Privacy Statement and Cookie Policy

As a controller within the context of the European General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act [“BDSG”, Bundesdatenschutzgesetz], DFL Deutsche Fußball Liga e.V., Guiollettstrasse 44-46, D-60325 Frankfurt am Main (the “DFL e.V.”) collects, processes and uses personal data which has been captured from visits to the website products.bundesliga.com (the “Website”) in compliance with the applicable data privacy provisions in the Federal Republic of Germany, in particular the GDPR and the BDSG. This Privacy Statement and Cookie Policy (hereinafter together: the “Statement“) sets out which data of the visitor of the Website (“User”) is captured on the Website and how this information is processed.

1. Personal data

Personal data are all information which relate to an identified or identifiable natural person. A natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, for example, the name, personalized email addresses, the residential address, the telephone number or the date of birth.

2. Data collection, processing and use when accessing the Website

Each time a User accesses the Website, the User’s Internet browser, for technical reasons, automatically supplies the following data to DFL e.V.’s web server:

  • IP address of the end device
  • date and time of access
  • name and URL of accessed page
  • transferred data volume
  • access status (data file transmitted, data file not found, etc.)
  • recognition data of the used browser and operating system of the User’s end device
  • name of the User’s Internet service provider
  • website from which the access was made

The collection, processing and use of these data occur for the purposes of enabling the use of the Website (connection set-up), system security and technical administration of the network infrastructure. A comparison with other data sets or a transmission to third parties, even in excerpts, does not take place.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of DFL e.V. results from the fact that DFL e.V. wants to provide a secure and functioning Website.

With regard to data collection, processing, and use for the purpose of optimizing the Website through web analytics, additional reference is made to Section 3 of this Statement.

3. Data collection, processing and use in the context of web analysis with Matomo (formerly: Piwik)

On the Website, DFL e.V. uses the open source web analysis service “Matomo” (formerly: Piwik) provided by InnoCraft Ltd., New Zealand which is locally installed on the servers of DFL e.V. (“Matomo”). Matomo stores cookies on the User´s end device (more details about the used cookies can be found in Section 5 of this Statement) and the following data will be collected and stored by using Matomo:

  • Two bytes of the IP address of the User’s accessing network
  • Called up website
  • Website from which the User has accessed the accessed website (referrer)
  • Subpages accessed from the accessed website
  • Duration of stay on the Website
  • Frequency with which the Website is accessed

By using the feature „IP2Location™ IP-Country-Region-City-ISP Database [DB4]“ provided Hexasoft Development Sdn Bhd, Malaysia („ip2location“) additional geographic information (country, region, city) will be collected and stored based on the IP addresses in aggregated form. This feature is also locally installed on the servers of DFL e.V.

A collection and storage always only takes place on the servers of DFL e.V. The data will not be transmitted to Matomo or other third parties.

Matomo and ip2location are set in a way that the IP addresses are not stored completely, but 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the calling computer. The User can prevent such an analysis by making use of the following opt-out. However, DFL e.V. hereby informs the User that in this case it is possible that the User cannot completely use all functions of the Website. In case the User opt-outs, another cookie will be stored on the User’s end device. This cookie will signal the system of DFL e.V. to not store the User’s data. If the User deletes cookies from his/her end device, this opt-out cookie will also be deleted and will have to be set again.

Further information about data protection are available under the following link.

4. Region-based Website content

The Website automatically detects the time zone of the User’s Internet browser in order to assign the User to a certain region (Asia, America, EMEA). The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR, whereby the legitimate interest of DFL e.V. results from the fact that DFL e.V. wants to offer helpful information to the User and in particular to ensure that relevant region-based content is presented to the User.

The User can change the region and also the time zone of the User’s Internet browser manually.

5. Cookies and local storage

5.1 Cookies

DFL e.V. uses different cookies on the Website. Cookies are small text files that are stored on the User’s end device and allow to recognize this end device. The Users have the option to adjust their browser’s settings to prevent it from accepting the storage of cookies. Please note that in that case that certain parts of the Website may not work. 

DFL e.V. decided to only use so-called performance cookies on the Website. Performance cookies enable DFL e.V. to analyse the use of the Website and to optimize the Website based on the User behaviour. DFL e.V. does not share information obtained from these cookies with third parties and does not use it for individual advertising.

DFL e.V. uses the following performance cookies on the Website:

Name Domain First Party / Third Party Lifespan Description
_pk_id* mt.bundesliga.com First Party 13 months This cookie from Matomo (formerly: Piwik) provided by InnoCraft Ltd. (New Zealand) is used to help us track user behaviour and measure site performance. The cookie is used to store a few details about the User such as the unique visitor ID to distinguish unique returning Users and merge the data from previous visits. The cookie records statistics about User visits to the Website, such as the number of visits, average time spent on the Website and which pages were read. DFL e.V. does not share any information generated by this cookie with Matomo or any other third party.
_pk_ses* mt.bundesliga.com First Party 30 minutes This cookie from Matomo (formerly: Piwik) provided by InnoCraft Ltd. (New Zealand) is used to help us track User behaviour and to track page requests of the User during the session. The cookie is used to temporarily store data for the visit. DFL e.V. does not share any information generated by this cookie with Matomo or any other third party.
_pk_ref* mt.bundesliga.com First Party 6 months This cookie from Matomo (formerly: Piwik) provided by InnoCraft Ltd. (New Zealand) stores information about the website from which the User accessed the Webbsite. This information is only collected if the User has not entered the URL of the Website directly.
AWSALB mt.bundesliga.com First Party 7 days This cookie from Amazon Web Services (AWS) is related to the integration of Matomo via AWS on the Website. The cookie enables AWS to direct requests from a specific session to the same server whenever possible (so-called sticky session). This is mainly used to ensure that a session is not lost as a result of requests for a session being routed to different servers.
AWSALBCORS mt.bundesliga.com First Party 7 days This cookie from Amazon Web Services (AWS) is related to the integration of Matomo via AWS on the Website. The cookie enables AWS to direct requests from a specific session to the same server whenever possible (so-called sticky session). This is mainly used to ensure that a session is not lost as a result of requests for a session being routed to different servers.
test mt.bundesliga.com First Party Session This cookie from Matomo (formerly: Piwik) provided by InnoCraft Ltd. (New Zealand) is used to check if the User’s browser supports cookies.

The legal basis for the use of these cookies are the legitimate interests of DFL e.V. pursuant to Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of DFL e.V. results from the fact that DFL e.V. wants to analyse the use of the Website in order to make it as pleasant as possible for users.

5.2 Local storage

The information that the user has taken note of the cookie notice banner is stored in the local storage by using the key dfl-usage-shown 1.0. Further information about local storage can be found here.

6. Limited purpose for processing and using personal data

All processing or use of personal data of the User occurs only for the purposes mentioned in this Statement and to the extent necessary to achieve the respective purpose.

Personal data are not published by DFL e.V. or disclosed to unauthorized third parties.

Transmissions of personal data to government agencies and public authorities occur only in accordance with mandatory national provisions in the law or if the disclosure is necessary in the case of attacks on the network infrastructure in order to pursue rights and for purposes of criminal prosecution. The legal basis for this processing is Art. 6 para. 1 sentence 1 c) GDPR in conjunction with § 24 para. 1 no. 1 b) German Data Protection Act [Bundesdatenschutzgesetz, “BDSG”].

7. Storage and deletion of personal data

All stored personal data and pseudonymized usage data are deleted immediately and permanently as soon as the data are no longer needed for the purposes for which they were collected or the User demands this unless DFL e.V. is required or entitled by law to do preserve the data. If DFL e.V. is required on the basis of provisions in the law to preserve the data, the stored personal data and pseudonymized usage data will be permanently deleted upon expiration of the time periods for preserving data required by law.

8. Security

DFL e.V. uses technical and organizational security measures in order to protect the personal data of the Users against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security measures are continuously adapted in accordance with technological developments.

9. Links to other websites

The Website may contain links to other websites. This Statement applies solely to the Website. DFL e.V. has no influence over, and does not control whether other providers comply with applicable data privacy provisions.

10. Rights of the User

The User has several rights under the GDPR. In particular, the User has

  • a right to information with regard to the stored personal data of the User (Art. 15 GDPR);
  • a right to have incorrect data corrected (Art. 16 GDPR);
  • a right to erasure under the prerequisites described in Art. 17 GDPR;
  • a right to restriction of the processing (Art. 18 GDPR);
  • a right for data transferability (Art. 20 GDPR); and
  • a right to object against the processing, if such processing safeguards the legitimate interests of DFL e.V. (Art. 21 GDPR).

The User can assert his/her rights by emailing info@dfl.de or by posting a letter to the registered office of DFL e.V. Questions regarding data protection can be addressed dataprivacy@dfl.de. Please note that only data privacy-related messages will be answered at this email address.

Furthermore, the User can submit a complaint about the data processing to the responsible supervisory authority. The Hessian Commissioner for Data Protection and Freedom of Information [Hessischer Beauftragter für Datenschutz und Informationsfreiheit] is responsible for DFL e.V. and the User can submit a complaint via the following link.

11. Where can the User find the relevant legal texts?

The GDPR can be found under the following link, the BDSG and other relevant German legal texts under the following link.

12. Applicability, validity and timeliness of the Statement

The provisions in this Statement on collection, processing and use of the User’s data apply for the User when using the Website. This Statement is current valid and is dated as of 10 March 2021. DFL e.V. reserves the right to amend this Statement at any time as needed with effect for the future, especially for the purposes of adaption to a further development of the Website or the implementation of new technologies.

DFL Deutsche Fußball Liga GmbH
+49 69 65005 0
info@bundesliga.combundesliga.com
Bundesliga International GmbH
+49 69 65005 0
info@bundesliga-international.combundesliga-international.com
© 2019 DFL Deutsche Fußball Liga e.V.