Personal data refers to any information that can be linked to you personally. This includes, for example, your name, address, telephone number and email address. Information that does not allow your actual identity to be deduced or that cannot be linked to it is not included. If, for example, you order a product via our website or make use of another service we offer, we will ask you for certain personal data.

The controller responsible for the processing of your personal data within the meaning of Article 4(7) of the GDPR on this website is:

HSV Fußball AG & Co. KGaA

Uwe-Seeler-Allee 9

22525 Hamburg

service@hsv.de

If you have any questions, complaints or wish to exercise your rights in relation to the General Data Protection Regulation, the Federal Data Protection Act, our privacy policy or the processing of your personal data, you can contact our Data Protection Officer, who can be reached using the following contact details:

HSV Fußball AG & Co. KGaA

Data Protection Officer

Uwe-Seeler-Allee 9

22525 Hamburg

Tel.: 040 4155 1887

Email: datenschutzbeauftragter@hsv.de

Please direct all requests for information exclusively to Datenschutzauskunft@hsv.de or by post to HSV Fußball AG & Co. KGaA, reference: Data Protection Information, Uwe-Seeler-Allee 9, 22525 Hamburg, so that we can process them in a timely manner.

All personal data collected by HSV Fußball AG & Co. KGaA is used in accordance with the applicable data protection regulations for the purposes of contract or order processing and to handle your enquiries and bookings. We would also like to use your email address to inform you in future about similar offers from the world of HSV that may be of interest to you. Personal data provided by applicants is processed exclusively for the purposes of the application process. We process the personal data you provide to us in connection with a competition solely for the purpose of organising the competition in question, as well as to determine and contact the winners. You can also find detailed information in our terms and conditions for the respective competition. If you provide us with personal data as part of the press accreditation process, the purpose of the processing is to issue an accreditation pass.

Should we intend to further process your personal data for a purpose other than that for which the personal data was collected, we will provide you with information about this purpose and all other relevant information in accordance with Article 13(2) of the GDPR prior to such further processing.

If you order or book any of the following products or services in our online HSV world, the legal basis for the processing of your personal data, in accordance with Article 6(1)(b) of the GDPR, is the relevant contract concluded between you and HSV Fußball AG & Co. KGaA:

• Fan merchandise in the online fan shop

• Tickets and hospitality packages

• Stadium and museum tours

• Events

• Trips to our home or away matches

• Offers from the HSV Football School and the HSV Kids Club

• Offers from the HSV Fun Park

• Official Fan Club (OFC)

• Merchandising fair

• HSV trips

If you create a user profile in our HSV World, this is free of charge. Nevertheless, an agreement is formed between you and HSV Fußball AG & Co. KGaA. This agreement forms the basis for data processing, in accordance with Art. 6(1)(b) of the GDPR.

For our (existing customer) advertising (see also below), feedback requests and press accreditation, the legal basis in each case is the legitimate interest of HSV Fußball AG & Co. KGaA, in accordance with Article 6(1)(f) of the GDPR. Our legitimate interests in this regard consist of advertising interests as well as organisational interests in the context of match day operations. The processing of data on our websites for the purposes of analysis and personalisation is based on your consent (Article 6(1)(a) of the GDPR). The legal basis for

The Volksparkstadion is under video surveillance in the adjacent outdoor areas, at the entrances and inside the stadium. All points of entry to monitored areas are marked with signs.

On HSV match days or during other major events at the Volksparkstadion (e.g. concerts), the Hamburg Police take control of the video surveillance and are therefore the ‘controller’ within the meaning of Section 2(14) of the Police Data Processing Act (PolDVG). The legal basis for the processing of personal data is Section 18(3) of the Police Data Processing Act (PolDVG). Recordings made by the Hamburg Police are deleted after one month at the latest (Section 18(1) sentence 4 PolDVG). This does not apply if the data is required for the prosecution of serious administrative offences or criminal offences, or if there are grounds for believing that the person will commit criminal offences in the future and retention is necessary for the preventive combating of serious criminal offences (Section 18(1) sentence 5 PolDVG).

For further information on data processing by the police, please visit https://www.polizei.hamburg/datenschutz/

For specific enquiries concerning the processing of personal data by the Hamburg Police, the point of contact for data subjects is the Executive Staff:

Hamburg Police

Executive Staff (LSt)

Bruno-Georges-Platz 1

22297 Hamburg

E-Mail: Leitungsstab-Datenschutz@polizei.hamburg.de

Den behördlichen Datenschutzbeauftragten der Polizei Hamburg erreichen Sie unter:

Polizei Hamburg
Behördlicher Datenschutzbeauftragter
Steindamm 82
20099 Hamburg

Email: Leitungsstab-Datenschutz@polizei.hamburg.de

You can contact the Hamburg Police’s Data Protection Officer at:

Hamburg Police

Data Protection Officer

Steindamm 82

20099 Hamburg

Email: Datenschutz-Polizei@polizei.hamburg.de

Outside of the events mentioned, we, HSV Fußball AG & Co. KGaA, are responsible for the data processing involved in video surveillance. We process the data for the purposes of access control, to protect our property and to exercise our right to manage our premises. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interests lie in the purposes mentioned. Our recordings are automatically deleted after 7 days, unless specific incidents require longer storage (e.g. theft, damage to property or breaches of the stadium regulations). Video recordings will only be disclosed to the extent necessary for the purposes of potential legal or criminal proceedings. In such cases, the recipients are the relevant law enforcement authorities. We are supported by an external service provider for the operation and maintenance of the video surveillance system. We do not make any audio recordings using the video surveillance system, nor do we use any technologies for automated facial recognition.

We have marked all required data with an asterisk (*). We need to collect this data in order to fulfil our obligations under the relevant contract with you. If we do not receive this data, we may not be able to process your order properly.

Yes. When you visit the websites of HSV Fußball AG & Co. KGaA, your browser automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. The following information is collected automatically and stored until it is automatically deleted:

• IP address of the requesting computer,

• Date and time of access,

• Name and URL of the file accessed,

• Website from which access is made (referrer URL),

• Browser used and, where applicable, your computer’s operating system, as well as the name of your internet service provider.

We process the aforementioned data for the following purposes:

• To ensure the website connects smoothly,

• To ensure a user-friendly experience on our website,

• To evaluate system security and stability, and

• For other administrative purposes.

The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest arises from the purposes listed above for data collection. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your identity.

In addition, we use cookies and analytics services when you visit our websites. You can find further details on this below.

As a customer of our online service, we would like to send you information about similar offers from the world of HSV by email or post. The legal basis for this is our legitimate interest in direct marketing in accordance with Article 6(1)(f) of the GDPR. If you do not wish to receive this, you may object at any time. Please use the following email address: service@hsv.de.

Where we engage external service providers in connection with data processing, we have ensured that they are selected and monitored in accordance with the relevant legal requirements and are also obliged to comply with data protection legislation. Beyond this, your data will not be disclosed to any third parties.

No, your personal data will not be used for such processes.

Your data will only be stored for as long as you remain registered with us via a user profile. If data is processed as part of an order, registration or purchase process within our HSV World, it will be stored in accordance with statutory data retention and storage requirements and subsequently deleted. With regard to marketing communications to (existing) customers or participation in our fan panel, your data will be stored for no longer than until you object to its use. We delete applicant data three months after the application process has been completed. Data collected as part of a competition is deleted once the competition has ended. Data collected for press accreditation is deleted once it is no longer required for matchday operations.

As a data subject whose personal data is being collected, you have various rights under the law:

Right of access:

Under Article 15 of the GDPR, you have the right to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.

Please address all requests for information exclusively to Datenschutzauskunft@hsv.de or by post to HSV Fußball AG, reference: Data Protection Information, Uwe-Seeler-Allee 9, 22525 Hamburg, so that we can process them in a timely manner.

Right to rectification:

In accordance with Article 16 of the GDPR, you may request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us.

Right to erasure:

You have the right, in accordance with Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for compliance with a legal obligation, for exercising the right of freedom of expression and information, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

Right to restriction of processing:

In accordance with Article 18 of the GDPR, you may request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, and we no longer require the data, but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR.

Right to data portability:

You may also, in accordance with Article 20 of the GDPR, receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller.

Right to withdraw consent:

In accordance with Article 7(3) of the GDPR, you may withdraw your consent at any time by contacting us. Please use the following email address: widerruf@hsv.de. As a result, we will no longer be permitted to process your data on the basis of this consent in future.

Right to object:

Where the processing of your personal data is based on our legitimate interests, you have the right to object to such processing. In this case, we ask you to inform us of the reasons why you wish to object to the processing. You may also object to data processing for the purpose of contacting existing customers without giving reasons. Please also refer to the information in section 8.

Right to lodge a complaint with a supervisory authority:

Under Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority for your usual place of residence or workplace, or for our registered office in Hamburg.

Cookies are small text files that store internet settings. They are downloaded by your web browser the first time you visit a website. Almost every website uses cookies. If you visit a website repeatedly using the same device and browser, the cookies will, for example, remember your preferences, tell us how you use the site, and tailor the content displayed to your personal interests and needs. Depending on their function and purpose, cookies can be divided into three categories: essential cookies, analytics cookies and personalisation cookies. Essential cookies are necessary for the operation of our websites and are used regardless of your privacy settings. Analytics cookies provide us with information on how users arrive at our site and how they navigate it. In addition, we process data for personalisation purposes so that we can tailor content to your interests. When you first visit our site and in the privacy settings, you can decide whether you wish to consent to processing for analytics and/or personalisation purposes. You can also withdraw any consent you have given here.

Customise your cookie settings

If you consent, this website uses Google Analytics, a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The data controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Analytics uses cookies that enable an analysis of how users such as yourself use the website. The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymisation on this website, your IP address will be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. On behalf of the operator of this website, Google will use this information to evaluate the use of the website, compile reports on this and provide the website operator with other services relating to website and internet usage.

We can also use the Google Search Console cookie to carry out search analyses, which provide us with information on how often our website appears in Google search results. This enables us to monitor and manage our websites in the search index.

The data we send to Google, which is linked to cookies or user identifiers (e.g. user ID), is automatically deleted after 14 months. Data that has reached the end of its retention period is automatically deleted once a month. For more information on the Google Analytics Terms of Service and Google’s privacy policy, please visit https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=de .

Google Ads Conversion Tracking:

If you consent, this website uses the Google Ads service. Google Ads is an online advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

This means that we display Google Ads and, as part of this, also use Google Remarketing and Conversion Tracking. The ads are displayed on websites within the Google advertising network based on search queries. In addition, we use Ads Remarketing lists for search ads. This enables us to tailor search ad campaigns to users who have previously visited our website. These services allow us to combine our adverts with specific search terms or to display adverts to previous visitors promoting, for example, services that they have viewed on our website. We can therefore show interest-based adverts to users of our website on other websites within the Google advertising network (as “Google Ads” within Google Search or on other websites).

Analysing online user behaviour is necessary for interest-based advertising. Google uses cookies to carry out this analysis. When a user clicks on an advert or visits our website, Google places a cookie on the user’s computer. These cookies remain active for 90 days. The information collected via these cookies is used to target the visitor with relevant content during a subsequent search query. Further information on the cookie technology used can also be found in Google’s information on website statistics and in its privacy policy. With the help of this technology, Google and we, as the client, receive information that a user has clicked on an advertisement and been redirected to our websites. The information obtained in this way is used exclusively for statistical analysis to optimise advertising. We do not receive any information that can be used to personally identify visitors.Your IP address is transmitted to Google; however, as we use Google’s IP masking feature on this website as part of our use of Google Analytics, your IP address is anonymised. The statistics provided to us by Google include the total number of users who clicked on one of our adverts and, where applicable, whether they were redirected to a page on our website tagged with a conversion tag. Using these statistics, we can identify which search terms resulted in our ad being clicked on particularly frequently and which ads led to the user contacting us via the contact form. Further information on data protection in relation to Google Ads can be found at: https://policies.google.com/technologies/ads?hl=de

You also have the option to use the ad settings to select the types of Google ads you wish to see or to disable interest-based ads on Google. Alternatively, you can disable the use of cookies by third-party providers by visiting the Network Advertising Initiative’s opt-out guide. However, we and Google will still receive statistical information on how many users have visited this page and when. If you do not wish to be included in these statistics, you can prevent this by using additional browser extensions (e.g. the Privacy Badger add-on).

In order to improve the user experience of our online services and the effectiveness of our online advertising, we use tracking technologies provided by trbo GmbH, Römerstr. 6, 80801 Munich (www.trbo.de), subject to your consent. The use of this technology helps us to understand which pages are particularly attractive to users of our services, which products interest our customers most, and which individual offers we should make to our website users in each case. The data collected and used in this context is always stored solely under a pseudonym (e.g. a random identification number) and is not combined with any personal data about you (e.g. name, address, etc.). Where external service providers are granted access to the data, this is done exclusively on our behalf and under our control. Technically, the tracking tools used employ, in particular, so-called ‘cookies’ and ‘web beacons’ to collect the following information: which pages are visited, when, how often and in what order; which products are searched for; which links or offers are clicked on; and which orders are placed.

In addition, subject to your consent, we use components from the provider Facebook.com on our website. Facebook is a company owned by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. Each time you visit a page on our website that contains such a component, this component causes the browser you are using to download a corresponding representation of the Facebook component. Through this process, Facebook is informed of which specific page on our website is currently being visited.

When you visit our site whilst logged into Facebook, Facebook uses the information collected by the component to identify which specific page you are visiting and associates this information with your personal Facebook account. For example, if you post comments, this information is transmitted to your personal user profile and stored there. Furthermore, the information that you have visited our site is passed on to Facebook. This happens regardless of whether you click on the component or not. If you wish to prevent Facebook from collecting and storing data about you and your behaviour on our website, you must log out of Facebook before visiting our site. Facebook’s privacy policy provides further information on this, in particular regarding the collection and use of data by Facebook, your rights in this regard, and the settings available to protect your privacy: Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA -http://www.facebook.com/about/privacy/.

Our Facebook page is designed to facilitate better, more active communication with our fans and supporters. We use it to keep you updated on all matters relating to HSV.

Data processing on our Facebook page is carried out on the basis of an agreement between joint controllers in accordance with Article 26 of the GDPR, which you can view here: https://www.facebook.com/legal/terms/page_controller_addendum.

When you visit our Facebook page, your data may be automatically collected and stored for market research and advertising purposes.

Various categories of statistical data can be viewed via Facebook Page Insights. These statistics are provided by Facebook. Facebook provides us with various data relating to our Facebook group for a selectable time period and for the categories of fans, subscribers, people reached and people who have interacted. You can find further information on the types of data collected here.

This data is used to create so-called user profiles using pseudonyms. These may be used, for example, to display advertisements on and off the platforms that are likely to match your interests. Cookies are generally used on your device for these purposes. These cookies store visitor behaviour and user interests. In accordance with Article 6(1)(f) of the GDPR, this serves to safeguard our legitimate interests, which prevail following a balancing of interests, in the optimised presentation of all topics and offers relating to HSV and in effective communication with our fans and visitors. If the social media platform operator asks for your consent to data processing, e.g. via a tick box, the legal basis for the data processing is Article 6(1)(a) of the GDPR.

For detailed information on the processing and use of data by the providers on their sites, as well as contact details and your rights in this regard and settings options for protecting your privacy, in particular options to object (opt-out), please refer to the privacy notices linked below. Should you nevertheless require assistance in this regard, please do not hesitate to contact us.

Facebook: https://www.facebook.com/about/privacy/

Right to object (opt-out):

Facebook: https://www.facebook.com/settings?tab=ads

Further information on using social media safely can be found on the website of the Federal Office for Information Security at https://www.bsi-fuer-buerger.de/BSIFB/DE/DigitaleGesellschaft/SozialeNetze/sozialeNetze_node.html.

If you have decided to take part in our HSV Fan Panel, we – HSV Fußball AG & Co. KGaA and Hamburger Sport-Verein e.V., acting as joint controllers – will use the data you have provided (always your name and email address, plus, where applicable, additional data for the HSV Fan Panel: age, occupation, fan interests, fan loyalty, HSV memberships, technical experience) to invite suitable candidates to take part in surveys and digital tests relating to our various digital platforms (website, online shop, apps, etc.). With the email invitation, you will receive further information on the content and procedures of the respective planned survey or digital test and the associated processing of personal data. Your participation in the surveys is entirely voluntary.

The legal basis for the processing of your personal data is your consent, Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect by unsubscribing from the Fan Panel. The easiest way to do this is by emailing fan-panel@hsv.de. In general, you may contact both HSV Fußball AG & Co. KGaA and Hamburger Sport-Verein e.V. at any time to exercise your rights regarding data processing by the Fan Panel.

To make it as straightforward as possible to coordinate survey or digital test appointments for everyone, we use, with your consent, the Bookings service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. To this end, we will provide you with a link to our “Bookings page” in our invitation email, where you can view our staff’s available slots and select a time for your survey participation. However, you may also inform us of your preferred dates in other ways (such as by email). Where Bookings is used, the associated processing of personal data is based on your consent, Article 6(1)(a) of the GDPR, which you may withdraw at any time with future effect. Further information on data protection can be found in Microsoft’s Privacy Policy.

Audio, photo and video recordings are made on a regular basis as part of the football school. The recordings are made in fulfilment of the contract and are made available exclusively to participants of the football school (e.g. via the online galleries SmugMug and Flickr) for private use only. The legal basis for data processing is the contract concluded between HSV and you in accordance with Article 6(1)(b) of the GDPR. Any further publication of the recordings for public relations purposes or to promote future events will take place exclusively on the basis of your express consent in accordance with Article 6(1)(a) of the GDPR in selected online and print media (on the website www.hsv.de) and/or on HSV’s social media channels (Facebook, X, YouTube). The recordings will only be disclosed to the extent necessary in connection with the creation and publication of the recordings, in particular in print and online media. In this case, the recipients are HSV employees, external service providers, partners, sponsors and web hosts. The recordings will be deleted once the purpose for which they were collected has been fulfilled, unless further storage is required by statutory retention and archiving obligations or for the establishment, exercise or defence of legal claims. Recordings processed on the basis of your consent will be stored for an indefinite period for the specific purpose, subject to you withdrawing your consent. Consent to the processing of the recordings may be withdrawn in writing at any time with effect for the future. The lawfulness of the data processing carried out on the basis of your consent up to the point of withdrawal remains unaffected by this. As soon as you withdraw your consent, we will delete the data, provided that statutory storage and retention obligations or the assertion, exercise or defence of legal claims do not require further storage.

On our website, we provide a chatbot to assist with service and information enquiries relating to HSV. This is the moin.ai chatbot, provided by knowhere GmbH (Karolinenstraße 9, 20357 Hamburg).

In this context, knowhere GmbH acts as a data processor in accordance with Article 28 of the GDPR. This means that it processes personal data exclusively on our behalf and in accordance with our instructions. When you use the chatbot, the content you enter – i.e. your data – is transmitted to the service provider. In doing so, knowhere GmbH engages various sub-processors who are also subject to the GDPR. Data processing arrangements ensure that sub-processors also comply with data protection obligations. No processing takes place on servers in third countries (outside the European Union). Further information on data protection at knowhere GmbH can be found at: https://www.iubenda.com/privacy-policy/59451072.

Legal basis for processing

The processing of your data in connection with the use of the chatbot is based on:

your consent (Art. 6(1)(a) GDPR) and

our legitimate interest (Art. 6(1)(f) GDPR) in providing you with a fast and efficient service (see below).

Type of data and purpose of processing

The processing of your personal data serves to answer your questions on topics such as membership, orders, tickets, appointments and other matters relating to HSV quickly and easily. Providing personal data is generally not required to use the chatbot. However, if your enquiry is so specific that personal details such as your name, customer number or ticket number are needed to clarify the matter and the chatbot cannot answer your enquiry, you have the option of submitting your enquiry with the necessary details via a contact form provided. Your enquiry will then be forwarded, together with the personal data you have provided, to an HSV service representative, who will get back to you by email.

No automated decision-making with legal effect (Art. 22 GDPR) takes place. In particular, no contracts are concluded via the chatbot. Your chat inputs are not used to improve the AI.

Retention period

The data from the chat conversation is retained for 30 days.

Local Storage

To ensure you get the most out of the chatbot, we use a technology known as local storage. This involves storing certain information locally in your browser’s memory. This data remains stored even after you close the browser window – provided you do not manually clear the cache – and can be retrieved when you visit the site again.

Local storage enables us to save your preferences and usage behaviour relating to the chatbot on your device. This allows us, for example, to restore your most recent chat history or display relevant content based on your previous usage. To this end, the subpages of our website on which you have used the chatbot are stored in local storage.

The data stored in local storage is not accessible to third parties, is not passed on to third parties and is not used for advertising purposes. The use of this technology is based on our legitimate interest in providing you with a user-friendly and fully functional chatbot service (Art. 6(1)(f) GDPR).

If you do not wish to use local storage, you can manage this individually in your browser or operating system settings. There, you can also view or delete stored data, or block its use entirely. Please note that this may result in restrictions on the chatbot’s functionality.

Please also refer to the additional privacy notices.

Due to the rapid development of the internet and any changes we may make to our processes, we may need to revise and update this privacy policy from time to time. This version is dated March 2021.