Terms

Privacy Statement and Cookie Directive

 

As the controller within the meaning of the European General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act [“BDSG”, Bundesdatenschutzgesetz], DFL Deutsche Fußball Liga GmbH, Guiollettstraße 44-46, 60325 Frankfurt am Main, Germany, (“the DFL“) collects, processes and uses personal data that is collected and stored during visits to and use of the website commonground.bundesliga.com (the “Website“), in compliance with the data privacy regulations applicable in the Federal Republic of Germany, particularly the GDPR and the BDSG. This Privacy Statement und Cookie Policy (hereinafter collectively: the “Statement”) sets out which personal data regarding visitors to the website (hereinafter: “Users“) is collected and how this data is processed.

 

  1. Data collection and processing during visits to the Website

Every time a User accesses the Website, the User’s web browser automatically transfers the following data to the DFL’s web server for technical reasons:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the page accessed
  • Quantity of data transferred
  • Access status (file transferred, file not found etc.)
  • Identification data of the browser and operating system used on the User’s device
  • Name of the User’s internet service provider
  • Website from which the access takes place

The collection and processing of this data occur for the purposes of enabling the use of the Website (establishing a connection), system security and the technical administration of the network infrastructure. The data will not be compared with other sets of data or passed on to third parties either in whole or in part.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The DFL legitimate interest is based on the aim of providing the Users a secure and functioning Website.

Additional reference is made to Clause 4 with regard to the collection and processing of data for analysing the use of the Website and its content as well as the optimisation of the Website through web analytical services.

 

  1. Playing videos

The DFL embeds videos on the Website using “JW Player” software solution from Longtail Ad Solutions, Inc. (USA).

For legal reasons, the DFL is not permitted to make the videos shown on the Website available in certain countries. To ensure this, when the User selects a video, the User’s current location is transmitted to JW Player via the IP address of the User’s device in order to verify the authorisation to play the relevant video in the countries approved by the DFL. The IP address is used to check whether playing the video is permitted in the country in which the User’s device is currently located or whether this must be avoided for legal reasons. In the latter case, the User will be shown only a notice to that effect instead of the video. This information will remain intact only for the duration of this check on the device and will then be deleted; furthermore, it will not be stored or transferred to a back-end system. Apart from the User’s IP address, JW Player does not process any personal data, and it records only the video play counts.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of the DFL is based on compliance with the existing contractual agreements with its national and international licensees for the media rights to the matches of the Bundesliga and Bundesliga 2.

 

  1. Data collection and processing in the context of the use of interactive maps

On the Website, the DFL uses the service of MapBox Inc., 740 15th Street NW, 5th Floor, Washington, District of Columbia 20005, USA (“Mapbox”) to display interactive maps directly on the Website and to enable the User to interact with these maps.

When using this service, information about the User’s use of the website (such as the User’s IP address) is transmitted to Mapbox servers and stored there. These servers may be located in the United States. If the level of data protection there is not comparable to that in the EU, Mapbox will secure this data transfer by means of EU standard contractual clauses.

More information on the processing of personal data by Mapbox can be found in the Terms of Service and the Mapbox Privacy Policy.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of the DFL results from the fact that the DFL wants to present the content of this Website in the best possible and most user-friendly way.

 

  1. Data collection and processing in the context of web analysis

The DFL uses Matomo, an open-source analytics application developed by InnoCraft Ltd., New Zealand (“Matomo”) to analyse use of the Website and its content. This application is installed locally on the DFL’s servers. The DFL uses the application without cookies.

Matomo collects and stores the following data:

  • Two bytes of the IP address of the User’s system used to access the Website
  • Website accessed
  • Website from where the User arrived at the accessed web page (referrer)
  • Sub-pages which are accessed from the accessed Website
  • Time spent on the Website
  • Frequency at which Website is accessed

Repeat users are identified by way of a config_id. This is a random character sequence that is calculated using the first two bytes of the IP address, the browser plugin, the operating system and the User’s selected browser language, and then hashed. The ID is deleted and a new one created after 24 hours so that the Website cannot reidentify the User when visiting again.

Using the IP2Location™ IP-Country-Region-City-ISP Database [DB4] features from Hexasoft Development Sdn Bhd, Malaysia, (“ip2location”) likewise installed locally on the DFL’s servers, additional geolocation information (country, region, town or city) is also collected and stored cumulatively on the basis of IP addresses.

Collection and processing take place only on the DFL’s servers. The data will not be passed on to Matomo or any other third parties.

Matomo and ip2location are set up to ensure that IP addresses are not stored in their entirety; instead, two bytes of each IP address are masked (e.g. 192.168.xxx.xxx). This renders it impossible to attribute the abbreviated IP address to the specific device used.

A User can prevent such an analysis by using the following opt-out. An iFrame for the opt-out will be loaded when opening the Statement and a session cookie with the name “matomo_sessid” will be generated within this iFrame. This cookie checks whether the opt-out has already been activated.

 

 

However, the DFL hereby informs the User that in this case, it is possible that the User may not be able to use all functions of the Website to their fullest extent. If the User chooses to opt-out, a cookie with the name “matomo_ignore” and a lifetime of 30 years will be set on the User’s device, which prevents Matomo from storing incoming scripts from the Website. Furthermore, another cookie with the name “mtm_consent_removed” and a lifetime of 30 years will be set. This cookie signals to DFL’s system not to process or analyse the User’s data. If the User later clears the cookies on their device, these opt-out cookies will also be cleared and will need to be reinstalled.

Further information on privacy can be found in Matomo’s privacy policy.

The legal basis for this processing is Art. 6 para. 1 sentence 1 f) GDPR, whereby the DFL’s legitimate interest in the processing is the evaluation of Website data for the purpose of optimising it.

 

  1. Cookies

The DFL uses different cookies on the Website. Cookies are small text files that are stored on the User’s end device and allow to recognize this end device. The Users have the option to adjust their browser’s settings to prevent it from accepting the storage of cookies. Please note that in that case that certain parts of the Website may not work.

The following functional cookies are used on the Website:

Name Domain First Party / Third Party Lifespan Description
matomo_ignore bundesliga.com First Party 30 years This cookie from Matomo provided by InnoCraft Ltd. (New Zealand) is set if the User chooses to opt-out (see Clause 4). It prevents Matomo from storing incoming scripts from the Website.
mtm_consent_removed bundesliga.com First Party 30 years This cookie from Matomo provided by InnoCraft Ltd. (New Zealand) is set if the User chooses to opt-out (see Clause 4). This cookie signals which signals to our system not to store process or analyse the User’s data.
wp-wpml_current_language commonground.bundesliga.com First Party 1 day This cookie is used to store language settings.

These cookies enable the DFL to provide enhanced functionality and personalisation on the Website. These cookies can be set by the DFL or its processors whose services DFL added to the Website. If the User does not allow these cookies, then some or all of these services may not function properly. The legal basis for the use of these cookies are the legitimate interests of the DFL pursuant to Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of the DFL results from the fact that the DFL wants to offer a Website with as many functions and interesting content as possible.

 

  1. Data forwarding to third parties

Aside from the cases outlined, the DFL will forward personal data to third parties only if it is authorised or obliged to do so. This is the case particularly if the DFL transfers personal data to government agencies and authorities in accordance with mandatory national legislation or if forwarding is necessary for the purpose of legal action or criminal prosecution in the event of attacks on network infrastructure. The legal basis for this processing is Art. 6 para. 1 sentence 1 c) GDPR in conjunction with Section 24 para. no. 1 BDSG.

 

  1. Storage and deletion of personal data

All stored personal data and pseudonymised usage data will be deleted immediately and permanently as soon as they are no longer needed for the purposes for which they were collected or if the User demands this, unless the DFL is required or entitled by law to preserve the data. If the DFL is required or entitled by law to preserve the data, the stored personal data and pseudonymised usage data will be permanently deleted upon expiry of the statutory retention periods.

 

  1. Security

The DFL uses technical and organisational security measures to protect personal User data against accidental or intentional tampering, loss, destruction or access by unauthorised persons. These security measures are regularly adapted in accordance with technological developments. Nonetheless, the DFL advises the User that absolute security can never be guaranteed in online data transmission.

 

  1. Links to other websites

The Website may contain links to other websites. This Statement applies solely to this Website. The DFL has no influence over content from other providers and does not control whether other providers comply with the applicable data protection regulations or other legal requirements. If a user alerts the DFL to the presence of unlawful content on linked websites, the DFL will remove the links from the Website immediately.

 

  1. Rights of the User

The GDPR grants a number of rights to the User. In particular, the User has

  • a right of access to personal data concerning themselves (Art. 15 GDPR)
  • a right to rectification of inaccurate data (Art. 16 GDPR)
  • a right to erasure of data under the conditions stipulated in Art. 17 GDPR
  • a right to restriction of processing (Art. 18 GDPR)
  • a right to data portability in accordance with Art. 20 GDPR
  • a right to object to processing, unless this takes place to protect the legitimate interests of the DFL (Art. 21 GDPR).

If data processing is based on the User’s consent, the User may revoke this at any time with future effect.

The User can assert their rights by submitting an e-mail to info@bundesliga.com  or by post using the address specified at the beginning of this Statement. The DFL’s privacy officer can be contacted at dataprivacy@bundesliga.com. This e-mail address is used to respond solely to enquiries pertaining to privacy.

Furthermore, the User can submit a complaint about the data processing to an appropriate supervisory authority. The authority responsible for the DFL is the Hessian Commissioner for Data Protection and Freedom of Information [Hessischer Beauftragter für Datenschutz und Informationsfreiheit], and the User can submit a complaint via the following link.

 

  1. Where can the User find the relevant legal texts?

The User can access the GDPR via this link and the BDSG and other relevant German legal texts via this link.

 

  1. Applicability, validity and up-to-date status of the Statement

The provisions in this Statement on the collection, processing and use of the User’s data apply to the User when using the Website. This Statement is up to date as at 16 August 2024. The DFL reserves the right to amend this Statement as needed at any time and with future effect, especially for the purposes of adapting to later versions of the Website or implementing new technologies. The User can view the current Statement on the Website at any time under the “Privacy Statement” menu item in the footer.