Privacy

Privacy Policy

1. Controller

1. FC 1910 Heinsberg-Lieck e.V.
Ringstraße
52525 Heinsberg
Email: vorstand@fc-heinsberg-lieck.de
Phone: 0163 – 47 55 058

Represented by the Board:
1st Chairman: Reinhard Deußen
2nd Chairwoman: Jessica Räde

2. General information on data processing

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this privacy policy. The use of our website is generally possible without providing personal data.

3. Hosting

Our website is hosted by OVHcloud. The provider is OVH GmbH, St. Johanner Str. 41-43, 66111 Saarbrücken, Germany. When you visit our website, your personal data is processed on the servers of OVHcloud. Personal data may also be transmitted to the parent company OVH SAS in France.

The use of OVHcloud is based on Art. 6 Abs. 1 lit. f DSGVO. We have a legitimate interest in the most reliable presentation of our website possible.

4. SSL-/TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

5. Server log files

When you access our website, information is automatically sent to the server of our website by the browser used on your end device. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion (maximum 90 days):

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access is made (referrer URL)
• Browser used and, if applicable, the operating system of your computer as well as the name of your access provider

The mentioned data is processed for the following purposes: ensuring a smooth connection to the website, ensuring a comfortable use of our website, and evaluating system security and stability.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the collected data to draw conclusions about your person.

6. Cookies

We use cookies on our website. These are small files that your browser automatically creates and that are stored on your device when you visit our site. Cookies do not cause any damage to your device and do not contain viruses, trojans, or other malware.

We differentiate between technically necessary cookies and optional cookies:

Technically necessary cookies: These cookies are required for the operation of the website and cannot be disabled. They include, for example, session cookies for user login, cookie settings, and the selected language (cookie). fc_lang, see 16.). The legal basis is Art. 6 para. 1 lit. f GDPR.

Optional cookies: These cookies are only set with your consent and are used for analysis or convenience functions. The legal basis is Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.

You can configure your browser settings according to your preferences, e.g., refuse the acceptance of third-party cookies or all cookies. Please note that in this case, you may not be able to use all functions of this website.

7. Reach measurement with Matomo

This website uses Matomo (formerly Piwik), an open-source software for statistical analysis of visitor traffic. Matomo is operated on a dedicated server of 1. FC 1910 Heinsberg-Lieck e.V. — there is no data transfer to third parties or to third countries (e.g., the USA).

Stored information:

• IP address (shortened/anonymized)
• Date and time of page access
• Title and URL of the accessed page
• Browser, operating system, screen resolution (device type)
• Previously visited page (referrer URL, if available)

Cookieless mode (default, without consent): If you have not or not yet agreed to our cookie banner, Matomo will be operated without cookies . Your IP address will be anonymized, and you will not be recognizedwhen you visit our website again. The processing is solely for the statistical evaluation of page views to improve our offerings.

Legal basis (cookieless): Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in statistical reach measurement to improve content.

Cookie mode (only with consent): If you have agreed to the "Statistics" category in our cookie banner, Matomo will additionally set cookies to recognize you across multiple page views. This allows us to determine, for example, how many visitors return.

Legal basis (cookies): Your consent pursuant to Art. 6 para. 1 lit. a GDPR.

Storage duration: The collected visitor data is stored in aggregated form for a maximum of 6 months and then deleted or fully anonymized.

Objection/Withdrawal: You can withdraw your consent to statistical cookies at any time via our cookie banner. If you also wish to object to anonymized reach measurement, please contact us using the contact details provided above — we will then manually remove your data from the Matomo system.

8. Push notifications

We offer you the option to receive push notifications via your browser. Through this, we inform you about news and results from our club.

Consent: Push notifications are only sent if you have explicitly agreed to receive them. The legal basis is Art. 6 para. 1 lit. a GDPR.

Stored data: The following data is stored when signing up for push notifications:

• Endpoint URL (an anonymous address generated by the browser)
• Encryption keys (p256dh and auth)
• Time of registration
• Browser type

No personal data such as name, email address, or IP address is permanently stored.

Withdrawal: You can withdraw your consent at any time by disabling push notifications in your browser settings or using the unsubscribe function on our website.

9. Contact form and email contact

If you contact us via the contact form or email, your details, including the contact data you provide, will be stored by us for the purpose of processing the request and in case of follow-up questions. We do not share this data without your consent.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR, provided your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6 para. 1 lit. f GDPR).

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory legal provisions – especially retention periods – remain unaffected.

10. Membership Application

If you submit a membership application via our website, the following data will be collected:

• Name, first name
• Date of birth
• Address
• Email address
• Phone number
• If applicable, SEPA direct debit mandate (IBAN, account holder)

This data is used exclusively for processing your membership application and subsequent membership management. The legal basis is Art. 6 para. 1 lit. b GDPR (contract fulfillment). The data will be deleted after the termination of membership and the expiration of statutory retention periods.

11. Swap Market

Our website offers a swap market where club members and interested parties can offer or search for football equipment (jerseys, shoes, balls, training gear, etc.). Listings can be posted without a user account — management is done via a personal token link sent to the poster by email.

Data collected when posting a listing:

• Pseudonym (publicly visible — freely selectable, no real name required)
• Email address (private, used exclusively for confirmation and management — never publicly visible)
• Phone number (optional, private — shared only after mutual contact approval)
• Listing contents: title, description, category, size, condition, price mode (swap/give away/€), region (ZIP code/city), team reference
• Up to 3 photos uploaded by the poster
• Anonymous view statistics per listing (24-hour cooldown per visitor)

Contact initiation (double opt-in): If an interested person wants to contact a poster, a two-step confirmation process is carried out:

1. The interested person enters a pseudonym, email address, optionally a phone number, and a message, then confirms their email address via a link.
2. The poster receives the request and decides whether to exchange contact details.
3. Only after explicit approval by the poster will the contact details of both parties be shared via email.
4. If the request is declined, the interested person will not be informed; the poster's data remains unknown (protection against stalking/spam).

Legal basis: Consent according to Art. 6 para. 1 lit. a GDPR, granted through the explicit confirmation of the email address when creating a listing or submitting a contact request.

Storage duration: Listings are automatically deactivated 60 days after posting (with a reminder email 7 days before expiration for optional extension). After deactivation, all personal content (email, phone, pseudonym, description, photos) is anonymized within 14 days and fully deleted from the database after a total of 30 days. Contact requests are fully deleted 90 days after completion (approval/rejection). Unconfirmed listings or requests are automatically removed after 48 hours.

Manual deletion: You can delete your listing at any time via the management link in the confirmation email. If you have lost this link, you can request a new overview with editing links to be sent to your email address via the "Manage Listings" form.

Protection against misuse: Creating listings and contact requests is restricted to requests from Germany (localized via the Cloudflare header CF-IPCountry). Submission attempts are subject to rate limiting per IP address and email. These measures protect against automated requests and spam.

12. Registration for trial training

You can register yourself or your child for a trial training session through our website.

What data we process: First name, last name, and date of birth of the player, email address, the chosen team, and the date. For minors, we also require the name of a legal guardian and their consent. For minors and registrations for a junior team, we mandatorily ask for the current club; in all other cases, this information is optional. Additionally optional are phone numbers and notes for the coaches. If the player is registered with another club, we also process their consent for the trial training, provided you upload it for us. Uploaded consents are stored in a non-publicly accessible folder and are only available to the coaching team of the chosen team and the Board. To prevent misuse, we also store the IP address when the registration is submitted, but only as a non-reversible hash value (not a readable IP address).

Purpose: To organize the trial training, remind you of the date, inform you in case of cancellation, and comply with the requirements of § 21 of the Youth Match Regulations of the West German Football Association.

Legal basis: Your consent (Art. 6 para. 1 lit. a GDPR) and the execution of pre-contractual measures at your request (Art. 6 para. 1 lit. b GDPR). For protection against automated registrations and misuse (Cloudflare Turnstile, stored IP hash), our legitimate interest (Art. 6 para. 1 lit. f GDPR).

Who receives the data: The coaches and supervisors of the chosen team as well as the Board. Additionally, we use the following service providers: Cloudflare (Turnstile, protection against automated registrations; technical data such as the IP address is transmitted to Cloudflare when the form is accessed, legal basis Art. 6 para. 1 lit. f GDPR) and Microsoft 365 (sending emails for confirmation, reminders, and information, data processing agreement). There is no further disclosure to third parties. We do not use reach measurement on the personal pages for confirming and managing your registration.

How long we store: Generally, one year after the last trial training, after which the data is automatically deleted. Unconfirmed registrations are deleted after 48 hours. Backup copies (backups) are overwritten with a delay according to usual rotation periods; deleted data may still be contained in backups until then.

Your rights: You can revoke your consent at any time and delete your data yourself via the personal link in the confirmation email. Open appointments will be canceled in the process.

13. Requests for friendly matches

Clubs can request a friendly match against one of our teams through our website.

What data we process: Name of the club, team, and optionally the league, name, email address, and phone number of the contact person, desired match location, preferred dates, an optional message, and, if applicable, your response to a counterproposal from our coaches. To prevent misuse, we also store the IP address when the form is submitted, but only as a salted hash value (pseudonymized).

Purpose: To process the request, arrange the match, enter it into the association's match operations system (DFBnet), and inform you about confirmations, cancellations, or changes.

Legal basis: Your consent (Art. 6 para. 1 lit. a GDPR) as well as the execution of pre-contractual measures upon your request (Art. 6 para. 1 lit. b GDPR). For protection against automated requests and misuse (Cloudflare Turnstile, stored IP hash), it is our legitimate interest (Art. 6 para. 1 lit. f GDPR).

Who receives the data: The trainers of the requested team and the Board. If a match is arranged, the youth management for youth teams and the Board for senior teams also receive the match data to enter it into DFBnet. Additionally, we use Cloudflare (Turnstile, protection against automated requests; technical data such as the IP address is transmitted to Cloudflare when the form is accessed) and Microsoft 365 (email dispatch, data processing). No further data sharing takes place. We do not use reach measurement on the personal page for your request.

How long we store the data: Usually one year after the agreed match date or after the decision on the request, after which the data is automatically deleted. Unconfirmed requests are deleted after 48 hours. Backup copies are overwritten with a delay.

Your rights: You can revoke your consent at any time and withdraw your request via the personal link in the confirmation email. For early deletion, please contact the address mentioned under point 1.

14. Inventory and defect reports in the club area

In the protected club area, we manage the club's equipment. Registered coaches and responsible persons can borrow and return items as well as report defects, including with photos.

What data we process: Your name as the borrowing, issuing, or reporting person, times of borrowing, return, and reporting, agreed return dates, your details about the defect, and uploaded photos. Photos are re-saved upon upload; embedded metadata such as location (GPS) and camera data are removed.

Purpose: To track where the club's equipment is located, fix damages, remind about returns, and reorder materials.

Legal basis: The fulfillment of your tasks within the club (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in an orderly management of club property (Art. 6 para. 1 lit. f GDPR).

Who receives the data: The persons responsible for inventory (Board or equipment manager, for youth teams the youth management) as well as the trainers of the respective team. Defect reports are sent via email to the Board, and for youth teams additionally to the youth management. For email dispatch, we use Microsoft 365 (data processing). When adding an item, a photo can be transmitted to Microsoft's Azure OpenAI service for automatic recognition (name, manufacturer, category) (data processing); only photos of items and no personal data are processed. Similarly, invoices for purchased equipment can be transmitted to Azure OpenAI for extracting details (item, item number, quantity, price); invoices are only accessible to the responsible persons (equipment manager, Board). The photos are not publicly accessible.

How long we store the data: As long as the item is listed in the inventory. If your access to the club area is deleted, loans and reports without reference to your person remain (“former member”). Photos related to a defect can be deleted at any time by the reporting person or the responsible persons.

Your rights: You can request information, correction, and deletion via the address mentioned under point 1.

15. Embedded content from third-party providers

FuPa.net: Our website integrates data from FuPa.net (football in the region) to display current match results, tables, and team information. Data is retrieved via an API from FuPa's servers. It is possible that FuPa collects your IP address in the process. For more information, please refer to FuPa's privacy policy: https://www.fupa.net/datenschutz

Google Fonts: This website uses Google Fonts, which are embedded locally on our server. No connection to Google's servers is established.

16. Automatic translation of the website

Our website is available in addition to German in other languages (currently English at /en/, Türkisch unter /tr/ und Ukrainisch unter /uk/). The translations are automatically created using the Azure OpenAI service from Microsoft (data processing, data center in the EU).

Which data is transmitted: The public texts of our website (pages, posts, menus, form labels) are translated. We save these translations so they do not have to be recreated each time. If you fill out a form in another language, we also automatically translate the confirmation emails to you; the texts of the email are transmitted to Azure OpenAI but are not stored. Your personal details such as name, phone number, or date of birth are not translated. Pages with personal access links (e.g., for managing a registration) are also only translated for display and not stored.

Legal basis: Our legitimate interest in facilitating access to our club for those interested who do not have sufficient German language skills (Art. 6 para. 1 lit. f GDPR); for forms, the processing of your request (Art. 6 para. 1 lit. b GDPR).

Language selection: Your selected language is determined by the address of the page (e.g. /en/). To ensure you stay in your language when clicking further, we save it in the technically necessary cookie fc_lang (only the language code, e.g., "en", storage duration 1 year, no sharing; legal basis § 25 para. 2 no. 2 TTDSG). We do not evaluate your browser language.

17. Social media

Our website contains links to our social media profiles (e.g., Facebook, Instagram). These are simple links, not social media plugins. When you click on the links, you will be redirected to the respective platforms. Only after the redirection will data be transmitted to the respective provider. Information on how your personal data is handled can be found in the respective providers' privacy policies.

18. Activity log for club officials (Audit Log)

In the internal administration area (member area / WordPress administration), we log processing activities carried out by club officials with administrative or editing rights. The purpose of this logging is to ensure traceability of administrative actions, maintain data integrity (especially for receipts, membership applications, and role assignments), and detect misuse or unauthorized access.

Data collected:

• Username and email address of the acting official (snapshot at the time of the action)
• IP address of the acting official
• Timestamp of the action
• Type of action (e.g., "Receipt approved," "Membership application processed," "Role assigned")
• Reference to the affected object (e.g., receipt number, application number)
• Additional detailed data about the action if needed (e.g., the changed status)

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in tamper-proof club administration and abuse detection) as well as – insofar as accounting or tax-relevant processes (in particular receipts and membership fees) are concerned – Art. 6 para. 1 lit. c GDPR in conjunction with the retention obligations under §§ 140 ff. AO.

Recipient: Access to the activity log is exclusively granted to officials with the role of "club administrator”.

Retention period: The log entries are stored for 730 days (two years) and then automatically deleted. If legal retention obligations apply, the underlying documents (e.g., receipts) may be retained longer; however, the log itself is subject to the aforementioned period.

Affected persons: Club officials with administrative or editing rights in the club's internal management area.

Right to object: You have the right to object to the processing of your personal data within the activity log at any time for reasons arising from your particular situation (Art. 21 GDPR). We will review the objection and cease processing unless there are compelling legitimate grounds for the processing that outweigh your interests.

19. Your rights as a data subject

You have the following rights regarding your personal data processed by us:

• Right of access (Art. 15 GDPR) – You can request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR) – You can request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) – You can request the deletion of your data unless legal retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) – You can request that we provide your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR) – You can object to the processing of your data at any time, provided the processing is based on Art. 6 para. 1 lit. f GDPR.
• Right to withdraw consent (Art. 7 para. 3 GDPR) – You can withdraw consent at any time. The legality of the processing carried out based on the consent until the withdrawal remains unaffected.

20. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR.

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Phone: 0211/38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

21. Currentness and changes to this privacy policy

This privacy policy is current as of October 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed at any time on this page.