Thank you for visiting our website and for your interest in our company. The protection of your personal data is important to us. In the following we inform you in accordance with Art. 12, 13 and 21 of the General Data Protection Regulation (GDPR) about how we handle your personal data when using our website.

Personal data is individual information about the personal or factual circumstances of an identified or identifiable natural person. This includes information such as legal name, address, telephone number and date of birth.

I. Responsible Party

Kölner Sportstätten GmbH

RheinEnergieSTADION (Tribüne Ost)

Aachener Str. 999

50933 Köln

Tel.: +49 (0) 221 716 161 50

Email: info@koelnersportstaetten.de

II. Data Protection Officer

Datenschutzbeauftragter@­koelnersportstaetten.de

Luther Rechtsanwaltsgesellschaft mbH

Anna-Schneider-Steig 22

50678 Cologne, Germany

III. Purposes and Legal Grounds for Data Processing

1. Informational use of the website

You can visit our website without providing any personal information. If you use our website for information purposes only, or otherwise provide us with information about yourself, we will not process any personal data other than that which your browser transmits to enable you to visit the website.

a) Technical provision of the website  

For the technical provision of the website, it is necessary for us to process certain automatically transmitted information from you so that your browser can display our website and you can use it. This information is automatically collected and stored in our server log files each time you access our website. This information relates to the computer system of the accessing computer. The information collected is as follows:

• IP address
• Browser type/version (e.g. Firefox 59.0.2 (64 bit))
• Browser language (e.g. German)
• Operating system used (e.g. Windows 10)
• Internal resolution of the browser window
• Screen resolution
• Javascript activation
• Java On / Off
• Cookies On / Off
• Colour depth
• Referrer
• Time of access

We also use cookies to make our website available to you. Cookies are text files that are stored on your computer’s web browser or by your web browser on your computer system when you visit a website. A cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again. We use these cookies solely to make our website and its technical features available to you. Some features of our website cannot be provided without the use of cookies. The following information is stored in the cookies and sent to us: cookie ID.

We do not use the information collected by the above cookies to create user profiles or to analyse your browsing behaviour.

We process your personal data for the technical provision of our website based on the following legal grounds:

• For the technical provision of our website pursuant to Section 25 (2) No. 2 of the German Teleservices Data Protection Act (Teledienstedatenschutzgesetz – TTDSG), as the processing of the aforementioned data is absolutely necessary in order to enable you to use our website in the manner expressly requested by you
• To fulfil a contract or to perform pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR, if you visit our website to obtain information about us
• To protect our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR in order to provide you with the website technically and securely. Our legitimate interest is to provide you with an attractive, technically functional and user-friendly website as well as to take measures to protect our website from cyber risks and to prevent our website from posing cyber risks to third parties.

b) Social media links

Links to services such as Facebook, YouTube and Google Maps are included on the website. When you click on the link, you will be taken to the site of the relevant service provider, and only then will user information be sent to the relevant service provider. For information on how your information will be treated when using the websites of other providers, please refer to their privacy policies.

2. Active use of the website

In addition to using our website for informational purposes, you may also actively use our website to order one of our products, register for an event, sign up for our newsletter or contact us. In addition to the processing of your personal data described above solely for informational purposes, we will also process other personal data from you that we need to fulfil your order or to process and respond to your enquiry.

a) User enquires

In order to be able to process and respond to your enquiries to us, e.g. via the contact form or to our email address, we process the personal data you provide in this context. This will always include your name and email address so that we can send you a reply, as well as any other information that you send us as part of your message.

We process your personal data to respond to user enquiries based on the following legal grounds:

• If you contact us within the framework of a contract to which you are a party or for the purpose of taking pre-contractual measures, the legal basis is Art. 6 par. 1 lit. b GDPR.
• To protect our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR; our legitimate interest is to respond appropriately to customer requests.

b) Conclusion, execution and termination of the contract; payment and dispatch

Our website also allows you to enquire about and/or book an event, and to place an order (in particular to purchase VIP tickets for events) by email, online or via a contact form. For this purpose, we process the personal data you provide in the context of the relevant enquiry/booking as well as your payment details. You may also be able to purchase event tickets from our ticketing partners. Certain tickets may be solely available from these partners. In these cases, you will be redirected to the offers or websites of our partners, where only the privacy policy of the respective partner will apply.

In order to be able to send you the tickets you have ordered, we will pass on your first and last name, contact details (address, telephone number if applicable, e-mail etc.) to our logistics service provider.

We process your data for the above-mentioned purposes based on the following legal grounds:

• To fulfil a contract or to perform pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR.

We process your personal data as part of your application if you provide it to us. The application documents may contain specific categories of personal data.

i) Processing personal data

Candidate data usually includes the following information: First and last name, academic degree (if applicable), date and place of birth, contact details (address, email, telephone and/or mobile number), application documents (letter of motivation, CV, certificates), language skills, areas of expertise. We also process the data you send us when you contact us by e-mail.

We base our decisions in the application process on the personal data you provide to us within the law. For example, we may use your professional qualifications to decide whether to shortlist you for a job, or the impression we got of you during an interview to decide whether to offer you the job you applied for.

We process your personal data to do this based on the following legal grounds:

• Data processing for the purpose of deciding on whether to establish an employment relationship, Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 sentence 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)

ii) Processing special personal data

According to Art. 9 of the GDPR, special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious (e.g. information about religious affiliation/denomination) or philosophical beliefs or trade-union membership, as well as the processing of biometric data for unique identification (e.g. photographs), health data (e.g. information about the degree of severe disability) or data concerning sex life or sexual orientation. If your CV contains special categories of personal data, we will not intentionally collect it. We explicitly ask you not to send us such data.

If, contrary to our explicit request, you voluntarily provide us with special categories of personal data in accordance with Art. 9 para. 1 GDPR as part of your application documents (e.g. your photograph or details of your religious affiliation/denomination), we will store these on the basis of your consent in accordance with Art. 88 para. 1 GDPR in conjunction with Section 26 para. 3 sentence 2 BDSG-new. This also applies if you provide us with further specific personal data in the course of the application process. By voluntarily providing this information, you consent to the storage of this specific personal data as part of the application process.

As a general rule, we do not take this specific personal data into account when making a selection decision, unless we are required to do so by law. For example, some job advertisements may give preferential treatment to people with disabilities in accordance with applicable laws. In these cases, the information is always voluntary and is provided with your express consent, which you give by voluntarily providing this information.

We process your special personal data based on the following legal grounds:

• In accordance with Art. 9 para. 1 GDPR on the basis of your consent pursuant to Art. 88 para. 1 GDPR in connection with § 26 para. 3 sentence 2 BDSG.

d) Newsletter

With your consent, we may use your information for promotional purposes, such as sending you our newsletter. We process mandatory information such as your email address. You can unsubscribe at any time by clicking on the link provided in the newsletter and cancelling your subscription.

We process your personal data based on the following legal grounds:

• If you have given us your consent via the double opt-in procedure, in accordance with Art. 6 para. 1 lit. a GDPR.

e) Photographs and video recordings at events

For the purposes of documenting an event, we may take and publish photographs and/or video recordings of that event. It is possible that you, as a visitor to the event, may appear in these recordings. The event will always be the focus of the footage, not you as a visitor.

We process your data for the above-mentioned purposes based on the following legal grounds:

• To protect our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in documenting the event and using the images for public relations and media coverage in order to present ourselves to the outside world. This is particularly the case where the photographs are (i) contemporary portraits, (ii) people appearing only as accessories against a landscape or other location, or (iii) images of meetings, processions and similar events in which the people depicted have taken part. We may use the photographs for internal and external communications, advertising, press and public relations purposes and for publication in printed materials, such as brochures, newspapers and magazines, and for publication on the intranet and internet, such as our websites, social media and third-party websites.

3. Compliance with Legal Regulations

We also process your personal data to comply with other legal or regulatory obligations imposed on us in connection with processing your visit to our website and our business relationship. These include, in particular, retention periods under commercial, trade or tax law, as well as legal and criminal prosecution.

We process your personal data to do this based on the following legal grounds:

• To comply with a legal obligation to which we are subject pursuant to Art. 6 para. 1 lit. c GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data and in connection with other relevant regulations or official orders (e.g. under criminal law).

4. Law enforcement

We may also process your personal data to exercise our legal rights and enforce our legal obligations. We also process your personal data to defend ourselves against legal claims. Finally, we process your personal data to the extent necessary for the defence against or prosecution of criminal offences.

We process your data for the above-mentioned purposes based on the following legal grounds:

• To protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, to the extent that we are asserting legal claims or defending ourselves in legal disputes, or preventing or investigating criminal offences.

IV. Links

Some areas of our website contain links to third party websites. These websites are subject to their own privacy policies. We are not responsible for their operation, including their handling of data. If you choose to submit information to or through such third-party sites, you should review the privacy policies of those sites before submitting any personally identifiable information to them.

V. Recipient categories

Initially, only our employees will have access to your personal data. In addition, we may share your personal data with other recipients who provide services to us in connection with our website, to the extent permitted or required by law. We limit the disclosure of your personal data to what is necessary, in particular to process your order. In some cases, our service providers receive your personal data as processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients will act independently with your information that we share with them.

The categories of recipients of your personal data are listed below:

• IT service providers for the administration and hosting of our website
• Service providers who assist us in, for example, enforcing our right
• Public bodies and institutions insofar as we are legally obliged to send your personal data to them.

VI. Third-country transfers

Data will only be transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary in the course of fulfilling our contractual relationship, if it is required by law (e.g. for tax reporting purposes), if you have given your consent, or if it is necessary for processing an order. If service providers are used in a third country and there is no “adequacy decision” from the EU Commission for that country, these service providers are required to comply with the European level of data protection in addition to written instructions by agreeing to the EU standard contractual clauses. For more information, please contact our Data Protection Officer.

We do not otherwise transfer your personal data to countries outside the EU or the EEA, or to international organisations.

VII. Duration of storage

1. Informational use of the website

If you use our website for information purposes only, we will store your personal data on our servers solely for the duration of your visit to our website. When you leave our site, your personal information is immediately deleted. Any cookies that we may have installed are also normally deleted when you leave our website. You can also delete installed cookies yourself at any time.

2. Active use of the website

When you actively use our website, we initially store your personal data for the duration of answering your enquiry or for the duration of our business relationship. This includes the initiation of a contract (pre-contractual legal relationship) and the fulfilment of a contract.

Furthermore, we will keep your personal information until the limitation period for any legal claims arising from our relationship with you has expired, in order to use it as evidence if necessary. The limitation period is usually between 1 and 3 years, but can be up to 30 years.

We delete your personal data when the statute of limitations expires, unless there is a statutory retention obligation, for example from the German Commercial Code (Sections 238, 257 (4) HGB) or from the German Fiscal Code (Section 147 (3), (4) AO). These retention obligations can last from two to ten years.

3. Job applications

We initially store your personal data for the duration of the application process.

If we do not hire you for the position, we will delete your data three months after rejection, unless you have consented to further storage. If you have consented, we will keep your data until you withdraw your consent, but will delete it after two years at the latest.

If your application is successful and you are offered employment with us, we refer you to our Employee Privacy Notice, which explains how your data will be processed.

Longer retention periods may also be required where the data is necessary for the establishment, exercise or defence of legal claims or where there are legal retention obligations. The data will be kept for as long as necessary to fulfil these purposes.

VIII. Your rights as a data subject

As a data subject, you have the following rights under the law, which you may exercise against us:

1. Right to information  

Pursuant to Art. 15 GDPR, you are entitled at any time to request confirmation from us as to whether we are processing personal data relating to you; if this is the case, you are also entitled pursuant to Art. 15 GDPR to obtain information about this personal data and certain other information (including the purposes of the processing, the categories of personal data, the categories of recipients, the intended storage period, the origin of the data, the use of automated decision making and, in case of transfer to third countries, the appropriate safeguards) and a copy of your data.

2. Right to rectification

Pursuant to Art. 16 GDPR, you have the right to request that we rectify the personal data we hold about you if it is inaccurate or incorrect.

3. Right of erasure

You are entitled, under the terms of Art. 17 GDPR, to request that we immediately erase personal data concerning you. The right of erasure does not apply, inter alia, if the processing of personal data is necessary for (i) the exercise of the right to freedom of expression and information, (ii) the fulfilment of a legal obligation to which we are subject (e.g. statutory retention obligations) or (iii) the establishment, exercise or defence of legal claims.

4. Right to restriction of processing

You are entitled to request that we restrict the processing of your personal data under the terms of Art. 18 GDPR.

5. Right to data portability  

Under the terms of Art. 20 GDPR, you have the right to request that we provide you with your personal data that you have given us in a structured, commonly used and machine-readable format.

6. Right of withdrawal

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

7. Right of objection  

You are entitled to object to the processing of your personal data under the conditions of Art. 21 GDPR so that we stop processing your personal data. The right to object exists only within the limits of Art. 21 GDPR. Furthermore, our interests may conflict with stopping the processing, so we may be entitled to process your personal data despite your objection.

8. Right of appeal to a supervisory authority

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged breach, if you consider that the processing of personal data relating to you is in breach of the GDPR, subject to the conditions of Art. 77 GDPR. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf, Germany
Telefon: +49 211 384 240
Fax: +49 211 384 241 0
E-Mail: poststelle@ldi.nrw.de

However, we recommend that you always make a complaint to our Data Protection Officer in the first instance.

Where possible, your requests to exercise your rights should be made in writing to the above address or directly to our Data Protection Officer.

IX. Scope of your obligations to provide data

In principle, you are not required to provide us with your personal data. However, if you do not, we will not be able to provide you with our website or respond to your enquiries. Personal data that we absolutely need for the above-mentioned processing purposes is marked with an asterisk (*) or another symbol as mandatory information.

X. Automated decision-making/profiling

We do not use automated decision making or profiling (automated analysis of your personal circumstances).

XI. Information about your right to object pursuant to Art. 21 GDPR

You have the right at any time to oppose the processing of your data, pursuant to Art. 6 para. 1 f GDPR (data processing based on a balancing of interests) or Art. 6 para. 1 e GDPR (data processing in the public interest), if there are reasons arising from your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The objection can be made informally and should preferably be addressed to the contact details set out in the legal notice.

XII. Changes

We reserve the right to change this Privacy Policy at any time. We will notify you of any changes by posting the amended Privacy Policy on our website. Unless otherwise stated, such changes will take effect immediately. Please check this Privacy Policy regularly for the latest version.

Last updated January 2023