privacy policies

Thank you for visiting the Ticketshop. Conscientious data protection is of particular importance for us and forms the foundation of a trusting relationship with our customers. In accordance with Art. 12, 13 et seqq. GDPR (EU), we would therefore like to inform you about the importance of data protection and the handling of your personal data.

1. Name and contact details of the controller

In the sense of the European General Data Protection Regulation ("GDPR (EU)") and other national laws on data protection in the Member States as well as other data protection regulations, your contact person as controller is:

FC St. Pauli v. 1910 e.V.

Harald-Stender-Platz 1

20359 Hamburg

(hereinafter referred to as "we", "us" or "our")

2. General information on data processing

a. Scope of processing of personal data

We basically process your personal data only to the extent necessary for the performance of our services. The processing of your personal data routinely takes place only on the basis of your consent. An exception applies in those cases where prior consent cannot be obtained for factual reasons or where processing of your personal data is permitted by law.

b. Legal principles for processing personal data

Insofar as we obtain your consent for the processing of personal data, Art. 6 Para. 1 lit. a GDPR (EU) constitutes the legal basis.

In the processing of personal data which is necessary for the fulfilment of a contract between you and us, Art. 6 Para. 1 lit. b GDPR (EU) constitutes the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6 Para. 1 lit. c GDPR (EU) constitutes the legal basis.

In the event that vital interests of you or another natural person require the processing of personal data, Art. 6 Para. 1 lit. d GDPR (EU) constitutes the legal basis.

If the processing is necessary to protect a legitimate interest of ours or a third party and your interests, fundamental rights and freedoms do not outweigh the first interest, Art. 6 Para. 1 lit. f GDPR (EU) constitutes the legal basis for processing.

c. Data erasure and storage period

Your personal data will be erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond this period if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which we are subject. Unless there is a need for further storage of the data for the conclusion or fulfilment of a contract, the data are also blocked or erased if a storage period prescribed by the aforementioned standards expires.

3. Provision of the website

a. Legal basis for data processing

Art. 6 Para. 1 lit. f GDPR (EU) constitutes the legal basis for processing your personal data within the scope of providing the website and creating log files.

b. Purpose of data processing

The temporary storage of your personal data by us is necessary to enable the website to be delivered to your computer. For this purpose, your personal data must remain stored for the duration of the session.

Your personal data are stored in log files to ensure that the website functions properly. We also use your personal data to optimise our website and to ensure the security of our information technology systems. An evaluation of your personal data for marketing purposes does not take place in this context.

For these purposes, our legitimate interest in data processing is in accordance with Art. 6 Para. 1 lit. f GDPR (EU).

c. Storage period

Your personal data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of the collection of your personal data for the provision of the website, this is the case at the end of the respective session..

If your personal data are stored in log files, they are erased after seven days at the latest. Further storage is possible. In this case, your personal data will be erased or altered so that it is no longer possible to assign the visiting client.

d. Possibility of objection and elimination

The collection of your personal data for the provision of the website and the storage of your personal data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for you to object.

4. Cookies

a. Legal basis for data processing

Art. 6 Para. 1 lit. f GDPR (EU) constitutes the legal basis for processing your personal data within the framework of the use of technically necessary cookies.

b. Purpose of data processing

The use of technically necessary cookies serves to simplify your use of our website. Some functions of our website cannot be offered without the use of cookies. For this, it is necessary that your internet browser is recognised even after changing pages. The user data collected by technically necessary cookies are not used to create user profiles.

Our legitimate interest in the processing of your personal data for this purpose is in accordance with Art. 6 Para. 1 lit. f GDPR (EU).

c. Storage period

Your personal data are erased as soon as they are no longer necessary to achieve the purpose of their collection; this is particularly the case when cookies are deactivated.

d. Possibility of objection and elimination

Cookies are stored on your computer which then transfers them to our website. You therefore also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transfer of cookies. Cookies that have already been saved can be erased at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.

You cannot prevent the transfer of Flash cookies via the settings of your Internet browser. This requires changes to the Adobe Flash Player settings.

5. Ticket sales

a. Legal basis for data processing

Art. 6 Para. 1 lit. b GDPR (EU) constitutes the legal basis for the processing of your personal data in the context of ticket sales.

b. Purpose of data processing

In the context of ticket sales, the purpose of processing your personal data is the fulfilment of the contract between you and us.

c. Storage period

Your personal data are erased as soon as it is no longer necessary to achieve the purpose for which they were collected. In the case of processing your personal data within the framework of ticket sales, this is the case if any claims arising from the contractual relationship have become time-barred and there are no longer any legally prescribed retention periods.

d. Possibility of objection and elimination

In the context of ticket sales, the processing of your personal data is absolutely necessary for ticket sales. Consequently, there is no possibility for you to object.

6. Registration

a. Legal basis for data processing

Art. 6 Para. 1 lit. b GDPR (EU) constitutes the legal basis for the processing of your personal data within the framework of registration.

b. Purpose of data processing

Your registration facilitates the conclusion of contracts between you and us. The processing of your personal data within the framework of registration is therefore necessary for the fulfilment of a contract between you and us or for the implementation of pre-contractual measures.

c. Storage period

Your personal data are erased as soon as it is no longer necessary to achieve the purpose for which they were collected. In the case of processing your personal data within the framework of ticket sales, this is the case if any claims arising from the contractual relationship have become time-barred and there are no longer any legally prescribed retention periods.

d. Possibility of objection and elimination

You can cancel your registration at any time. You can have the personal data stored about you changed at any time. If your personal data are required to fulfil a contract or to carry out pre-contractual measures, premature erasure of your personal data is only possible if any contractual or statutory obligations do not prevent erasure.

7. Direct marketing

a. Legal basis for data processing

Art. 6 Para. 1 lit. b GDPR (EU) constitutes the legal basis for the processing of your personal data in the context of direct marketing by post.

b. Purpose of data processing

In the context of direct marketing by post, the purpose of processing your personal data is to promote ticket revenues. For this purpose, we have a legitimate interest in data processing in accordance with Art. 6 Para. 1 lit. f GDPR (EU).

c. Storage period

Your personal data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected; this is particularly the case when the objection is received.

d. Possibility of objection and elimination

In the context of direct marketing by post, you can object to the processing of your personal data at any time for the future.

8. Web analysis by Matomo (formerly PIWIK)

a. Legal basis for data processing

Art. 6 Para. 1 lit. f GDPR (EU) constitutes the legal basis for processing your personal data.

b. Purpose of data processing

The processing of your personal data enables us to analyse your surfing behaviour. We are in a position to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its user-friendliness. For these purposes, we also have a legitimate interest in the processing of your personal data in accordance with Art. 6 Para. 1 lit. f GDPR (EU). In the anonymisation your IP address, your interest in the protection of personal data is sufficiently taken into account.

c. Storage period

Your personal data will be erased as soon as they are no longer needed for the purposes mentioned above. In our case, this is the case after three months.

d. Possibility of objection and elimination

Cookies are stored on your computer which then transfers them to our website. You therefore also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transfer of cookies. Cookies that have already been saved can be erased at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.

On our website, we offer you the possibility of an opt-out from the analysis procedure. To do this, please click on the corresponding link. In doing so, another cookie is placed on your computer, which signals us not to collect your personal data. If you erase the corresponding cookie, we must set the opt-out cookie again.

More information about the privacy settings of the Matomo software can be found at the following link: https://matomo.org/docs/privacy/

9. Legal defence and legal enforcement

a. Legal basis for data processing

Art. 6 Para. 1 lit. f GDPR (EU) constitutes the legal basis for the processing of your personal data in the context of legal defence and legal enforcement.

b. Purpose of data processing

The purpose of processing your personal data in the context of legal defence and legal enforcement is to defend ourselves against unauthorised claims as well as the legal enforcement of claims and rights. For this purpose, we have a legitimate interest in data processing in accordance with Art. 6 Para. 1 lit. f GDPR (EU).

c. Storage period

Your personal data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected.

d. Possibility of objection and elimination

In the context of legal defence and legal enforcement, the processing of personal data is absolutely necessary for legal defence and enforcement. Consequently, there is no possibility for you to object.

10. Recipient categories

With the controller, those departments receive your personal data which they need to fulfil the aforementioned purposes. In addition, we make use of various service providers and transfer your personal data to other trustworthy recipients. These could be, for example:

- Banks
- Scan services
- Print shops
- Letter shops
- IT service providers
- Lawyers and Courts

11. Rights of the data subject

If any personal data of yours are processed, you are a data subject in the sense of GDPR (EU) and you have the following rights against us:

a. Rights of access

You can ask us to confirm whether personal data relating to you is being processed by us.

If such processing is taking place, you can request the following information from us:

(1) the purposes for which the personal data are being processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data relating to you have been or are still being disclosed;
(4) the planned period of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage period;
(5) the existence of a right to rectification or erasure of personal data relating to you, a right to restriction of processing by us or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority; (7) if the personal data are not collected from you, any available information about the origin of the data;
(8) the existence of automated decision making including profiling under Article 22 Para. 1 and 4 GDPR (EU) and – at least in these cases – meaningful information about the logic involved as well as the scope and the intended effects of such processing for the data subject.

You have the right to request information as to whether the personal data relating to you are transferred to a third country or to an international organisation. In this context, in accordance with Art. 46 GDPR (EU), you can request the appropriate safeguards in connection with the transfer.

b. Right to rectification

If the personal data processed relating to you are incorrect or incomplete, you have a right of rectification and/or completion against us. We must make the rectification without delay.

c. Right to restriction of processing

Under the following conditions, you may request that the processing of personal data relating to you be restricted:

(1) if you dispute the accuracy of the personal data relating to you for a period that enables us to verify the accuracy of the personal data;
(2) the processing is unlawful and you reject having the personal data erased and instead request that the use of the personal data be restricted;
(3) we no longer need the personal data for the purposes of processing, but you however need them to assert, exercise or defend legal claims, or
(4) if you object to the processing pursuant to Art. 21 Para. 1 GDPR (EU) and it is not yet clear whether our justified reasons outweigh your reasons.

If the processing of personal data relating to you has been restricted, such data may only be processed - apart from being stored - with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State.

If the restriction on processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.

d. Right to erasure

i. Obligation to erase

You can ask us to erase the personal data relating to you immediately and we are obliged to erase this personal data immediately if one of the following reasons applies:

(1) the personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed;
(2) pursuant to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR (EU), you revoke your consent to the processing and there is no other legal basis for processing;
(3) pursuant to Art. 21 Para. 1 GDPR (EU), you object to the processing and there are no overriding legitimate reasons for the processing, or you submit an objection pursuant to Art. 21 Para. 2 GDPR (EU);
(4) the personal data relating to you have been processed unlawfully;
(5) the erasure of personal data relating to you is necessary to fulfil a legal obligation under Union law or the law of the Member States to which we are subject, or
(6) the personal data relating to you have been collected in relation to information society services offered in accordance with Art. 8 Para. 1 GDPR (EU).

ii. Information to third parties

If we have made the personal data relating to you public and according to Art. 17 (1) GDPR (EU) we are obliged to erase them, we will take appropriate measures (including technical measures taking into account the available technology and implementation costs) to inform controllers who process the personal data that you as the data subject have requested the erasure of all links to this personal data or of copies or replications of this personal data.

iii. Exceptions

The right to cancellation does not exist insofar as the processing is necessary

(1) to exercise freedom of expression and information;
(2) to fulfil a legal obligation required for processing under the law of the Union or of the Member States to which we are subject, or to perform a task in the public interest or in the exercise of official authority conferred on us;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 Para. 2 lit. h and i and Art. 9 Para. 3 GDPR (EU);
(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes according to Art. 89 Para. 1 GDPR (EU), to the extent that the law referred to in (a) is likely to render impossible or seriously prejudicial the attainment of the objectives of such processing, or
(5) to assert, exercise or defend legal claims.

e. Right tob e provided with information

If you have exercised against us your right of rectification, erasure or restriction of processing, we are obliged to inform all recipients to whom the personal data relating to you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right against us to be informed about these recipients.

f. Right to data portability

You have the right to receive the personal data relating to you that you have provided to us in a structured, common and machine-readable format. In addition, you have the right to transfer the personal data provided to us to another controller without our interference, provided that

(1) the processing is based on a consent according to Art. 6 Para. 1 lit. a GDPR (EU) or Art. 9 Para. 2 lit. a GDPR (EU) or on a contract according to Art. 6 Para. 1 lit. b GDPR (EU) and
(2) processing is carried out by means of automated methods.

In exercising this right, you also have the right to request that the personal data relating to you be transferred directly by us to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on us.

g. Right of objection

For reasons arising from your particular situation and in accordance with Art. 6 Para. 1 lit. e or f GDPR (EU), you have the right at any time to object to the processing of personal data relating to you; this also applies to profiling based on these provisions.

We will no longer process personal data relating to you unless we can prove compelling grounds for processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data relating to you for the purpose of such advertising; this also applies to profiling, insofar as it is associated with such direct marketing.

If you object to the processing for direct marketing purposes, the personal data relating to you are no longer processed for these purposes.

You have the possibility to exercise your right of objection in connection with the use of Information Society services by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

h. Right to revoke the data protection declaration of consent

You have the right to revoke your consent for the data protection declaration at any time. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation.

i. Automated decision in individual cases including profiling

You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has a legal effect against you or significantly impairs you in a similar manner. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and us,
(2) is admissible by law of the Union or of the Member States to which we are subject and that law contains appropriate measures to safeguard your rights, freedoms and legitimate interests, or
(3) is made with your express consent.

However, according to Art. 9 Para. 1 GDPR (EU), these decisions may not be based on special categories of personal data unless Art. 9 Para. 2 lit. a or g GDPR (EU) applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in (1) and (3), we will take reasonable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain an individual's intervention from us, to state his or her position and to challenge the decision.

j. Right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or suspect of infringement, if you believe that the processing of personal data relating to you is contrary to the GDPR (EU).

The supervisory authority responsible for us is:

Hamburg

Klosterwall 6 (Block C)

20 098 Hamburg

The supervisory authority to which you have lodged your complaint shall inform you of the status and the results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR (EU).

For further questions, please contact our Data Protection Officer.

Date: 8th May 2018