Privacy Policy

The respective controllers responsible for processing personal data are:

DFB e.V., DFB-Campus, Kennedyallee 274, 60596 Frankfurt am Main, represented by President Bernd Neuendorf, Treasurer Stephan Grunwald and General Secretary Dr Holger Blask, info@dfb.de, phone: 069-67 88 0, fax: 069-67 88 266

or

DFB GmbH & Co. KG, DFB-Campus, Kennedyallee 274, 60596 Frankfurt am Main. Its general partner authorised to represent the company is DFB-Verwaltungsgesellschaft mbH, DFB-Campus, Kennedyallee 274, 60596 Frankfurt am Main, represented by Managing Directors Dr Holger Blask, Stephan Grunwald, Manuel Hartmann and Andreas Rettig. Phone: 069-67 88 0, fax: 069-67 88 266

hereinafter referred to as the “DFB”.

The Data Protection Officers of the DFB companies can be contacted at datenschutz@dfb.de.

DFB e.V. and DFB GmbH & Co. KG are joint controllers in relation to players representing the national teams. Information on the processing of players’ data can be found in the DFB’s data protection portal at https://www.dfb.de/datenschutz-im-fussball#spielerinnen-des-dfb (German).

In all other respects, DFB e.V. and DFB GmbH & Co. KG are joint controllers pursuant to Article 26 GDPR unless a single company is expressly identified as the controller or a different arrangement is otherwise apparent.

The following companies are responsible for data protection in relation to the individual websites:

dfb.de: Joint controllers: DFB e.V. and DFB GmbH & Co. KG

fussball.de: DFB GmbH & Co. KG

dfb-eFootball.de: DFB GmbH & Co. KG

tickets.dfb.de: DFB GmbH & Co. KG

dfb-akademie.de: Joint controllers: DFB e.V. and DFB GmbH & Co. KG

dfbnet.org: DFB GmbH & Co. KG

We have entered into an agreement in order to safeguard your rights, fulfil our information obligations under Articles 13 and 14 GDPR and comply with the other requirements of the GDPR.

• To exercise your rights in relation to the processing of personal data under this joint-controllership arrangement, or if you have any questions, please contact the Data Protection Officer of DFB GmbH & Co. KG at datenschutz@dfb.de.
• Further information about the processing of your personal data under joint controllership is provided below in this Privacy Policy.

If you have any questions regarding the processing of your personal data in connection with the password-protected DFBnet SpielPLUS, mailbox or Pass Online services, please contact the Data Protection Officer of your responsible association directly.

Unless an individual controller is expressly identified, our websites are operated under the joint-controllership arrangement described in section 1.1.

When you visit dfb.de, dfbnet.org or any of the DFB’s other websites, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a log file. The following information is collected and stored until it is automatically deleted:

• the IP address of the requesting device, with the final octet removed;
• the date and time of access;
• the name and URL of the file accessed;
• the website from which access was made (referrer URL);
• the browser used and, where applicable, your computer’s operating system; and
• the name of your internet service provider.

We process this data for the following purposes:

• ensuring that the websites establish a connection smoothly;
• ensuring convenient use of our websites;
• checking and maintaining system security and stability; and
• other administrative purposes.

The legal basis for the processing is Article 6(1), sentence 1, point (f) GDPR. Our legitimate interest arises from the purposes for which the data is collected as set out above. We do not under any circumstances use the data collected for the purpose of drawing conclusions about you as an individual. We delete this data after three months.

You can also contact us via our websites. This requires us to process personal data. The information below sets out the types of personal data processed, the purpose of the processing, the legal basis and when the data is deleted. We are also required to transfer your data to third parties for various reasons. Further information can be found under “Data transfers”.

When you use the contact form, we process the following data and store it until your enquiry has been dealt with:

• first name and surname;
• email address;
• telephone number (optional);
• publisher/newspaper/company;
• data specific to the service concerned;
• additional information (optional); and
• your message to us.

This data is processed for the purpose of responding to your enquiries. The processing is based on our legitimate interest pursuant to Article 6(1), point (f) GDPR, as we have an interest in responding to your questions and addressing your concerns.

To provide accessible access to our websites, our websites include additional functionality. For this purpose, we use, among other things, a website plug-in called “Eye-Able”, which allows the output and presentation of our websites to be adapted to visitors’ needs. A JavaScript file is downloaded and executed on the user’s device in order to run the plug-in.

We use technology provided by Web Inclusion GmbH, Gartenstraße 12c, 97276 Margetshöchheim, with which we have entered into a data processing agreement. Web Inclusion GmbH in turn uses subcontractors to provide this functionality, namely the content delivery network (CDN) operated by BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia.

When the plug-in is loaded, your IP address is transmitted to the servers of our processor or sub-processor. Otherwise, settings are stored in your browser’s local storage only when individual functions are activated. All settings are stored locally and are not transmitted.

Where the DFB provides services, the legal basis for the processing is Article 6(1), point (c) GDPR in conjunction with section 14 of the German Accessibility Strengthening Act (BFSG). In all other cases, the legal basis is our legitimate interest pursuant to Article 6(1), point (f) GDPR, with the legitimate interest consisting of providing an accessible website.

Our websites provide the option of receiving browser push notifications. These can be sent to a user’s device and may contain news or other information. This function must be actively enabled. Once it has been enabled, a unique token – in this case a device ID – is created which is required in order to use push notifications. This token enables us to send notifications to the user’s device.

The token is generated and provided by our service provider. It is then stored on our systems and used when a push notification is sent to the device. For this purpose, we process the following data:

• individual device ID;
• association with a mein.DFB account, where applicable.

If you are logged into your mein.DFB account, information about your consent is also stored in your customer profile. We have entered into a data processing agreement pursuant to Article 28 GDPR with the service provider that provides this functionality.

You can withdraw your consent at any time through your browser settings or, where available, directly on our website (opt-out). If you withdraw your consent, your browser will automatically notify us and push communications to the relevant device ID will be discontinued.

The legal basis for the processing is your consent pursuant to Article 6(1), point (a) GDPR.

Various types of personal data are processed when you interact with the DFB. The possible scenarios are set out below. Based on the subject matter or the specific address of the service (URL), you can find information on the types of personal data processed, the purpose of the processing, the legal basis and when the processing ends. We may also be required to transfer your data to third parties for various reasons. Further information can be found in section 15.

The following websites and sub-pages are operated jointly by the DFB companies (see section 1.1).

User registration, single sign-on (SSO) – mein.DFB

URL: oidc.dfb.de

Types of personal data: surname, first name, email address, age group, email address of parent/legal guardian for persons under 16, password, two-factor authentication, newsletter settings, marketing consent, date of registration

Purpose: registration and account management for the DFB SSO solution, which can be used to access various DFB services.

Legal basis: Article 6(1), sentence 1, point (b) GDPR

End of processing: upon termination by the user or by DFB e.V. (e.g. due to a breach of the terms of use) and following expiry of the subsequent standard limitation period.

Brand Portal

URL: https://markenportal.dfb.de

Types of personal data: name, email address, user category and, depending on that category, company details, DFB contact person, purpose of registration, department

Purpose: registration with the DFB Brand Portal in order to provide access to brand assets

Legal basis: Article 6(1), sentence 1, point (b) GDPR

End of processing: upon termination by the user or by DFB e.V.

Contact form for problems with user accounts

URL: www.dfb.de/kontakt-account-probleme

Types of personal data: email address, first name, surname, date of birth, nature of enquiry, description of problem

Purpose: contacting DFB Support regarding problems with a DFB user account

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: six months after completion of the support case

General contact form

URL: www.dfb.de/kontakt

Types of personal data: first name, surname, email address, question

Purpose: submitting questions to the association

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: six months after completion of the contact process

Press Portal – registration and verification

URL: presse.dfb.de

Types of personal data: title, first name, surname, email address, telephone number, media organisation/editorial department, position/role, press-card number and expiry date, self-employed status, information provided in free-text fields and images of the press card

Purpose: enabling media representatives to create an account for the DFB Press Portal and carry out the required verification; downloading brochures and other information; submitting and managing accreditation applications

Legal basis: Article 6(1), sentence 1, point (b) GDPR; for voluntary information, Article 6(1), point (a) GDPR (consent)

End of processing: upon termination by the user or by DFB e.V. (e.g. due to a breach of the terms of use)

Press Portal – registration for appointments/events, including additional persons

Registered media representatives can register to attend certain appointments or events. Registration is carried out via the previously registered account. Additional persons, such as camera operators, can also be registered.

Types of personal data:

• For the profile holder: profile data (see above), event registration and event data, number of places required, editorial purpose, information provided in free-text fields and registration status
• For third parties: first name, surname, role, email address

Purpose: registration for participation in events; confirmation of registrations by the DFB

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Where the profile holder registers third parties, those third parties must be informed of the information contained in this Privacy Policy before their data is entered.

Fair Play Medal nomination form

URL: https://www.dfb.de/preisewettbewerbe/fair-play-medaille/meldeformular/

Types of personal data: name of the person nominated, first name and surname of the person making the nomination, address of the person making the nomination, street, postcode, town/city, telephone number, email address, fax number, match, date of match, regional association of the team, league, age group, description of the fair-play gesture

Purpose: submission of potential award recipients or nominations for potential recipients of the Fair Play Medal

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: six months after the award has been presented

Hospitality Portal (WEB)

URL: www.dfb.de/vip-tickets/start

Types of personal data: company, first name, surname, telephone number, email address, address, number of persons, credit-card details

Purpose: ordering VIP tickets for national-team and DFB-Pokal matches

Legal basis: Article 6(1), sentence 1, point (b) GDPR; for advertising purposes based on a legitimate interest, Article 6(1), sentence 1, point (f) GDPR

Deletion: 24 months after the tickets are sent for advertising purposes; invoicing documents are retained until the end of the statutory ten-year retention period

Ordering the referees’ magazine

URL: www.dfb.de/verbandsservice/publikationen/dfb-schiedsrichter-zeitung

Types of personal data: first name, surname, street and house number, postcode, place of residence, email address

Purpose: order form for ordering the referees’ magazine from our publishing partner

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: three months after the subscription ends

Competitions

URL: Various URLs

Types of personal data: first name, surname, street and house number, postcode, place of residence, email address, telephone number, fax number (optional)

Purpose: running competitions

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: six months after the competition ends

Dispatch of prizes

URL: Various URLs (competitions)

Types of personal data: first name, surname, street and house number, postcode, place of residence

Purpose: dispatch of prizes; where applicable, transfer to a sponsor if the sponsor is responsible for dispatching the prizes

Legal basis: Article 6(1), point (f) GDPR for the transfer; otherwise see “Competitions”

Deletion: six months after the competition ends

DFB Football Badge

URL: fussballabzeichen.dfbnet.org/index.html

Types of personal data: for school registration: surname, first name (contact person), email address, password, business telephone number; when creating an event, details of an assessor are also required (optional)

Purpose: registration of schools (contact person with contact ID) to enable participation in the Football Badge programme; approval of events/resolution of queries; transfer of contact details to logistics providers for the dispatch of materials, in particular Football Badges

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: deletion by the user

Chatbot

URL: dfb.de

Types of personal data: email address, PIN where applicable, message text; at the user’s request, first name, surname and gender may also be processed

Purpose: improving our online services through an interactive chat application and carrying out marketing campaigns based on our legitimate interests, such as competitions; the data is also aggregated and thereby anonymised in order to carry out anonymous statistical analyses based on our legitimate interests, measure success and improve our advertising approach where we have obtained consent to do so

Legal basis: Article 6(1), sentence 1, point (f) GDPR

Deletion: message text within three days where it is not required to determine competition winners; otherwise all data is deleted immediately after the winner has been drawn

Data Centre

URL: https://www.dfb.de/datencenter

Types of personal data: first name and surname, date of birth, nationality, club and match history and a photograph of players, coaches and referees

Purpose: recording professional and amateur football activity for the purpose of informing the public about public figures, maintaining historical records and archiving

Legal basis: Article 6(1), sentence 1, point (f) GDPR

Deletion: data is deleted in accordance with a differentiated deletion policy. As a general rule, deletion takes place two years after the end of the current season. Participants in the Bundesliga, Bundesliga 2, 3. Liga and Frauen-Bundesliga, as well as national-team players, are exempt.

Registration for the Event Portal

URL: https://eventportal.dfb.de

Types of personal data: surname, first name, username/email address, password, date of birth (voluntary), company, telephone number, street, house number, postcode, town/city, country, mobile-phone number

Purpose: registering an account in order to use the Event Portal services; contacting users

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

Registration for the restricted area for DFB employees and developers

URL: https://eventportal.dfb.de

Types of personal data: surname, first name, email address, password, assignment to the “DFB” or “Administrator” group, contact details (voluntary)

Purpose: registering an account in order to edit the Event Manual

Legal basis: section 26(1) BDSG, Article 6(1), point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

Registration for the restricted area for service providers

URL: https://eventportal.dfb.de

Types of personal data: surname, first name, email address, password

Purpose: access to and editing of the Event Manual

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

DFB TV Plus

The DFB operates a streaming platform at watch.dfbtvplus.de for content provided by the DFB. A mein.DFB account is required in order to use the content (see section 3.1). Users can then purchase access to content.

In addition to the mein.DFB account information, we process the following personal data:

• registration for DFB TV Plus;
• selected subscription and subscription status;
• payment information;
• your IP address and other technical information required to deliver the website; see section 2.

We use external payment service providers to process payments. The information required to process and allocate the payment is transmitted to these providers during the ordering process. Further information on the payment service providers used can be found in the consent management platform at watch.dfbtvplus.de, which you can access via the privacy settings.

The legal basis for the processing is performance of a contract pursuant to Article 6(1), point (b) GDPR.

We process your personal data until the purpose ceases to apply, generally for the duration of the contractual relationship. Information relevant to billing is retained in accordance with statutory retention periods.

Podcasts

URL: https://dfb-akademie.de

Types of personal data: IP address, device information

Purpose: downloading and playing podcasts

Legal basis: Article 6(1), sentence 1, point (a) GDPR

The DFB provides the DFB Play streaming platform, which allows users to watch current DFB matches live or on demand. In order to provide the streaming service, we process the following personal data:

• device ID;
• IP address;
• HTTP connection type (secure);
• stream name/details;
• stream duration;
• player/stream ID.

The legal basis for collecting and processing the personal data described above depends on the data concerned and the specific context in which it is collected and used. As a rule, we process personal data where this is necessary for the performance of a contract with you, for example to provide the service, pursuant to Article 6(1), point (b) GDPR; where the processing is based on our legitimate interests and these are not overridden by your data-protection interests or fundamental rights and freedoms, for example in connection with direct marketing in accordance with your preferences; or where you have given your consent to the relevant processing.

The processing activities set out below are carried out under the joint controllership of the DFB companies (see section 1.1). Any exceptions are expressly identified.

UNSERE TALENTE is the DFB app for selected youth national-team players. It forms part of the DFB Academy environment and provides access to the school portal.

Registration

Types of personal data: email address, password, date of registration

Purpose: registration and account management for the DFB user account required to use the school portal

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: upon termination by the user or as soon as the player is no longer part of the development programme; standard limitation period within the meaning of section 8

Accounts/profiles

The DFB app provides you with all the latest DFB news for fans, including live coverage of various competitions.

Types of personal data: title, first name, surname, email address, date of birth, parents/legal guardians, nickname, password, date of registration, player records, school-related data, school documents

Purpose: document management for players, teachers, accompanying persons and coordinators

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

Events organised by the DFB are sometimes supported by a corresponding event app. Within the event app, the DFB processes first name and surname, where applicable including title, gender and academic title, as well as the email address, on the basis of consent pursuant to Article 6(1), sentence 1, point (a) GDPR, in order to provide personalised information and support. The data is deleted no later than when consent is withdrawn; as a rule, it is deleted once the purpose of the event app has ceased to apply. Further details are set out in the relevant consent declaration.

Registration

Types of personal data: title, first name, surname, email address, date of birth, nickname, password, date of registration

Purpose: ensuring the smooth running of events and providing opportunities for participants to contact one another

Legal basis: Article 6(1), sentence 1, point (b) GDPR; where, for example, consent has been given to contact other participants, Article 6(1), sentence 1, point (a) GDPR

Deletion: standard limitation period within the meaning of section 8. Where processing is based on consent, generally upon withdrawal of that consent.

The Teampunkt app is operated under the sole responsibility of DFB GmbH & Co. KG.

With the team management app Teampunkt, we provide an app intended to make it easier for coaches and players to manage their team. Its features include planning training sessions, league matches and tournament dates, managing attendance and absences and providing a team chat. In order to use the app, the person responsible for the team must first activate the team, after which the names of coaches and players are transferred from DFBnet to the app, but are not yet published or made accessible to third parties.

4.3.1. Registration

To use the Teampunkt team management app and interact with other users in your team, you must register. Players/parents can only register if they have previously been invited by the coach. This invitation includes a personalised and encrypted activation link from which team membership is derived.

Categories of data subjects:

• persons responsible for teams;
• coaches;
• players;
• parents/legal guardians (optional).

During registration, we collect the following data:

• first name and surname;
• email address, which also serves as the username; and
• password (hashed).

When an invitation is accepted, the following data relating to the invited user is transferred from the DFBnet database to the Teampunkt database:

• first name, surname, date of birth;
• team affiliation;
• player photograph;
• player registration number and date of eligibility to play.

This data is required to create and configure your account and enable you to use the app, for example to confirm attendance at training sessions or league matches, contribute to discussions or take part in team votes. Only the first name, surname, player photograph and team affiliation are made visible to other team members.

The processing is based on Article 6(1), point (b) GDPR.

4.3.2. Features

The app’s main function is to coordinate matches, training sessions and other team activities. Users can add appointments, communicate with the team and create and assign tasks and activities. The app is free to use and use of the app is not mandatory in order to participate in organised football.

The features include:

• appointments with attendance/absence functions;
• tasks assigned to players;
• squads and line-ups, which must be approved by coaches;
• the team’s competitions, where stored on FUSSBALL.DE;
• statistics, including training and performance statistics.

Additional data may be required to use individual functions. Further information such as clothing size, shoe size, shirt number, preferred foot (right, left or both), position and other details can be entered voluntarily in the profile. Users can also enter attendance and playing-frequency information. This processing is based on your consent pursuant to Article 6(1), point (a) GDPR.

Statistics are only published within the team after the data subjects have given their consent. Coaches alone have access to the statistics beforehand. Data within the app is linked to publicly available information on FUSSBALL.DE, allowing information on divisions and matches, tables and statistics to be accessed via the app. You can activate individual statistics such as attendance or performance. Statistics are disabled by default; activation and release are based on your consent pursuant to Article 6(1), point (a) GDPR. The statistics are therefore not publicly visible unless the players or their parents/legal guardians actively release them for the other players in the team.

Your data is deleted when you terminate your user account with us. This does not apply to appointments created by a coach for the team, such as training sessions, or tasks created and assigned as part of team organisation.

To enable young people aged between 11 and 16 to register, we are legally required to obtain permission from their parents/legal guardians. The email address of the parent/legal guardian must therefore be provided. The account in the Teampunkt app can only be activated once the parent/legal guardian has confirmed their permission. The parent/legal guardian’s email address is stored and processed solely for the purposes of activating the user account and documenting consent. Children aged 10 and under cannot register themselves. In these cases, the coach sends an email invitation to the parent/legal guardian, provided that they have previously consented to receiving such an invitation.

4.3.3. Push notifications

If push notifications are activated, Firebase Cloud Messaging provided by Google (Android) and Apple Push Notifications (iOS) are used to provide this function. Google and Apple generate a calculated key consisting of the app identifier and the device identifier (device token). This key is stored on the Firebase platform together with the settings you have selected in order to provide content in accordance with your preferences. The Google and Apple servers cannot draw any conclusions about individual user requests or otherwise obtain information relating to an identifiable person.

4.3.4. Technical data processing and downloads

When you download the app, certain required information is transmitted to the app store you have selected, namely the Google Play Store or Apple App Store. This may include your username, email address, customer number associated with your account, the time of download, payment information and the individual device identifier. This data is processed exclusively by the relevant app store and is outside our control.

When you use the app, we automatically collect certain data required in order to provide it. This includes:

• internal device ID;
• IP address;
• version of your operating system;
• time of access;
• time of request;
• general log data.

This data is automatically transmitted to us but is not stored. It is used to provide you with the service and its associated functionality, improve the app’s features and performance and prevent and remedy misuse and malfunctions.

This processing is justified because it is necessary for performance of the contract between you as the data subject and us pursuant to Article 6(1), point (b) GDPR in order to provide the app, and because we have a legitimate interest in ensuring that the app functions correctly and reliably and in providing a service that meets market and user needs. This legitimate interest outweighs your rights and interests in protecting your personal data within the meaning of Article 6(1), point (f) GDPR.

4.3.5. Tracking

We only use various cookies after obtaining your consent, which you can select via the consent manager when you first use our mobile app. The relevant functions are only activated with your consent and may be used in particular to analyse and improve use of our mobile app, make it easier for you to use the service across different browsers or devices, recognise you when you return or display advertising, including where applicable tailoring advertising to your interests, measuring the effectiveness of advertisements or showing interest-based advertising. The legal basis for this processing is Article 6(1), sentence 1, point (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of your consent before it was withdrawn.

The DFB eFootball platform and tournaments are operated under the responsibility of DFB GmbH & Co. KG. Participation in DFB eFootball tournaments requires the processing of personal data.

Users must first register via the website in order to participate. The following personal data is requested:

• username (required);
• first name (required);
• surname (required);
• federal state (required);
• date of birth (required);
• email address (required);
• platform (optional);
• gamertag (optional).

To obtain a gamertag, you need an account on the PS4 or Xbox platform. The relevant privacy policies can be found at:

• Xbox Live: https://privacy.microsoft.com/de-de/PrivacyStatement
• PlayStation Network: https://www.playstation.com/de-de/legal/privacy-policy/

Personal data may also be processed by the game manufacturer when you use the games employed for DFB eFootball. The relevant privacy policy can be found at:

• EAFC: https://tos.ea.com/legalapp/WEBPRIVACY/US/de/PC/

Where the provision of personal data during registration is optional, the legal basis for processing by DFB GmbH & Co. KG is the user’s consent pursuant to Article 6(1), point (a) GDPR. The data is then processed until consent is withdrawn.

For required fields, the legal basis for processing personal data by DFB GmbH & Co. KG is Article 6(1), point (b) GDPR, as we require the data in order to perform the contractual relationship. The personal data is processed for the duration of the contractual relationship and deleted once it ends.

Additional personal data is processed for the purposes of running eFootball competitions. In addition to the data collected during registration, further information is generated which is linked to the gamertag and therefore to the individual behind it.

This includes, in particular, the following categories of personal data:

• club and squad affiliation, team tag, etc.;
• team administration and other roles;
• identification ID and verification of registered players’ identities;
• the running of competitions, in particular the draw for fixtures and presentation of matchdays and tournament brackets;
• match results and events, interruptions, team selections, etc.;
• reporting, public relations and marketing relating to the relevant event, in particular the broadcasting of matches via twitch.tv and other channels;
• communications, e.g. by email or Discord;
• for the dispatch of prizes, first name, surname and postal address.

The legal basis for processing personal data for participation in DFB eFootball competitions by DFB GmbH & Co. KG is Article 6(1), point (b) GDPR, as we require this data to perform the contractual relationship. Personal data stored in connection with the user account, such as a fussball.de ID, is processed for the duration of the contractual relationship and deleted when it ends. Tournament-related data, such as match results, is deleted no later than six months after the end of the tournament. This does not affect the processing of personal data for reporting purposes under the media privilege, i.e. processing for journalistic purposes.

In some competitions, participants also have the opportunity to win prizes. We therefore request the first name, surname and postal address of winners. Some prizes are provided by sponsors. In these cases, the prize is sent by the relevant sponsor. For this purpose, we must transfer your first name, surname and postal address to the sponsor. Further information about the relevant sponsors can be found in the tournament information.

The legal basis for the transfer is a legitimate interest pursuant to Article 6(1), point (f) GDPR. The legitimate interest consists of enabling sponsors to dispatch prizes. You may object to the processing pursuant to Article 21 GDPR. In this case, however, the prize cannot be sent.

Certain events require prior qualification, which may be organised under the responsibility of the regional and state associations using the DFB eFootball platform. Other organisations may also use the DFB eFootball platform for their own eFootball events.

In these cases, the data of registered participants or participants entered for the event must be transferred to the event organisers. These transfers are necessary to enable the organisers to take the measures required on site to organise and run the event. The specific recipients of the data are identified during the registration process.

Processing is carried out on the basis of Article 6(1), sentence 1, point (b) GDPR, as participants enter into a contract to participate in the event when they register. Processing is necessary in order to run the event.

DFB eFootball support is optionally also provided via the communication software Discord (Discord Inc., 444 De Haro Street, San Francisco). Registration on the service provider’s platform is required in order to use Discord.

When Discord is used, data may be transferred to servers in the USA. Discord’s privacy policy can be found at:

• https://discordapp.com/privacy

Use of Discord is voluntary. Alternatively, support can also be contacted by email.

For marketing purposes outside specific eFootball events, DFB GmbH & Co. KG processes personal data collected during registration.

DFB GmbH & Co. KG also transfers personal data for marketing purposes to DFB e.V. and its companies, regional and state associations (https://www.dfb.de/verbandsstruktur/landes-regionalverbaende/) and official partners (https://www.dfb.de/verbandsstruktur/partner-des-dfb/). DFB GmbH & Co. KG and the parties listed above process and use this personal data for internal customer analysis and for advertising by email relating to campaigns, tickets and other products, such as fan merchandise, specialist publications and licensed products, and services. Processing by DFB GmbH & Co. KG for marketing purposes, transfer by DFB GmbH & Co. KG to the parties listed above and processing by those parties are voluntary and are based on the data subject’s consent. The legal basis is Article 6(1), point (a) GDPR. Personal data is processed until consent is withdrawn.

Registered users can embed their own Twitch or YouTube streams on dfb-efootball.de in order to increase their reach. Before a stream can be embedded on dfb-efootball.de, it must first be authenticated. The purpose of the processing is to promote eFootball by providing a platform that increases the reach of eFootball streams. The legal basis for the processing is your consent pursuant to Article 6(1), point (a) GDPR. Personal data is processed until consent is withdrawn, for example by removing the stream from the user account, or until the dfb-efootball.de account is deleted. Further information about authentication with the various compatible providers is provided below.

Authentication with Twitch

To embed a Twitch stream on dfb-efootball.de, you must first generate an authorisation token using your Twitch account. You must then enter this token and your Twitch user ID (username) on dfb-efootball.de in order to embed the stream.

Further information can be found in Twitch’s privacy policy:

https://www.twitch.tv/p/de-de/legal/privacy-notice

Authentication with YouTube

To authenticate a YouTube stream, you must log in via the Google API. The following information is processed:

• primary email address associated with the account;
• profile information, where you have made this publicly visible;
• the YouTube account linked to your Google account.

This data is not stored in the IT systems of dfb-efootball.de.

Once a stream has been authenticated, DFB GmbH & Co. KG can retrieve the stream and associated metadata, such as the number of viewers, game being played and online status, and display it on dfb-efootball.de. Streams displayed on the platform are publicly accessible.

Further information can be found in YouTube’s privacy policy:

https://policies.google.com/privacy?hl=de

The organisation of match operations and ticketing in connection with the processing activities set out below is the responsibility of DFB GmbH & Co. KG.

Ticket shop

URL: tickets.dfb.de

Types of personal data: for registration: title, first name, surname, telephone number, mobile-phone number, street, house number, additional address details, postcode, town/city, country, email address, email confirmation, date of birth, password, password confirmation, nationality, payment details. For registered users: email address and password; alternatively, FCN membership number and FCN PIN.

Purpose: online shop for ordering tickets for matches involving DFB national teams and DFB-Pokal matches. A personal user account must exist or be created in order to complete an order.

Legal basis: Article 6(1), sentence 1, point (b) GDPR. For international matches outside the EU, data may also be transferred to those countries. Depending on the relevant country, such transfers are based on Article 45(1) GDPR where the country provides an adequate level of protection, such as Switzerland; Article 46(1) GDPR where appropriate safeguards for protecting personal data are in place; or Article 49(1), point (b) GDPR where the transfer is necessary for performance of the contract despite the absence of an adequate level of protection or appropriate safeguards. For advertising purposes based on a legitimate interest: Article 6(1), sentence 1, point (f) GDPR.

Deletion: 36 months after the end of the current calendar year; invoicing documents are retained until the end of the statutory ten-year retention period.

Email advertising

URL: tickets.dfb.de

Types of personal data: title, first name, surname, email address, email confirmation, goods or services purchased

Purpose: sending advertising relating to similar goods or services

Legal basis: Article 6(1), point (f) GDPR, section 7(3) UWG

Deletion: 36 months after the end of the current calendar year

Proof of eligibility

URL: tickets.dfb.de

Types of personal data: in addition to normal registration information: eligibility documentation for people with disabilities, including a photograph on the front and back; record of eligibility, validity of the eligibility document, type of disability, e.g. wheelchair user

Purpose: purchase of special categories of tickets for people with disabilities; booking seats specifically designated for the person’s disability; tickets for accompanying persons

Legal basis: Article 6(1), point (b), Article 9(2), point (a) GDPR

Deletion: the copy of the eligibility document is deleted immediately after it has been checked. All other data is deleted once the eligibility document expires, after which eligibility must be applied for again.

Hospitality

The DFB offers various hospitality options, including exclusive VIP packages for international matches and cup finals. These combine premium tickets with catering, special seating, parking services and additional stadium entertainment. The DFB uses Beyond Hospitality Group AG to organise and provide these services.

The following data in particular is processed:

• contact details, such as first name, surname, email address and telephone numbers;
• billing addresses;
• details of additional participants using the hospitality services.

The data is shared with the service provider so that it can organise and provide the services on behalf of the DFB. The legal basis for the processing is Article 6(1), sentence 1, point (b) GDPR. A data processing agreement pursuant to Article 28 GDPR has been concluded.

The data is deleted after expiry of the standard limitation periods unless a longer statutory retention obligation applies, including under the German Commercial Code (HGB) or Fiscal Code (AO).

Employees and representatives of media organisations and service providers eligible for accreditation (“applicants/accredited persons”) are hereby informed of the processing of their personal data (“data”) by DFB GmbH & Co. KG as part of the accreditation procedure for DFB GmbH & Co. KG events, as described below.

DFB GmbH & Co. KG is supported in some aspects of accreditation procedures for events by processors within the meaning of Article 28 GDPR. The relevant accreditation is issued by DFB GmbH & Co. KG.

Applicants/accredited persons need only provide data required to decide whether accreditation should be granted and to enable the accreditation to be used, or data that DFB GmbH & Co. KG is legally required to collect. Without this data, DFB GmbH & Co. KG will generally be unable to consider or review the accreditation application.

6.2.1. Use of the Accreditation Portal

The Accreditation Portal is provided as a web portal. When the website is accessed, the data referred to in section 3 is processed.

The following technically necessary cookies are also used:

.Accredit-SS

This is a session cookie used to identify the session status used by the application.

The cookie name may vary from one website to another and, depending on the type of website, may contain the website name and the word “live” or “uat”. Example: .Accredit-SANDBOX-live-SS

_RequestVerificationToken

This is a session cookie set by web applications built using ASP.NET MVC technologies as an anti-forgery cookie.

.Accredit

This is a session cookie used to retain the user’s identity within the session so that the user remains logged in. The name of this cookie may vary between clients.

Example: .Sandbox

_cookieacceptance

A persistent cookie used to indicate that the user has acknowledged the website’s cookie notice.

The legal basis for the processing is our legitimate interest in providing the Accreditation Portal pursuant to Article 6(1), point (f) GDPR.

6.2.2. Source and categories of data

DFB GmbH & Co. KG processes data that it receives from applicants/accredited persons as part of the accreditation procedure.

Relevant master data relating to applicants/accredited persons includes:

• all first names and surnames;
• date and place of birth;
• gender;
• personal email address;
• company;
• personal telephone number.

Depending on the accreditation, further data may be requested:

• birth name(s);
• previous names;
• nationality;
• registered address;
• type of identification document;
• identification-document number;
• photograph.

6.2.3. Purpose and legal basis of processing; data recipients

Within DFB GmbH & Co. KG, data is made available to those departments that require it in order to fulfil contractual and statutory obligations. Processors used by DFB GmbH & Co. KG pursuant to Article 28 GDPR, other service providers and other data recipients may also receive data for these purposes. These may include companies providing event organisation, event security, printing and dispatch and IT services.

Data relating to applicants/accredited persons is only transferred to recipients outside DFB GmbH & Co. KG where statutory provisions or official security vetting procedures permit or require this. Subject to these conditions, recipients may include those described below, including companies belonging to the DFB GmbH & Co. KG corporate group and other third parties.

6.2.4. For the purposes of the accreditation procedure

Data collected through the Accreditation Portal is processed and used by DFB GmbH & Co. KG exclusively in order to process your accreditation correctly, decide whether and to what extent a right of access should be granted and monitor compliance with the relevant restrictions. Processing is based on DFB GmbH & Co. KG’s legitimate interest in ensuring that the event is properly conducted, in particular ensuring the safety of visitors and protecting property brought to the event, pursuant to Article 6(1), point (f) GDPR.

Applicants/accredited persons have the right to object at any time, on grounds relating to their particular situation, to the processing of their data described above. Where an applicant/accredited person objects, DFB GmbH & Co. KG will no longer process the data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the applicant/accredited person concerned, or the processing is required for the establishment, exercise or defence of legal claims.

Where accreditation is carried out directly for a natural person who has a contractual relationship with DFB GmbH & Co. KG which can only be performed if accreditation is in place, the legal basis for the accreditation is the contract between the parties pursuant to Article 6(1), point (b) GDPR.

6.2.5. Legitimate interests

Where necessary, DFB GmbH & Co. KG processes data beyond the immediate purposes of the accreditation procedure in order to safeguard its legitimate interests or those of third parties.

Examples include:

1. recording and publicly disseminating photographs and audiovisual recordings from events in which applicants/accredited persons appear in that capacity, as well as the commercial and non-commercial exploitation of these photographs and audiovisual recordings without restriction as to time or territory, in any physical form, in particular production and distribution on all digital and analogue media formats, and in any non-physical form, in particular broadcasting, public communication and making available, such as by download or streaming, in all media and on all platforms by DFB e.V., DFB GmbH & Co. KG or third parties designated by them, as well as by other clubs and corporate entities participating in the event where applicable, and by licensees and partners of DFB e.V., DFB GmbH & Co. KG and those clubs, including cooperation, media and marketing partners;
2. establishing and exercising legal claims and defending legal disputes;
3. ensuring IT security and IT operations.

Applicants/accredited persons have the right to object at any time, on grounds relating to their particular situation, to the processing of their data described above. Where an applicant/accredited person objects, the DFB and its companies will no longer process the data unless compelling legitimate grounds for processing can be demonstrated which override the interests, rights and freedoms of the applicant/accredited person concerned, or the processing is required for the establishment, exercise or defence of legal claims.

6.2.6. Processing for public-interest purposes

Where necessary, DFB GmbH & Co. KG processes data for public-interest purposes and transfers data to the competent authorities where this is:

1. necessary to fulfil legal obligations imposed on DFB GmbH & Co. KG pursuant to Article 6(1), point (c) GDPR;
2. necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in DFB GmbH & Co. KG and/or the relevant event venue or venue lessor pursuant to Article 6(1), point (e) GDPR; or
3. necessary to prevent threats to national or public security pursuant to section 24(1), no. 1 BDSG.

Applicants/accredited persons have the right to object at any time, on grounds relating to their particular situation, to processing of their data pursuant to Article 6(1), point (e) GDPR. Where an applicant/accredited person objects, DFB GmbH & Co. KG will no longer process the data unless it can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the applicant/accredited person concerned, or the processing is required for the establishment, exercise or defence of legal claims. Processing for the prevention of threats to national or public security is carried out in particular as part of security vetting procedures (5.8.6).

6.2.7. Transfer of data for security vetting

To ensure the safe and smooth running of an event, employees may be subject to security vetting as part of their accreditation application. The aim is to prevent them from posing a potential threat to the event as a whole.

For this purpose, their first name(s), surname(s) and date of birth, and, in consultation with the security authorities, where applicable additional information such as place of birth, birth name(s), previous name(s), nationality, registered address, type and number of identification document, photograph and/or gender, are transferred to the security authorities responsible for the relevant event venue. The transfer is carried out by DFB GmbH & Co. KG on the instructions of the competent security authorities pursuant to Article 6(1), point (c) GDPR or section 24(1), no. 1 BDSG. The transferred data is checked against police databases. These include databases containing information in particular on criminal convictions, but also ongoing and discontinued investigations and criminal proceedings which did not result in a court conviction, as well as the “Gewalttäter Sport” database. The latter contains information on investigations initiated and concluded in connection with sporting events, in particular violent offences against persons and property and offences against public order. Please note that the information contained in these databases may be more extensive than that contained in the German Federal Central Criminal Register.

The recommendation from the security authority to DFB GmbH & Co. KG is made on the basis of and subject to the police legislation applicable at the relevant event venue. DFB GmbH & Co. KG receives only a recommendation from the security authority as to whether the individual should be deployed. DFB GmbH & Co. KG does not receive information from the databases or any reasons for the recommendation.

Where security concerns exist and a corresponding recommendation is made, accreditation may be refused. Where DFB GmbH & Co. KG refuses accreditation on the basis of information held by the security authority, the person concerned may contact the competent security authority. The person’s objections will then be reviewed and the notification to DFB GmbH & Co. KG corrected where appropriate.

Accreditation already granted may be withdrawn at any time, in particular where concerns arise on the basis of facts that subsequently become known or occur.

6.2.8. Retention period

Where necessary, DFB GmbH & Co. KG processes and stores data because repeated decisions on accreditation may be required for the duration of the contract with the relevant licensee or service provider employing the applicant/accredited person, or for the duration of a contract concluded directly with that person. Where the applicant/accredited person leaves their employment before the contract with the relevant licensee or service provider ends, or where a contract concluded directly with that person ends, DFB GmbH & Co. KG will, provided it has been informed by the relevant licensee or service provider, delete that person’s data when they leave, notwithstanding the provisions above. Statutory and contractual retention obligations within the meaning of sections 8 and 9 remain unaffected.

DFB GmbH & Co. KG provides its partners with a central platform for media services relating to the Google Pixel Frauen-Bundesliga. Users can access a content delivery network (CDS) via a personalised account and exchange media data and other content.

The following personal data is processed:

• For user profiles
  • name and contact details, including email, address and telephone number;
  • affiliation within the permissions-management system.
• Content data
  • image data;
  • audio recordings;
  • video recordings.

The categories of data subjects include in particular:

• players;
• employees of partners.

The data is accessible to third parties that have entered into a separate contractual agreement with DFB GmbH & Co. KG. These include media partners, sponsors and participating clubs.

DFB GmbH & Co. KG is partly supported in operating the CDS by processors within the meaning of Article 28 GDPR. The necessary agreements have been concluded with the relevant contractors. Operation of the CDS remains the responsibility of DFB GmbH & Co. KG.

Data relating to players is processed on the basis of express consent pursuant to Article 6(1), sentence 1, point (a) GDPR or a contractual agreement pursuant to Article 6(1), sentence 1, point (b) GDPR. Data relating to other users is processed on the basis of a contractual agreement pursuant to Article 6(1), sentence 1, point (b) GDPR. Where no consent has been given and no contract has been entered into, the data is processed on the basis of the DFB’s legitimate interest in match reporting and marketing pursuant to Article 6(1), sentence 1, point (f) GDPR.

Through an approval process (Approval Portal), the DFB ensures that youth academies operated by clubs in the higher divisions meet the relevant requirements. The categories of data subjects are: coaches, sporting management, organisational management, physiotherapists, sports psychologists, fitness coaches, goalkeeping coaches, doctors, dual-career contact persons, education contact persons and safeguarding contact persons.

The DFB processes the following data for this purpose:

• first name and surname;
• email address and telephone number;
• weekly working hours and role;
• uploaded proof of qualifications, e.g. employment contracts or training certificates;
• school cooperation agreement;
• list of players, including name and date of birth;
• concepts/documentation.

The purpose of the processing is registration and approval as a youth academy. The legal basis for the processing is performance of the contractual relationship pursuant to Article 6(1), sentence 1, point (b) GDPR. Personal data is deleted as soon as the purpose for which it was stored ceases to apply. This is particularly the case where an application for approval as a youth academy is unsuccessful, provided that no statutory retention periods prevent deletion. In such cases, the data is restricted and retained solely for the purposes of the required archiving.

DFB GmbH & Co. KG is responsible for issuing coaching licences, in particular the Pro Licence, A+ Licence, A Licence, B+ Licence, Goalkeeping A Licence, Goalkeeping B Licence and the advanced goalkeeping course. For this purpose, the DFB processes the data required to issue coaching licences. The data required in each case is determined by the requirements of the DFB Training Regulations and includes in particular:

• first name and surname;
• gender and title;
• postal address, including street, town/city and postcode;
• date-of-birth information;
• contact details;
• licence-related data, including courses and experience;
• certificate of fitness to participate in sport;
• enhanced certificate of good conduct.

The purpose of the processing is to process applications for the relevant licence and organise and administer licences for licence holders, including the necessary communication and information, including by email. The legal basis for the processing is performance of the contractual relationship pursuant to Article 6(1), sentence 1, point (b) GDPR. Where special categories of personal data are involved, these are processed in conjunction with consent pursuant to Article 9(2), point (a) GDPR. Personal data is deleted as soon as the purpose for which it was stored ceases to apply. This is particularly the case where an application for a licence is unsuccessful, provided that no statutory retention periods prevent deletion. In such cases, the data is restricted and retained solely for the purposes of the required archiving. The certificate of good conduct is deleted immediately after it has been reviewed by the responsible member of staff and is not retained.

Participation in continuing-education programmes and courses

Types of personal data: title, first name and surname, address, contact details, billing address where applicable, payment information and any further data evident from the relevant registration process and, where applicable, information relating to the administration of the course, VAT ID, continuing-education details and numbers, club data, dietary preferences and travel and accommodation information etc.

Purpose: establishing, organising, providing and administering continuing-education programmes and courses, improving data quality for analyses and statistics and administration using appropriate software.

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

Proof of the required licence at the relevant licence level may be a prerequisite for participation in continuing-education programmes and courses.

The processing activities set out below are carried out under the joint controllership of the DFB companies (see section 1.1).

The DFB allows fan clubs supporting its teams to register as official fan clubs of the national teams. To administer the fan clubs, the DFB processes the following data relating to the fan clubs and their members:

• name and contact details, at least an email address, of chairpersons and deputies;
• name and date of birth of fan-club members;
• contact details of members (optional);
• fan-club data;
• information relating to the organisation of events or the provision of benefits to fan-club members.

The data is processed for the purposes of managing and organising the fan club and membership, enabling member meetings, community events and other benefits such as discounts, priority purchase rights, merchandise and club meetings, checking applicants against the DFB’s stadium-ban database when applying to participate in the fan club/tournament registration and when applying for tickets, transferring the participant number to event organisers such as UEFA/FIFA for comparison where applicable, and reporting breaches of the fan-club code.

The legal basis for processing is the data subject’s consent pursuant to Article 6(1), point (a) GDPR. Provision of the data is voluntary, although the requirements for registration must be met. Consent can be withdrawn at any time without giving reasons. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

The legal basis for comparing data with the stadium-ban database when attending a stadium or in the event of breaches of the fan-club code is Article 6(1), sentence 1, point (f) GDPR. The DFB has a legitimate interest in ensuring spectator safety, enforcing its rights as the party responsible for the premises and ensuring compliance with laws and accepted social standards.

All data is deleted when it is no longer required for the purpose for which it was collected or when you withdraw your consent, unless the DFB is entitled or required by law to retain it for longer.

Fans of the national teams can register with the DFB as members of the Fan Club Nationalmannschaft. They receive a fan card entitling them to use various services and benefits determined by the DFB. The following data is processed during registration:

• first name and surname;
• email address;
• address;
• date of birth;
• bank details;
• telephone number (optional).

The legal basis for the processing is Article 6(1), sentence 1, point (b) GDPR.

Registration for the Fan Club Nationalmannschaft can be made as a group. In this case, data relating to at least nine additional persons must be entered in the registration form and transmitted to the DFB. The data of the persons included in the group application is also processed on the basis of Article 6(1), sentence 1, point (b) GDPR. The person making the application has been informed that they must have the consent and authorisation of all persons listed in the application and must have informed them about the associated processing of their data.

The Fan Club Nationalmannschaft sends service emails to the email addresses provided. These contain exclusive information and promotions relating to the Fan Club. This is carried out in accordance with the Fan Club’s terms and conditions. The information forms part of performance of the contract and is processed on the basis of Article 6(1), sentence 1, point (b) GDPR.

Users can also optionally subscribe to the newsletter and provide consent for marketing purposes. The legal basis for this processing is consent pursuant to Article 6(1), sentence 1, point (a) GDPR. Consent is voluntary and can be withdrawn at any time with effect for the future. Further details can be found in section 18 of this Privacy Policy.

The legal basis for comparing data with the stadium-ban database when attending a stadium or in the event of breaches of the fan-club code is Article 6(1), sentence 1, point (f) GDPR. The DFB has a legitimate interest in ensuring spectator safety, enforcing its rights as the party responsible for the premises and ensuring compliance with laws and accepted social standards. Where a ticket application is made, the participant number may be transferred to event organisers such as UEFA/FIFA for comparison.

Membership can be managed in the Fan Club area, which also provides options for organising and booking travel, member meetings, participation in the community and other benefits such as discounts, priority purchase rights, merchandise, no advance-booking fees and club meetings. Data may also be compared against the DFB’s stadium-ban database when applying to participate in the Fan Club/tournament registration and when purchasing tickets.

All data is deleted when it is no longer required for the purpose for which it was collected or when the contract is terminated, unless the DFB is entitled or required by law to retain it for longer.

Fans of the national teams can register with the DFB as members of the Fanbase. Registration entitles them to use various services and benefits determined by the DFB. The following data is processed during registration:

• first name and surname;
• email address;
• data and information relating to the use of Fanbase services.

The legal basis for the processing is Article 6(1), sentence 1, point (b) GDPR and consent within the meaning of section 7(2), no. 2 UWG.

Following registration, members regularly receive information about promotions, international matches and benefits. Unsubscribing from this newsletter automatically results in termination of membership and can be carried out at any time using the opt-out option in the newsletter.

All data is deleted when it is no longer required for the purpose for which it was collected or when the contract is terminated, unless the DFB is entitled or required by law to retain it for longer.

As part of the 2026 World Cup, the DFB gives data subjects the opportunity to have their first name and surname, referred to below as their “fan name”, published on the team bus and on other official DFB items or items belonging to DFB partners. The following personal data is processed in order to perform the contractual agreement:

• first name and surname;
• email address.

This includes publication of the fan name. The legal basis for the processing is Article 6(1), point (b) GDPR. Data subjects are thereby given the opportunity for their first name and surname to appear within the DFB environment as part of the campaign.

Participants have no entitlement to publication of their fan name. If a data subject’s fan name is not selected, the data is deleted once the final selection of fan names has been made, unless further consent has been provided to the DFB or other legal relationships exist. In all other respects, the DFB Fan Names Terms and Conditions of Participation apply.

The provisions governing participation in competitions in section 8 of this Privacy Policy also apply.

Fans who have purchased a ticket for an international match can consent to register for the “Match Experience” service. They can be contacted before, during and after the match via RCS chat. This includes real-time updates such as goal alerts, gamification features such as quizzes and polls, and partner and merchandising offers.

The following personal data is processed in connection with use of the RCS chat:

• mobile-phone number;
• message text and information provided within the chat itself, such as name, email address, gender and date of birth;
• profile information within the RCS chat;
• IP address.

The legal basis for the processing is Article 6(1), point (a) GDPR. You give your consent by starting a conversation with us after scanning a QR code. Consent can be withdrawn at any time. Please note that withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. To document your consent and defend our legal rights, we store information relating to your consent on the basis of Article 6(1), point (f) GDPR. The legitimate interest arises from the purposes stated above.

The purpose of processing data in connection with use of the RCS chat is to improve the matchday experience and provide partner and advertising offers.

Your use of Match Experience may be analysed. Only information provided by the messaging service itself is used for this purpose, such as your telephone number, message ID, times at which messages were sent and received and their delivery status. Availability information is not processed. This enables us to analyse the reach of the service, provide information tailored to users’ needs and continuously improve our service.

We use a service provided by Telekom Deutschland GmbH, which supplies us with the relevant tools. A data processing agreement pursuant to Article 28 GDPR has been concluded. The provider is Telekom Deutschland GmbH, Hahnstraße 43 d, 60528 Frankfurt am Main.

The processing activities set out below are carried out under the joint controllership of the DFB companies (see section 1.1).

If you enter a competition, personal data is processed for the purpose of running the competition. The categories of data processed are:

• first name;
• surname;
• email address;
• street and house number;
• postcode and place of residence;
• date of birth;
• telephone number (optional).

The legal basis for the processing is Article 6(1), point (b) GDPR. Data may be passed to sponsors for the purpose of sending prizes. Sponsors process this data solely for the purpose of dispatching the prize. It is not processed for any other purpose.

Where you have expressly given us your consent pursuant to Article 6(1), point (a) GDPR, your first name, surname and place of residence will be published on our websites if you win. Otherwise, publication will take place in anonymised form, for example “Max M. from Frankfurt”.

Your data is deleted six months after the end of the competition unless contractual or statutory retention requirements apply or otherwise stated in connection with the competition.

8.2.1. Advertising and marketing consent

Where you have consented to the use of your data for marketing purposes, the DFB companies will process your personal data. DFB GmbH & Co. KG, DFB e.V. and its companies process and use this personal data under joint controllership for internal customer analysis and for advertising by email relating to campaigns, tickets and other products, such as fan merchandise, specialist publications and licensed products, and services provided by DFB e.V., DFB GmbH & Co. KG, its companies and official partners. For customer-analysis purposes, advertising emails contain tracking parameters that record interactions with the advertising.

Processing by the DFB for marketing purposes, transfer by the organisation collecting the data to the parties listed above and processing by those parties are voluntary and are based on your consent pursuant to Article 6(1), point (a) GDPR. You can withdraw this consent at any time. You can of course also contact us using any other means, such as by post, to withdraw your consent. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn. Once consent has been withdrawn, personal data is retained for a further six months for the purpose of defending legal claims. The legal basis for this is Article 6(1), point (f) GDPR.

8.2.2. Newsletters

If you have subscribed to a newsletter, DFB GmbH & Co. KG, DFB e.V. and its companies process your personal data for the purpose of sending the newsletter and carrying out internal customer analysis. For customer-analysis purposes, newsletters contain tracking parameters that record interactions with the newsletter. Processing is voluntary and is based on your consent pursuant to Article 6(1), point (a) GDPR. You can withdraw this consent at any time via the portal operated jointly with DFB e.V. at newsletter.dfb.de. The portal can be accessed via the unsubscribe link at the end of the newsletter. You can of course also contact us using any other means, such as by post, to withdraw your consent. Processing continues until consent is withdrawn. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn. Once consent has been withdrawn, personal data is retained for a further six months for the purpose of defending legal claims. The legal basis for this is Article 6(1), point (f) GDPR.

The DFB regularly conducts surveys on various topics in order to collect insights and data concerning, among others, users, customers and players and other people involved in organised football, conduct market research, improve cooperation and improve DFB services. This may also include emails containing links to current surveys. The categories of data processed include:

• master data, where required for the survey;
• contact details/email address, optional/where consent has been given for a survey link to be sent;
• company affiliation;
• business-area affiliation;
• survey data, including answers, ratings and feedback;
• connection and location data.

For this purpose, we use a service provided by Netigate, which provides us with the necessary tools. A data processing agreement pursuant to Article 28 GDPR has been concluded. The provider is Netigate Deutschland GmbH, Untermainkai 27-28, 60329 Frankfurt am Main. Further details can be found at https://www.netigate.net/de/impressum/#legal.

Processing by the DFB is voluntary and is based on your consent pursuant to Article 6(1), point (a) GDPR. You can withdraw this consent at any time. The survey data and your personal data may be stored separately, meaning your survey responses may no longer constitute personal data and may therefore not be capable of being deleted because they cannot be attributed to you. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. Following withdrawal of consent, personal data may be retained for a further six months for the purpose of defending legal claims. The legal basis for this is Article 6(1), sentence 1, point (f) GDPR.

The processing activities set out below are carried out under the joint controllership of the DFB companies (see section 1.1).

Participation in events

Types of personal data: title, first name and surname, address, contact details, billing address where applicable, payment information and any further data evident from the relevant registration process.

Purpose: sending personalised invitations, planning and running the event and making bookings, e.g. flights, rail travel and hotel accommodation

Legal basis: Article 6(1), sentence 1, point (b) GDPR.

Deletion: standard limitation period within the meaning of section 8

Invitations and registration for events

Types of personal data: title, first name and surname, address, contact details, billing address where applicable, payment information and any further data evident from the relevant registration process.

Purpose: sending personalised invitations, e.g. to guests of honour, planning and running the event and making bookings, e.g. flights, rail travel and hotel accommodation

Legal basis: Article 6(1), sentence 1, point (f) GDPR.

Deletion: ten-year retention period.

Platform for managing events and participants

Types of personal data: title, first name and surname, address, contact details, billing address where applicable, payment details and any further data evident from the relevant registration process and, where applicable, data relating to event administration, VAT ID, continuing-education data and numbers, club data, dietary preferences, travel and accommodation information etc.

Purpose: establishing, configuring, running and organising DFB events

Legal basis: Article 6(1), sentence 1, point (b) GDPR.

Deletion: standard limitation period within the meaning of section 8

Registration of service providers

Types of personal data: title, first name and surname, address, contact details and any further data evident from the relevant registration process.

Purpose: organising and running DFB events.

Legal basis: Article 6(1), sentence 1, point (b) GDPR.

Deletion: standard limitation period within the meaning of section 8

Information about similar events

Types of personal data: first name and surname, address, contact details, email address.

Purpose: information about forthcoming similar events

Legal basis: Article 6(1), sentence 1, point (f) GDPR where you have participated in a paid event or withdrawn your consent; Article 6(1), point (b) GDPR where there is an association-related or legal obligation to provide the information; Article 6(1), sentence 1, point (a) GDPR where you have given consent.

Deletion: six months after consent is withdrawn by the user

In connection with DFB events, DFB marketing activities and performance of contracts, various recordings of individuals are made in the form of moving images, photographs and audio.

Depending on the relevant agreement or consent, personal data including

• portrait or full-body images;
• video and/or audio recordings;
• first name and surname (optional)

is processed and, in particular, published both offline and online. The data subjects include

• event participants;
• contractual partners involved in campaigns, e.g. models or advertising ambassadors;
• other people involved in DFB activities, e.g. player mascots.

Depending on the specific agreement with the data subjects, the data is processed on the basis of consent pursuant to Article 6(1), point (a) GDPR, for performance or implementation of a contract pursuant to Article 6(1), point (b) GDPR or on the basis of the DFB’s legitimate interest pursuant to Article 6(1), point (f) GDPR, in some cases in conjunction with sections 22 and 23 of the German Art Copyright Act (KUG). Before processing takes place, data subjects are informed of the specific legal basis and are given information relating to the particular processing involved.

9.2.1. Information on consent

Consent is voluntary and can be withdrawn at any time without giving reasons and with effect for the future. In this case, no further recordings will be published and existing publication will cease. Consent can be withdrawn at any time by emailing datenschutz@dfb.de or by using any of our other contact methods.

Photographs that primarily show the person concerned will then be removed from the online services of the companies referred to above without undue delay and will no longer be used for new publications. Where the person concerned is shown in a photograph together with other people, the photograph does not need to be removed; it is sufficient for the person concerned to be made unrecognisable without undue delay, for example by pixelating them. Where photographs have been published in printed materials, they will cease to be used from the next edition of the relevant publication following withdrawal of consent.

Information published online is accessible worldwide, can be found via search engines and can be combined with other information, which may allow profiles relating to an individual shown in an image to be created. Information placed online, including photographs and videos, can easily be copied and redistributed. Specialist archiving services also permanently document the content of certain websites at particular points in time. As a result, information published online may continue to be available elsewhere even after it has been deleted from the original website.

9.2.2. Information on legitimate interests

Images of event participants for documentation and reporting purposes are processed and, where applicable, published by the DFB unless the interests of the individuals shown clearly outweigh this interest in the individual case. When publishing images, the DFB follows the requirements of the GDPR while taking account of the principles developed under the KUG. Publication on the basis of legitimate interests may be appropriate in particular where the image was taken in connection with an event of contemporary significance or a gathering, or where the person shown appears only incidentally alongside the main subject of the publication. Participants can indicate an individual interest against publication by clearly displaying a marker provided by the DFB at the relevant event. In other cases, images are published only on the basis of consent, which can be withdrawn at any time with effect for the future.

9.2.3. General information on the use of photographs and video recordings

The DFB distributes these recordings without restriction as to time or territory, commercially and non-commercially, in any physical form, in particular through production and distribution on all digital and analogue media formats, and in any non-physical form, in particular through broadcasting, public communication and making available, such as by download or streaming, in all media and on all platforms operated by the DFB, its subsidiaries or other third parties, such as the press and cooperation, media and marketing partners.

To organise and carry out our activities, it is sometimes necessary for individuals to register in advance or provide certain information. For this purpose, we use Microsoft Forms (“MS Forms”). Depending on the relevant form or survey, the data processed may include responses or feedback, the date and time of submission, user IDs and associated data where the user is logged in, and technical log data, including audit logs. The data is processed exclusively for the purposes specified in the relevant form or survey.

When a Microsoft Form is submitted, the data entered may be processed by Microsoft in the USA. User IDs and technical data are not evaluated for survey purposes and survey responses are not attributed to individual users on that basis. This data can only be viewed by DFB administrators and not by the creators of the surveys. To ensure an adequate level of protection for the transfer of personal data to the USA, we have entered into a data processing agreement with the service provider. Processing is intended to take place exclusively within the EU wherever possible. However, because there remains a theoretical possibility of access from a third country, in this case the USA, standard contractual clauses within the meaning of the GDPR have also been agreed with the service provider. Microsoft is also certified under the EU-US Data Privacy Framework, while the standard contractual clauses have for many years formed part of Microsoft’s standard agreements with its customers and apply to all transfers from EU Member States. Microsoft also provides further safeguards intended to prevent unauthorised access as far as possible. Further information can be found in Microsoft’s privacy policy at https://privacy.microsoft.com/en-gb/privacystatement.

Where processing is required for performance of a contract, the legal basis is Article 6(1), point (b) GDPR. In all other cases, the legal basis is your consent, which you give by submitting the form.

All data is deleted when it is no longer required for the purposes for which it was collected or when you withdraw your consent, unless the DFB is entitled or required by law to retain it for longer.

Video conference

Types of personal data: title, surname, first name, email address, recordings of text, audio and video data

Purpose: participation in the Zoom conference. The DFB reserves the right subsequently to publish the recording on DFB websites. This will be set out in advance in the conditions of participation.

Legal basis: Article 6(1), sentence 1, point (b) GDPR in accordance with the conditions of participation; sections 22 and 23 KunstUrhG

Deletion: after the end of the event, provided no consent for marketing has been given

Zoom

Types of personal data: meeting data, text, audio and video data, IP address, telemetry data, approximate location; see https://zoom.us/de-de/privacy.html#_Toc44414845.

Purpose: participation in a video conference organised by the DFB, including transfer of the technically necessary data required for participation via Zoom. Zoom Video Communications, Inc., Attention: Data Privacy Officer, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA, email: privacy@zoom.us

Legal basis: Article 6(1), sentence 1, point (a), Article 28 and Article 49(1), point (a) GDPR

Deletion: after the end of the event; at Zoom, in accordance with its privacy policy

Digital communication tools are used in connection with events, courses and other joint meetings. Some of these tools allow video conferences to be recorded. The ability to record video conferences may be used for various purposes. In every case, the purpose must be communicated and consent obtained. Both participants’ video images and spoken contributions may be recorded. Details relating to third parties mentioned in presentations or discussions, for example where names are referred to, may also be recorded. The following categories of data are therefore covered:

• video image;
• audio stream;
• first name and surname;
• substantive contributions.

This may affect course participants, cooperation partners and external DFB service providers and suppliers. The relevant contact person and the specific purpose are communicated to the data subjects before each recording. The legal basis for the recording is consent pursuant to Article 6(1), sentence 1, point (a) GDPR. Consent is voluntary. The data subject has the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

The recording is automatically deleted after 60 days unless there are additional purposes for which it needs to be retained.

Registration for sponsor/partner trips

URL: https://starciteap.smarteventscloud.com

Types of personal data: title, academic title, first name, surname, email address, nationality, dietary requirements, telephone number, mobile-phone number, company, street, house number, postcode, town/city, passport number, first name and surname of the person making the booking, email address of the person making the booking, company of the person making the booking, telephone number of the person making the booking, departure and arrival information, hotel

Purpose: organising and running the sponsor/partner trip

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: standard limitation period within the meaning of section 8

Contractual relationships

Types of personal data: master data, contact persons and their contact details, contractual data, communications

Purpose: managing and performing contractual relationships

Legal basis: Article 6(1), sentence 1, point (b) GDPR.

Deletion: standard limitation period within the meaning of section 8

Satisfaction survey

Types of personal data: business email address for sending the survey link, company affiliation, business-area affiliation, responses to questions

Purpose: improving cooperation with our partners, conducting regular partner-satisfaction surveys, sending emails containing links to current surveys to improve cooperation. For this purpose, we use a service provided by Netigate, which supplies us with the relevant tools. A data processing agreement pursuant to Article 28 GDPR has been concluded. The provider is Netigate Deutschland GmbH, Untermainkai 27-28, 60329 Frankfurt am Main. Further details can be found at https://www.netigate.net/de/impressum/#legal.

Legal basis: Article 6(1), sentence 1, points (b) and (f) GDPR, section 7(3) UWG

Deletion: three years after the contractual relationship ends or following an objection to receiving communications. Distribution is stopped immediately following an objection.

Procurement procedures/tenders

Types of personal data: company master data, contact details of contact persons, data relating to the tender

Purpose: managing, organising and carrying out the procurement procedure

Legal basis: Article 6(1), point (c), Article 6(3), point (b) GDPR and section 97(1) GWB (Act against Restraints of Competition), section 55(1) Federal Budget Code (BHO)

Deletion: the duration for which personal data is stored is governed by the applicable budget-law retention periods under section 79 BHO and, under procurement law, section 8(4) of the Procurement Ordinance (VgV) and section 6(2) UVgO. The DFB’s deletion policy is used to implement these retention periods.

Fee agreements

Types of personal data: master data, billing data, engagement data, documents relevant to performance, e.g. licences and qualifications

Purpose: processing your data for general contract and fee administration. This includes managing personal data, including fee agreements, tender documents, communications and other relevant documentation.

Legal basis: Article 6(1), sentence 1, point (b) GDPR.

Deletion: standard limitation period within the meaning of section 8

9.8.1. General information

As an initial step in developing a carbon-footprint tool, a number of pilot clubs are selected to assist in creating the tool.

For this purpose, the DFB collects club information and information on clubs’ carbon footprints. Personal data relating to a club contact person is also processed, namely name, role and DFBnet ID. There is also an exchange of information with participating clubs, including via online formats where appropriate. Participating clubs may also communicate with the service provider commissioned to develop the carbon-footprint tool.

The legal basis for processing the personal data is performance of the legal relationship concerning participation in the pilot project pursuant to Article 6(1), point (b) GDPR.

All data is deleted when it is no longer required for the purposes for which it was collected. This will be the case no later than when the project has been completed.

9.8.2. Reporting new funding opportunities

The DFB’s new carbon-footprint tool provides information on funding opportunities available to clubs to improve their carbon footprint. To ensure that as many available funding schemes as possible, whether regional, national or otherwise, are included, users can notify the DFB of funding opportunities not yet listed so that these can also be included in the tool. Users submitting information should be contactable by the DFB so that any outstanding questions can be clarified. Their names are not published, although the name of the club that reported the funding opportunity may be displayed. The following information is required:

• details of the funding scheme, including name, category, region and link;
• optional contact details, including first name, surname and email address;
• optional club details for publication in the carbon-footprint tool.

Processing by the DFB is voluntary and based on your consent pursuant to Article 6(1), point (a) GDPR. You may withdraw this consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn. Following withdrawal of consent, personal data may be retained for a further six months for the purpose of defending legal claims. The legal basis for this is Article 6(1), sentence 1, point (f) GDPR.

9.8.3. Anstoß für Grün ideas competition

As part of the DFB’s ideas competition, clubs can submit ideas for environmental and climate-protection measures. The competition concluded on 31st December 2024.

The following information is required for a submission:

• contact details, for contacting nominees and unsuccessful applicants;
• club details, required in order to assess submissions;
• details of the concept, required in order to assess submissions.

Processing is carried out solely for the purpose of running the ideas competition pursuant to Article 6(1), point (b) GDPR. The data is deleted when the purpose of the processing ceases to apply. This occurs once the ideas competition has concluded.

The processing activities set out below are carried out under the sole responsibility of DFB GmbH & Co. KG.

To support the provision of courses, the DFB operates an electronic learning platform on which personal data is also processed. In some cases, course participants record videos of training sessions they conduct. These are subsequently processed on the electronic learning platform as part of their further training.

The DFB operates a number of Edubreak instances, including https://dfb.edubreak.de, https://club-berater.edubreak.de/, https://dfb-ausbilderportal.edubreak.de/ and https://dfb-refportal.edubreak.de/.

The following processing takes place on the platform:

Participation in the e-learning platform

URL: dfb.edubreak.de

Types of personal data: first name, surname, email address, contributions made on the platform and, where users choose to provide them, organisation, role, telephone number, interests, profile photograph and “About me” information

Purpose: providing the course

Legal basis: Article 6(1), sentence 1, point (b) GDPR

Deletion: following termination and expiry of the statutory limitation period plus an additional three-month period.

Video recordings as part of course participation

URL: dfb.edubreak.de

Types of personal data: audio and images of participants in the training session being filmed

Purpose: providing the course

Legal basis: Article 6(1), sentence 1, point (a) GDPR

Deletion: after three years; immediately where consent is withdrawn.

10.2.1. Processing when contacting us via the website

When you use the contact form, we process the following data and store it until your enquiry has been dealt with:

• first name and surname;
• email address;
• telephone number (optional);
• DFBnet ID (optional);
• problem-specific data (optional):
  • which website did the error occur on?
  • which browser are you using?
  • which operating system are you using?
  • when did the problem occur?
• selected default settings (optional):
  • association;
  • season;
  • team type;
  • competition level;
  • region;
  • series;
  • division;
  • club;
  • team;
• application-specific data (optional):
  • season;
  • nine-digit match ID;
  • club;
  • division;
• additional information (optional);
• your message to us.

This data is processed for the purpose of responding to your enquiries. The processing is based on our legitimate interest pursuant to Article 6(1), point (f) GDPR, as we have an interest in responding to your questions and addressing your concerns.

10.2.2. Online approval procedure

In addition to sporting qualification, a club/team must also be approved by the DFB in order to participate in a national competition. The Approval Procedure application supports full-time employees in checking whether the admission requirements have been met. Approval is only granted upon application by the club. The data subjects involved in this processing are:

• full-time club employees;
• voluntary club staff;
• coaches.

The following data is required:

• surname, first name;
• gender (optional);
• date of birth (optional);
• address (optional);
• telephone number (optional);
• mobile-phone number (optional);
• email address (optional);
• type and term of coaching licence.

This data is processed for the purposes of the contractual relationship. The processing is based on Article 6(1), point (b) GDPR for performance of contracts, in this case to carry out the association’s purpose of organising football in accordance with the DFB Statutes and regulations.

We store your data for as long as it is required for these purposes. The data listed above is generally deleted after three years unless grounds under Article 17(3) GDPR prevent deletion.

10.2.3. Sportmedia Services – applying for access

When you apply for access, we process the following data and retain it until the contractual relationship ends:

• first name and surname;
• email address;
• telephone number (optional);
• publisher/newspaper/company;
• data specific to the service concerned;
• additional information (optional);
• your message to us.

This data is processed for the purposes of the contractual relationship. The processing is based on Article 6(1), point (b) GDPR for performance of the contract.

The processing activities set out below are carried out under the sole responsibility of Deutscher Fußball-Bund e.V.

The personal data collected as part of participation in the “Schule und Verein: Gemeinsam am Ball!” project includes:

• the name of the contact person at the club and school;
• the name of the club chairperson;
• the name of the headteacher;
• address;
• telephone number;
• email address;
• the club’s bank details.

This data is collected, used and processed by Deutscher Fußball-Bund e.V. and the DFB-Stiftung Sepp-Herberger. It is used to dispatch packages and materials, conduct internal analysis and evaluation of the project, transfer funding and provide regular information on current and future DFB activities relating to schools. Collection, use and processing for any other purposes is excluded. The data may also not be disclosed to third parties or sponsors, with the exception of service providers used by the DFB to implement the projects. These are engaged as processors within the meaning of Article 28 GDPR. The legal basis for the processing is performance of the contractual relationship pursuant to Article 6(1), sentence 1, point (b) GDPR and, where applicable, consent pursuant to Article 6(1), sentence 1, point (a) GDPR.

DFB e.V. presents annual volunteer awards to individuals who have made an exceptional contribution to football as volunteers, such as the DFB Volunteer Award and Football Heroes. For this purpose, DFB e.V. provides a form through which volunteers can be nominated for an award. Nominations are forwarded to the relevant state associations and organisational bodies, which select the respective award recipients from among those nominated. DFB e.V. may invite award recipients to digital and/or in-person events in order to honour them. Where award recipients receive goods or services from DFB e.V., personal data may be transferred to third parties where this is necessary to provide the prizes.

DFB e.V. records the following personal data:

• relevant state association and district association;
• nominating person, in particular:
  • first name and surname;
  • club and role;
  • telephone number and email address;
  • period of voluntary activity (voluntary);
• volunteer/nominee, in particular:
  • title (voluntary);
  • first name and surname;
  • club and role and, where applicable, age group;
  • home address;
  • email address;
  • date of birth where applicable;
  • brief reasons for the nomination;
  • further reasons (optional);
  • history within the club (optional);
  • where applicable, further information required to provide prizes.

The legal basis for the processing is Article 6(1), point (b) GDPR. Honouring volunteers directly contributes to DFB e.V.’s association purposes. Where information about the nominating person is provided voluntarily, the legal basis is consent pursuant to Article 6(1), point (a) GDPR.

The personal data collected is deleted once the purpose of the processing ceases to apply. For all nominees, this will generally be after the award recipients have been selected. For selected nominees, processing generally continues until all events connected with the award have concluded. A list of the names of all award recipients is retained for three years.

At https://schiedsrichter-toolbox.dfb.de/, DFB e.V. provides functionality that can be used to create advertising materials such as posters, advertisements, flyers, newsletters and press releases. Personal data is also requested in order to include contact persons in the materials generated. This generally consists of the contact person’s name, email address and telephone number. The purpose of the processing is to create the materials referred to above. The legal basis is the promotion of the association’s purposes pursuant to Article 6(1), point (b) GDPR, specifically the promotion of public-relations activities relating to referee recruitment through provision of the Referee Toolbox. Further use of the materials created is the responsibility of the relevant clubs or organisations that have used the Referee Toolbox.

The personal data referred to above is also stored in a log entry together with the parameters relating to the selected medium. This is used to investigate potential misuse of the Referee Toolbox. We delete the log entries after three months.

The legal basis for retaining the creation logs is a legitimate interest pursuant to Article 6(1), point (f) GDPR. The legitimate interest consists of preventing misuse and investigating potential criminal offences.

DFB e.V. runs a “DFB-Punktespiel” with participating clubs. Members of participating clubs can report activities for which their club can earn points and win prizes.

A mein.DFB account is required to participate in the Punktespiel. Once you have logged in successfully, you can select your club. Your registration is then transferred to your club so that it can verify your membership. You can then submit activities.

The following personal data is processed:

• your mein.DFB account and associated information, the club you have selected and the activities you report.

Participating clubs can be registered for the Punktespiel by responsible club officials. In this case, the following information is processed:

• your mein.DFB account and associated information, your club affiliation and role, the DFBnet club ID, the email address of the club or responsible club official, the postal address for sending prizes, supporting documents such as an exemption notice, appendix to the corporation-tax assessment or positive notice pursuant to section 60a(1) AO.

Where necessary, data collected as part of the Punktespiel may also be shared with the relevant state association, for example in connection with the presentation of prizes or information about activities.

The purpose of processing personal data is to run the Punktespiel. The legal basis for the processing is Article 6(1), point (b) GDPR. Your personal data is deleted once the purpose for which it was stored ceases to apply. This occurs when the relevant Punktespiel ends, unless statutory retention periods prevent deletion. In such cases, the data is restricted and retained solely for the purposes of the required archiving.

DFB GmbH & Co. KG is responsible as the event organiser for the DFB-Pokal final in Berlin. During this event, video recordings are made in the stadium by the DFB and other organisations involved. These recordings are made primarily for the following purposes:

• criminal prosecution;
• enforcement of civil-law claims.

The following categories of personal data and data subjects are processed:

• personal data: recordings of people in spectator areas, in particular their faces and behaviour, and the time and location of the recordings;
• data subjects: visitors, security personnel and service staff.

The processing is necessary to safeguard the legitimate interests of the controller or a third party pursuant to Article 6(1), sentence 1, point (f) GDPR.

To ensure stadium security and enable criminal prosecution, the stadium and, depending on local circumstances, parts of its surroundings are subject to video surveillance pursuant to Article 6(1), sentence 1, point (f) GDPR in conjunction with section 4 of the German Federal Data Protection Act (BDSG). In particular, where a criminal offence is suspected and/or occurs, the data may be used as evidence and transferred to authorities or courts for these purposes. Where an event recorded by video camera takes place without incident, the recordings are deleted in accordance with the applicable data protection regulations, in particular the GDPR and BDSG.

The DFB reserves the right to make additional video recordings of fan areas during matches designated as particularly high risk or where there is a specific reason to do so. The data collected in this way is subject to detailed analysis both by the DFB as event organiser and, upon request, by the participating clubs, to which it is transferred for further analysis. The recording and analysis are carried out for the purpose of identifying offenders so that the DFB or participating clubs can enforce legitimate civil-law claims against them. These include in particular pursuing claims for damages and imposing stadium or premises bans, as well as conducting sports disciplinary proceedings. The measures also serve to reduce the risk posed to the current match and future matches, thereby protecting the life, physical integrity and health of other visitors and improving general spectator safety.

This data is stored, transferred and analysed by the DFB and the clubs concerned. Where no relevant behaviour has been recorded or it is not possible to identify the offenders, the recordings are deleted after three months. Before recordings are transferred to clubs, uninvolved persons are rendered unrecognisable by the DFB using appropriate measures.

The processing activities set out below are carried out under the sole responsibility of Deutscher Fußball-Bund e.V.

The outdoor areas of the DFB Campus, the entrances to the building and parts of the interior, namely the area known as the Boulevard, are protected by video surveillance. Video surveillance is used to protect the DFB’s rights as the party responsible for the premises and is intended both to prevent burglary, vandalism and other criminal offences through a deterrent effect and to enable offenders to be identified. It is also intended to protect the property of the employer, its customers, suppliers and employees. The video-surveillance system is therefore operated solely for the prevention and investigation of criminal offences. The following data is processed:

• image and video recordings;
• time and camera location.

The data is stored for seven days and then deleted or overwritten. The legal basis for the processing is Article 6(1), sentence 1, point (f) GDPR. The DFB’s interests consist of preventing and investigating criminal offences in order to protect property and its rights as the party responsible for the premises.

The DFB provides rooms at its Campus for overnight stays. The data required to organise, provide and otherwise administer overnight stays is collected and processed. The following data is processed:

• names and contact details of the person making the booking;
• names and contact details of guests, e.g. employees, committee members etc.;
• booking details and periods, including the reason for the overnight stay and committee affiliation or similar information;
• payment-processing data.

The legal basis for the processing is performance of the contractual relationship pursuant to Article 6(1), sentence 1, point (b) GDPR. The data is deleted three years after the end of the calendar year in which the overnight stay took place pursuant to sections 195 et seq. BGB, unless statutory retention periods prevent deletion. The data may be shared with authorities where required by local tourism and accommodation regulations pursuant to Article 6(1), sentence 1, point (c) GDPR.

The DFB offers tours of the DFB Campus. Tours are booked online using a booking form. The following personal data is collected:

• first name and surname;
• email address;
• date and time of the booked tour.

The legal basis for the processing is performance of the contractual relationship pursuant to Article 6(1), sentence 1, point (b) GDPR. The purpose of the processing is to organise and provide Campus tours. Your personal data is deleted once the purpose for which it was stored ceases to apply. This will generally be after the Campus tour has taken place, provided that no statutory retention periods prevent deletion. In such cases, the data is restricted and retained solely for the purposes of the required archiving.

For the use of rooms and areas, paid provision of rooms for accommodation and use of services by customers at the DFB Campus, Kennedyallee 274, 60528 Frankfurt am Main, the DFB processes the following data:

• first name and surname;
• contact details;
• company, where applicable;
• address;
• bank-account details;
• data required to administer, organise and provide the accommodation/event.

Personal data relating to customers and their authorised decision-makers may also be transferred to the competent bodies and authorities in order to coordinate the relevant security arrangements for the event, in particular the police, fire service, public-order authorities and medical and emergency services. Where security authorities are to carry out security vetting of personnel deployed at the event, the data subject’s express consent is required. Where the DFB does not receive the data directly from the data subject, it requires the party transferring the data to provide a data-protection guarantee confirming that the data subject has given consent.

The data is processed to administer provision of the relevant services. The legal basis for the processing is Article 6(1), sentence 1, point (b) GDPR. Further details on processing can be found in section 9 of the General Terms and Conditions for DFB Campus Services.

All data is deleted when it is no longer required for the purpose for which it was collected or when the contract is terminated, unless the DFB is entitled or required by law to retain it for longer.

In addition to the information provided in sections 4 to 7, data is generally retained by the DFB as follows:

1. Where a contractual relationship with the DFB ends, the data is deleted once the standard contractual limitation periods have expired and is merely restricted until that time.
2. Where data is processed on the basis of our legitimate interests, it is deleted once the purpose ceases to apply, unless grounds prevent deletion or further retention is otherwise lawful (see section 8.3).
3. We may be legally required pursuant to section 14b UStG and section 147 AO to retain information under commercial or tax law and any personal data contained in it pursuant to Article 6(1), point (c) GDPR. It is archived only for the duration of the statutory retention periods. Beyond this period, processing without your consent takes place only:
   1. to protect the rights of another legal or natural person;
   2. for the establishment, exercise or defence of legal claims;
   3. on grounds of substantial public interest in the EU or a Member State.

Your personal data is not transferred to third parties for purposes other than those listed below. We only transfer your personal data to third parties where:

1. you have expressly consented to this pursuant to Article 6(1), sentence 1, point (a) GDPR;
2. the transfer is legally permissible and is required pursuant to Article 6(1), sentence 1, point (b) GDPR for the performance of contractual relationships with you;
3. there is a legal obligation to make the disclosure pursuant to Article 6(1), sentence 1, point (c) GDPR;
4. the disclosure is required pursuant to Article 6(1), sentence 1, point (f) GDPR to safeguard legitimate interests, where these have been expressly described in this Privacy Policy, in particular under sections 4 and 7, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed; or
5. the data is transferred to a service provider acting on our behalf and solely on our instructions, whom we have selected carefully pursuant to Article 28(1) GDPR and with whom we have entered into an appropriate data processing agreement pursuant to Article 28(3) GDPR. Among other things, this agreement requires our contractor to implement appropriate security measures and grants us extensive rights of oversight.

Transfers to service providers under point 5 for the purpose of processing on our behalf take place in the following areas: technical provision and programming of the website, user communications, shop systems and provision of software as a service.

Where data is processed in connection with international matches outside the EU, it may also be transferred to the relevant countries. Such transfers are carried out for the purpose of performing the contract pursuant to Article 6(1), sentence 1, point (b) GDPR and, depending on the relevant country, are based on Article 45(1) GDPR where the country provides an adequate level of protection, e.g. Switzerland; Article 46(1) GDPR where appropriate safeguards for protecting personal data are in place; or Article 49(1), point (b) GDPR where the transfer is necessary for performance of the contract despite the absence of an adequate level of protection or specific safeguards.

Various technologies are used on our websites to provide you with the best possible user experience, in particular cookies, scripts and embedded content, hereinafter referred to as “technologies”.

Cookies are small text files that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted when your visit ends. Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

We also use scripts on our websites to provide other functionality, for example for statistical analysis of our website or protection against bots.

Cookies and scripts from third-party companies may also sometimes be stored on your device when you visit our website, e.g. third-party cookies. These enable us or you to use certain services provided by the relevant third party, e.g. cookies for measuring reach or embedding third-party content. We also embed content provided by third parties in order to offer you a varied range of content on our websites, such as videos and streams.

The technologies described above perform various functions. Many technologies are technically necessary because certain website functions would not work without them, e.g. the shopping-basket function or display of videos. Other technologies are used to analyse user behaviour or display advertising. Technically necessary technologies are stored on the basis of Article 6(1), point (f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in using these technologies in order to provide its services in a technically error-free and optimised manner.

Consent pursuant to Article 6(1), point (a) GDPR is obtained for technologies that are not technically necessary. Where consent to the storage of cookies has been requested, the relevant cookies are stored solely on the basis of this consent. Consent can be withdrawn at any time with effect for the future. Further information on cookie consent can be found in section 16.1.

You can configure your browser to notify you when cookies are set and only allow cookies on a case-by-case basis, exclude the acceptance of cookies in certain cases or generally, and activate automatic deletion of cookies when the browser is closed. Disabling cookies may restrict the functionality of this website. Further information on these options for the most commonly used browsers is available at:

• Microsoft Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
• Mozilla Firefox: https://support.mozilla.org/de/kb/Cookies-blockieren
• Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=de
• Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

This website uses the Usercentrics Consent Management Platform (CMP) to enable the use of certain cookies, scripts and embedded content in compliance with data-protection requirements. In particular, various technologies can be integrated through Usercentrics and managed on the basis of a legitimate interest or consent. Usercentrics can also be used to provide information about the technologies used on our websites.

The provider of this technology is Usercentrics GmbH, Rosental 4, 80331 Munich, website: https://usercentrics.com/de/ (“Usercentrics”).

When you access our website, the following personal data is transferred to Usercentrics:

• your consent(s) or withdrawal of your consent(s);
• your IP address;
• information about your browser;
• information about your device;
• the time of your visit to the website.

Usercentrics also stores a cookie in your browser in order to associate the consent you have given or withdrawn with you. The data collected in this way is stored until you ask us to delete it, delete the Usercentrics cookie yourself or the purpose for storing the data ceases to apply. Mandatory statutory retention obligations remain unaffected.

Usercentrics is used in order to obtain the consent required by law for the use of certain technologies. The legal basis for this is Article 6(1), sentence 1, point (c) GDPR. A distinction is made between functional cookies and cookies used to generate statistics. You can change your cookie settings at any time by clicking the Usercentrics icon at the bottom left.

We have entered into a data processing agreement with Usercentrics. This agreement is required under data-protection law and ensures that Usercentrics processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Further information on the service can be found at https://usercentrics.com/de/. Usercentrics’ Privacy Policy is available at https://usercentrics.com/de/datenschutzerklaerung/.

Information about the technologies we use, in particular the purposes of processing, legal bases, transfers and possible transfers of data to third countries, can be found in our Usercentrics Consent Management Platform (see section 16.1). When accessing the website for the first time, click “Settings”. You can access the information again at any time by clicking “Cookie Settings” in the footer of our websites.

You can withdraw consent given through Usercentrics at any time with effect for the future. Please note, however, that certain functions may then no longer be available. To withdraw your consent, click “Cookie settings” in the footer of our websites and make the desired changes.

Where processing is based on a legitimate interest, you can object via Usercentrics by changing the relevant settings as described above. Where the corresponding settings are not available, your right to object is restricted because there are compelling legitimate grounds requiring the processing; see Article 21(1), sentence 2 GDPR. This applies in particular to security-related services.

We maintain accounts on various social networks. Information on data protection can be found in our Social Media Policy. Where we use technologies provided by social networks on our websites, these are integrated through our Usercentrics CMP; see the section on cookies and consent management.

As a data subject whose personal data is processed, you have the right:

1. pursuant to Article 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the purposes of the processing, categories of personal data, categories of recipients to whom your data has been or will be disclosed, planned retention period, existence of a right to rectification, deletion, restriction of processing or objection, existence of a right to lodge a complaint, source of your data where it was not collected from you, and the existence of automated decision-making, including profiling, and where applicable meaningful information about the details involved;
2. pursuant to Article 16 GDPR, to request without undue delay the rectification of inaccurate personal data or completion of personal data stored by us;
3. pursuant to Article 17 GDPR, to request deletion of personal data stored by us unless the processing is required to exercise the right to freedom of expression and information, comply with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
4. pursuant to Article 18 GDPR, to request restriction of the processing of your personal data where you dispute the accuracy of the data, the processing is unlawful but you oppose its deletion, we no longer require the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Article 21 GDPR;
5. pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or request its transfer to another controller; and
6. pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority responsible for your usual place of residence, place of work or our registered office. The supervisory authority responsible for our registered office is Der Hessische Datenschutzbeauftragte, Postfach 3163, 65021 Wiesbaden.

To exercise your rights as a data subject, with the exception of the right to lodge a complaint with the supervisory authority, an email to datenschutz@dfb.de is sufficient.

Right to withdraw consent where processing is based on consent

Where your personal data is processed on the basis of consent pursuant to Article 6(1), sentence 1, point (a) GDPR, for example for sending newsletters, you have the right to withdraw your consent at any time without giving reasons. This means that we may no longer continue the data processing based on that consent in the future. Withdrawal of consent does not, however, affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

If you wish to exercise your right to withdraw consent, an email to datenschutz@dfb.de is sufficient.

Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1), sentence 1, point (f) GDPR, you have the right pursuant to Article 21 GDPR to object to the processing of your personal data where grounds relating to your particular situation apply. Where your objection concerns direct advertising, you have a general right to object and do not need to provide reasons.

If you wish to exercise your right to object, an email to datenschutz@dfb.de is sufficient.

When you visit our website, we use the widely adopted SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. This will generally be 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is being transmitted in encrypted form by the closed key or padlock symbol displayed in your browser’s status bar.

We also use appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. We continuously adapt our security measures in line with technological developments.

This Privacy Policy is current as of August 2026. As our websites, apps and services develop, or as a result of changes to statutory or regulatory requirements, it may become necessary to amend this Privacy Policy.