data security for stadium visitors

Who is responsible for data processing and whom can I contact?

Responsible is

1. FC Union Berlin e. V.
An der Wuhlheide 263, 12555 Berlin
Tel.: 030 65 66 88 100
E-Mail: verein@fc-union-berlin.de

You can reach our data protection officer at

datarea GmbH
Meißen Straße 103, 01445 Radebeul
Tel.: +49 351 2722 0880
E-Mail: info@datarea.de

What sources and data do we use?

We exclusively process personal data that we receive during the registration for the lottery and ticket sales from fans and spectators in our systems.

For the registration, we collect the following data:

·         Personal information: Name, First name, Date of birth

·         Address

·         Contact information: E-mail, Phone

When purchasing tickets, data for seat selection is also processed (Block, Row and Seat).

What do we process your data for (purpose of processing) and on what legal basis?

We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG)

a) for the fulfillment of contractual obligations (Art. 6 Para. 1 lit. b) GDPR)

We process the data from the registration for the sale of tickets, for invoicing, and for delivery to the buyer.

b) Due to legal obligations (Art. 6 Para. 1 lit. c) GDPR)

c) within the framework of weighing interests (Art. 6 Para. 1 lit. f) GDPR)

If necessary, we process your data beyond the actual fulfillment of the contract and legal provisions to protect legitimate interests of ours or third parties. For example, for consultation and data exchange with authorities, for asserting legal claims and defending against legal disputes, for the prevention or clarification of criminal offenses.

Who gets my data?

Within 1. FC Union Berlin, those departments that need your data to fulfill contractual obligations will have access to it.

Are data transferred to a third country or to an international organization?

In principle, there is no transfer of personal data to states outside the European Union (so-called third countries).

How long will my data be stored?

The data collected for the sale of tickets will be stored as long as it is necessary to meet commercial and tax law retention obligations. These arise, for example, from the Commercial Code (HGB) and the Fiscal Code (AO). The retention periods specified there usually range from two to ten years.

The data we collect for contact tracing is generally stored for four weeks.

What data protection rights do I have?

Every affected person has the right to access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR, and the right to data portability under Article 20 GDPR. The limitations stated in §§ 34 and 35 BDSG apply to the rights of access and erasure. Furthermore, there is a right to lodge a complaint with the competent data protection supervisory authority (Article 77 GDPR in conjunction with § 19 BDSG).

Competent supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin

You can revoke any consent given for the processing of personal data at any time. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected.

You can assert your rights as an affected person either by post or by email to the contact details provided above.

Is there a requirement for me to provide data?

In order to facilitate your visit to the stadium, you must provide the personal data necessary for the recording and execution of the ticket purchase and to fulfill the associated contractual obligations, or which we are legally obliged to collect. Without this data, we will generally not be able to allow you to attend the stadium.

To what extent is there automated decision-making?

We basically do not use fully automated decision-making in accordance with Article 22 of the GDPR for the justification and execution of business relationships.

Is profiling taking place?

Profiling, aimed at assessing certain personal aspects, does not take place with us.