following link.

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, DFL also wants to use its invest for operating the Website for direct advertising. The User - after weighing his reasonable expectations based on his relationship with DFL as the Website operator - will not incur any particular disadvantages.

 

4.3 Web analysis for carrying out A/B and multivariate testing

Furthermore, DFL uses a web analytics service provided by Optimizely Inc. (USA) ("Optimizely") for the purpose of carrying out A/B and multivariate testing. Optimizely uses cookies to identify a User's browser and to analyse how Users use the Website.

 

The User can refuse the use of Optimizely by clicking on the following link . An opt-out cookie will then be placed on the User's end device, which prevents the future collection of the User's data when visiting this Website. However, DFL hereby informs the User that in this case it is possible that the User cannot completely use all functions of the Website.

 

Further information about the way of functioning of this web analytics service can are available in Optimizely's privacy statement .  

 

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in evaluating the Website data for purposes of its optimization. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs (especially the above-mentioned measures).

4.4 Web analysis for statistically analysis of the speed of the Website

 

Furthermore, DFL uses a plugin of the performance analysis service of Instana  Inc. (USA) ("Instana") which enables t DFL to statistically analyse the speed of the Website.

 

When a User visits a page of this Website which contains such a plugin, his/her browser builds up a direct connection to the servers of Instana. DFL has no influence on the scope of data collected by Instana and informs the User according to its current information.

 

By integrating the plugin, Instana receives the information that a User has accessed the corresponding page of the Website. If the user is logged in at Instana, Instana may assign the User’s visit to the Website to his/her account at Instana. If a User is not a member of Instana, there is still the possibility that Instana will detect and store his/her IP address.

 

The purpose and scope of data collection and the further processing and use of data by Instana, as well as the corresponding rights and settings to protect the privacy of users, can be found in Instana’s privacy policy .

 

If a User is a member of Instana and does not want Instana to collect data about them in order to combine them with the member data stored by Instana, the User must logout of Instana before visiting the Website.

 

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in evaluating the Website data for purposes of its optimization. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs (especially the above-mentioned measures).

 

5. Geolocation

On its Website, DFL uses the geolocation function of the provider Maxmind Inc. (USA (“Maxmind”).

 

At the point in time when the User clicks on a video, this function determines the countries in which the respective video can be viewed and verifies if this video can be viewed in the country in which the User’s end device is located or whether this cannot occur due to legal reasons.

 

This function is also used for displaying the broadcaster which offer live content of the Bundesliga in the country where the User is located.

 

Aside from this, the location data and movement data of the User are not stored with this function.

 

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in complying with the agreements with the national and international licensees of the media rights of the matches of Bundesliga and Bundesliga 2, as well as to inform the User about the reception of the broadcasting of these matches in the country of the respective User. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs (especially the above-mentioned measures).

 

6. Sharing of content

DFL provides Users with the opportunity to share the Website's content. The legal basis for the following processings is Art. 6 para. 1 a) GDPR.

 6.1 Use of social media platforms Facebook, Twitter, Google+ and WhatsApp

Users can share the Website's content on social media services provided by Facebook, Twitter, Google+ and WhatsApp.

 

The use of these plugins will normally result in the transfer of data to Facebook, Twitter, Google+ or WhatsApp with each content visited, without the User's explicit permission. Along with the web address of the content visited, an identifier will also be transmitted which enables a direct connection to be made between the User and his/her profile on the respective platform.

 

The platform operators do not pass on any specific details pertaining to what other data is transmitted. The platform operators are moreover constantly developing their services and make available information as to how the accompanying data is used. The currently valid data protection regulations of the platform providers can be found here: Facebook , Twitter,  Google+ and WhatsApp .

 

In order to prevent any unwanted transmission of Users' data to Facebook, Twitter, Google+ and WhatsApp and to give Users a choice as to whether they wish to use social media services, DFL only offers social sharing links. This ensures no data will be transferred to third parties without the permission of the User. Only when the User activates the social media services, therefore consenting to connect with Facebook, Twitter, Google+ and WhatsApp, the connection with their services will be established and the social sharing links be provided.

 

6.2 Email forwarding

The User can also share content of the Website via email by clicking on the email logo button or recommend this content. The email addresses of the recipients entered in by the User will not be used, processed or stored by DFL.

7. Other online services and applications

7.1 Live blogs and news ticker

DFL uses the service "ScribbleLive" from Scribble, Inc. (Canada) ("Scribble") and deltatre AG (“deltatre”) for content involving live blogs or news tickers.

 

When a User visits a page with a live blog or news ticker, his/her browser establishes a direct connection to the server of Scribble and/or deltatre. The User’s IP address and other device-related information are communicated. The respective live blog or news ticker also places temporary cookies on the User’s hard drive. This allows the User to take advantage of the respective live blog or news ticker’s interactive features. Tracking cookies, which allow the formation of user profiles, are not employed on the Website where the services from Scribble and deltrate service is embedded.

 

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in offering the best possible service. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs (no creation of user profiles). The User - after weighing his reasonable expectations based on his relationship with DFL as the Website operator - will not incur any particular disadvantages.

 

7.2 Feedback service

DFL uses the feedback service "Usabilla for Websites" from Usabilla B.V. (Netherlands) ("Usabilla") to collect feedback from Users, as well as to conduct online surveys, and to improve the Website. When a User uses the feedback form or the feedback button or participates in an online survey, a cookie will be placed on his or her end device and the User's browser establishes a direct link to Usabilla's server and the information entered by the User (e.g. first name and last name, email address), the User’s IP address, as well as other device-related information are transmitted. Further details can be found in Usabilla's privacy policy. The legal basis for processing is Art. 6 para. 1 a) GDPR.

 

7.3 Ticket system

DFL uses the ticket system from Zendesk Inc. (USA) (“Zendesk”) for processing submitted requests and problems.

 

Further information is available in the data privacy statement of Zendesk. Data will be transmitted to the United States under the terms of Zendesk's approved Zendesk Binding Corporate Rules, which have been approved by the European Data Protection Authority on 19 May 2017 and are available online.

 

The legal basis for processing is Art. 6 para. 1 a) GDPR.

 

7.4 Online quizzes, surveys and other interactive content

DFL uses a plugin from Apester Ltd. (Tel Aviv) ("Apester") to create and to offer online quizzes, surveys and other interactive content. If a User participates in such an online quiz, survey or other interactive content, Apester could collect certain information (e.g. IP addresses, device-related information) which can be considered as personal data under the applicable data privacy provisions in the Federal Republic of Germany. Further information about the collection and of the processing of this

information through Apester can be found in Apester's privacy policy.

The legal basis for processing is Art. 6 para. 1 f) GDPR, whereby the legitimate interest for DFL results from the fact that, in the first place, DFL has an interest in offering the best possible service with regard to implemented services and applications. Secondly, a data subject can reasonably foresee that data might possibly be processed for this purpose at the time the personal data is collected and in light of the circumstances under which this occurs. The User - after weighing his reasonable expectations based on his relationship with DFL as the Website operator - will not incur any particular disadvantages.

7.5 Calendar function

On its Website, DFL uses the service "calovo" from calovo GmbH (Germany) to give Users the opportunity (e.g. via download of the dates, via synchronisation or via download of the calovo APP) to add single or multiple matches of the clubs of the Bundesliga and Bundesliga or the whole match schedules of the Bundesliga and Bundesliga 2 to the calendar of their end device. Further details can be found in the privacy statement of calovo GmbH. The legal basis for processing is Art. 6 para. 1 a) GDPR.

8. Special provisions for the official Bundesliga Facebook fan page

For the use the official Bundesliga Facebook fan page, DFL has chosen the most privacy friendly filter settings possible.

Facebook's information about data usage can be found at the following link. The most relevant passages of this data handling information for the fan page are as follows:

"Information and content you provide.

  • We collect the content, communications and other information you provide when you use our Products, including when you sign up for an account, create or share content and message or communicate with others. This can include information in or about the content that you provide (e.g. metadata), such as the location of a photo or the date a file was created. It can also include what you see through features that we provide, such as our camera, so we can do things such as suggest masks and filters that you might like, or give you tips on using portrait mode. Our systems automatically process content and communications that you and others provide to analyse context and what's in them for the purposes described below. Learn more about how you can control who can see the things you share.
  • Data with special protections: You can choose to provide information in your Facebook profile fields or life events about your religious views, political views, who you are "interested in" or your health. This and other information (such as racial or ethnic origin, philosophical beliefs or trade union membership) is subject to special protections under EU law.
  • Networks and connections. We collect information about the people, Pages, accounts, hashtags and groups that you are connected to and how you interact with them across our Products, such as people you communicate with the most or groups that you are part of. We also collect contact information if you choose to upload, sync or import it from a device (such as an address book or call log or SMS log history), which we use for things such as helping you and others find people you may know and for the other purposes listed below.
  • Your usage. We collect information about how you use our Products, such as the types of content that you view or engage with, the features you use, the actions you take, the people or accounts you interact with and the time, frequency and duration of your activities. For example, we log when you're using and have last used our Products, and what posts, videos and other content you view on our Products. We also collect information about how you use features such as our camera.
  • Information about transactions made on our Products. If you use our Products for purchases or other financial transactions (such as when you make a purchase in a game or make a donation), we collect information about the purchase or transaction. This includes payment information, such as your credit or debit card number and other card information, other account and authentication information, and billing, delivery and contact details.
  • Things others do and information that they provide about you. We also receive and analyse content, communications and information that other people provide when they use our Products. This can include information about you, such as when others share or comment on a photo of you, send a message to you or upload, sync or import your contact information
  • Provision of measurements, analyses and other business services. We use the information at our disposal (including your activities outside of our products, such as the websites you visit and the ads you see) to help advertisers and other partners measure the effectiveness and distribution of their ads and services and to understand the types of people who use their services and how people interact with their websites, apps and services. So we share information with these partners."

9. Limited purpose for processing and using personal data

All processing or use of personal data of the User occurs only for the purposes mentioned in this Privacy Statement and to the extent necessary to achieve the respective purpose.

 

Personal data are not published by DFL or disclosed to unauthorized third parties.

 

Transmissions of personal data to government agencies and public authorities occur only in accordance with mandatory national provisions in the law or if the disclosure is necessary in the case of attacks on the network infrastructure in order to pursue rights and for purposes of criminal prosecution. The legal basis for this processing is Art. 6 para. 1 c) GDPR in conjunction with § 24 para. 1 no. 1 b) German Data Protection Act [Bundesdatenschutzgesetz, "BDSG"].

 

10. Storage and deletion of personal data

All stored personal data and pseudonymized usage data are deleted immediately and permanently as soon as the data are no longer needed for the purposes for which they were collected or the User demands this unless DFL is required by law to do preserve the data. If DFL is required on the basis of provisions in the law to preserve the data, the stored personal data and pseudonymized usage data will be permanently deleted upon expiration of the time periods for preserving data required by law.

 

11. Security

DFL uses technical and organizational security measures in order to protect the personal data of the Users against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security measures are continuously adapted in accordance with technological developments.

12. Links to other websites

The Website may contain links to other websites. This Privacy Statement applies solely to the Website of DFL. DFL has no influence over, and does not control whether other providers comply with applicable data privacy provisions.

 

13. Rights of the User

The User has a right to information with regard to the stored personal data of the User. The User also has a right to have incorrect data corrected and to restriction of the processing and to have data deleted, as well as a right to object against the processing and the right for data transferability.

 

The User can contact DFL by email at info@bundesliga.com. The data privacy officer of DFL can be contacted at dataprivacy@bundesliga.com. Please note that only data privacy-related messages will be answered at this email address. For all other inquiries please use the email address info@bundesliga.com.

 

It is pointed out that there is a right to file an objection with the supervisory authority.

14. Applicability, validity and timeliness of the Privacy Statement

The provisions in this Privacy Statement on collection, processing and use of the User’s data apply for the User when using the Website. This Privacy Statement is current and is dated as of 20 August 2018. DFL reserves the right to amend this Privacy Statement at any time as needed with effect for the future, especially for the purposes of adaption to a further development of the Website or the implementation of new technologies.