Privacy Policy
FC St. Pauli Merchandising GmbH & Co. KG — fcsp-shop.com
Table of Contents
Introduction and Definitions
1. General
By operating our website at https://www.fcsp-shop.com/ (hereinafter "Website"), we process personal data. This data is treated confidentially and processed in accordance with applicable laws – in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).
This Privacy Policy explains what personal data we collect, for what purposes and on what legal basis we use it, and to whom we may disclose it. It also explains the rights you have to protect and enforce your data privacy.
2. Definitions
2.1 Personal Data
"Personal data" means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR) – for example name, e-mail address, postal address, bank details, date of birth, username, IP address or location data.
2.2 Processing
"Processing" means any operation performed on personal data (Art. 4(2) GDPR), including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, erasure or destruction.
Controller and Data Protection Officer
1. Controller
FC St. Pauli Merchandising GmbH & Co. KGLegal representatives: Hanna Obersteller, Patrick Mushatsi-Kareba (Managing Directors)
Harald-Stender-Platz 1, 20359 Hamburg, Germany
2. Data Protection Officer
HABEWI GmbH & Co. KGGeneral partner: HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Palmaille 96, 22767 Hamburg, Germany
Processing Framework: Website
We only process data that you actively provide on the Website or that you make available automatically when using our services. Your data is processed exclusively by us and is generally not sold, lent or passed on to third parties.
We host our Website with Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA, at a data centre located in Frankfurt am Main, Germany.
As a general rule, we do not transfer data to third countries. Any exceptions are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
Processing in Detail
1. Provision of the Website and Server Log Files
Each time our Website is accessed, we automatically collect: IP address (truncated), browser software, operating system, referrer URL, pages visited, date and time of access, internet service provider, and country/location.
Purpose: Ensuring stability and security of the Website; statistical analysis. Legal basis: Art. 6(1)(f) GDPR. Retention: Log files are deleted after 7 days.
2. Registration and Customer Account
Registration requires: first name, last name, postal address, password and e-mail address. A customer account is optional – you may also shop as a guest.
Purpose: Providing a customer account. Legal basis: Art. 6(1)(b) GDPR. Retention: Until termination of the usage agreement; deletion possible at any time on request.
3. Purchase
During the order process, mandatory fields (marked *) must be completed. Data is passed on to payment service providers and to DHL as the shipping service provider.
Payment service providers:
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg – PayPal Privacy Policy
- Credit card via BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt am Main, Germany
Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(a) GDPR for shipping notification e-mails. Retention: 8 years (commercial and tax law); restricted processing after 2 years.
4. Cancellation of Contracts
When you exercise your right of cancellation we process your name, contact details, contract identification data, and the date and content of your cancellation declaration. Legal basis: Art. 6(1)(b) and (c) GDPR. Retention: Until completion of the reversal; 6 years (commercial law), 10 years (tax law).
5. HubSpot
We use HubSpot (HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland) for e-mail marketing, social media reporting, CRM and contact forms. Data may be transferred to the USA. HubSpot Privacy Policy
Legal basis: Art. 6(1)(a), (b) or (f) GDPR depending on the function used.
6. Contact
When you contact us by e-mail, we process the data transmitted solely for the purpose of handling your enquiry. Legal basis: Art. 6(1)(f) or (b) GDPR. Retention: Until your enquiry has been conclusively resolved.
7. Newsletter
Only your e-mail address is required for the newsletter. We use the double opt-in procedure. You may unsubscribe at any time:
- by e-mail to info@fcsp-shop.com
- via the unsubscribe link in every newsletter e-mail
- at unidy.fcstpauli.com/newsletter
Legal basis: Art. 6(1)(a) GDPR (subscribers); Art. 6(1)(f) GDPR (existing customers). Newsletter provider: HubSpot, Inc., Cambridge, MA, USA.
8. Cookies and Other Tracking Technologies
Our Website uses session and persistent cookies as well as other tracking technologies (pixels, fingerprinting). Non-essential cookies are only set after you have given your consent via our consent tool (Usercentrics). You may revoke your consent at any time in the consent tool settings. Legal basis: Art. 6(1)(f) GDPR (technically necessary); Art. 6(1)(a) GDPR (all others).
9. Matomo
We use Matomo (Innocraft Ltd., Wellington, New Zealand) as a self-hosted web analytics solution. Your IP address is captured in truncated form only (IP masking). No data is passed on to third parties. Legal basis: Art. 6(1)(a) GDPR. Retention: 1 year.
10. Google Analytics
We use Google Analytics (Google LLC, Mountain View, CA, USA) exclusively with IP anonymisation. Legal basis: Art. 6(1)(a) GDPR. Retention: 14 months. Opt-out: Google browser add-on. Further info: policies.google.com/privacy
11. Social Feed
Our homepage displays selected posts from Pinterest, YouTube, TikTok, Facebook and Instagram, loaded directly from the respective platforms' servers. Legal basis: Art. 6(1)(a) GDPR. Privacy policies:
12. YouTube
Videos are embedded in YouTube's enhanced privacy mode – data is only transmitted to Google when you actively play a video. Legal basis: Art. 6(1)(a) GDPR. Further info: Google Privacy Policy
13. Local Font Hosting
We store web fonts locally on our own server. No requests are made to external font services, so no data (including your IP address) is transmitted to third parties in this context.
14. Google Webfonts
Our Website uses Google Webfonts (Google Ireland Limited, Dublin, Ireland). When fonts are loaded, your IP address may be transmitted to Google. Legal basis: Art. 6(1)(f) GDPR. Further info: Google Fonts FAQ
15. Adobe Fonts
Our Website uses Adobe Fonts (Adobe Systems Software Ireland Ltd., Dublin, Ireland). When fonts are loaded, your IP address may be transmitted to Adobe. Legal basis: Art. 6(1)(f) GDPR. Further info: Adobe Privacy
16. Font Awesome
Font Awesome is operated exclusively as a local installation on our own server. No data is transmitted to Fonticons, Inc.
17. Meta Pixel
We use Meta Pixel (Meta Platforms Ireland Limited, Dublin 2, Ireland) to display targeted advertising on Facebook and Instagram and to measure its effectiveness. Legal basis: Art. 6(1)(a) GDPR. Opt-out: Facebook Ad Settings / Meta Privacy
18. Prize Competitions
For competitions on Instagram and Facebook we process usernames and public profile information to determine and notify winners. Legal basis: Art. 6(1)(b) GDPR. Retention: Participant data deleted after competition ends; winner data retained for 10 years.
19. Google Ads Conversion
Used to measure the effectiveness of our Google Ads campaigns. Legal basis: Art. 6(1)(a) GDPR. Opt-out: Google Ad Settings. Further info: policies.google.com/privacy
20. Bing Universal Event Tracking (UET)
We use Bing Ads (Microsoft Corporation, Redmond, WA, USA) for targeted online advertising, supported by Finch LLC, Salt Lake City, USA. Data is stored for a maximum of 180 days. Legal basis: Art. 6(1)(a) GDPR. Further info: Microsoft Privacy Statement
21. Content Delivery Networks (CDN)
We use Cloudflare (Cloudflare Inc., 101 Townsend St, San Francisco, CA, USA) to deliver our Website quickly and reliably. Your IP address is transmitted to Cloudflare. Legal basis: Art. 6(1)(f) GDPR. Further info: Cloudflare Privacy Policy
22. EyeAble
We use EyeAble (Web Inclusion GmbH, Oberhaching, Germany) to improve website accessibility. The widget is hosted locally and sets no cookies. Anonymised access logs from the Access function are deleted after 3 days. Legal basis: Art. 6(1)(f) GDPR. Further info: EyeAble Privacy
23. Google Tag Manager
The Google Tag Manager (Google LLC, Mountain View, CA, USA) does not collect personal data and sets no cookies. It is used solely for managing tags on our Website. Legal basis: Art. 6(1)(a) GDPR (precautionary). Further info: Google Privacy Policy
24. WhatsApp Channel
24.1 Description of Processing
We operate a WhatsApp Channel through which we inform you about current offers, news and other information relevant to you. WhatsApp Channels are an optional, one-way communication service within WhatsApp that is separate from the private messaging function. Via this channel you can receive our posts and interact with them through reactions, comments or participation in polls.
As the channel operator, we do not receive any direct personal data from you. WhatsApp only provides us with aggregated and anonymised statistics that do not allow any conclusions to be drawn about individual subscribers. These statistics include, for example, the total number of subscribers, the reach of our posts and anonymised information about interactions with the content we share.
When you visit or subscribe to our channel, your name, phone number and profile picture are not visible to us as channel administrators, unless you have previously saved us as a contact. In that case, WhatsApp may show us your profile information (name, profile picture) as well as information about your interactions with our channel (reactions to posts, participation in polls). For other subscribers or visitors to our channel, you and your interactions remain invisible in any case.
The actual data processing is carried out by WhatsApp itself. Further information is available in the WhatsApp Channels Guidelines, in the information on security and privacy on channels and in the WhatsApp Privacy Policy.
24.2 Purpose
The processing is carried out to inform you about our products, services, news and offers and to communicate with you via our WhatsApp Channel. The anonymised statistics help us to optimise our communications and better align them with your interests.
24.3 Legal Basis
The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in improving our information and communication offering and in increasing our public reach through contemporary communication channels.
24.4 Retention
As channel administrators, we generally do not receive direct personal data from you and therefore do not store any such data. The anonymised statistics are stored by us for the duration of our WhatsApp Channel's operation.
24.5 Recipients and Transfer to Third Countries
Data is transferred to Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland and/or Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA as the operator of WhatsApp, and processed there. Meta also processes your personal data in the USA.
Security Measures
Our Website is secured with an SSL/TLS certificate. You can recognise active encryption by the padlock symbol in your browser's address bar.
Your Rights
1. Right of Access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether we are processing personal data concerning you and, if so, to receive a copy of that data.
2. Right to Rectification (Art. 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data and the completion of incomplete personal data.
3. Right to Erasure (Art. 17 GDPR)
You have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds listed in Art. 17 GDPR applies.
4. Right to Restriction of Processing (Art. 18 GDPR)
You have the right to obtain restriction of processing where one of the conditions in Art. 18 GDPR applies.
5. Right to Data Portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
6. Right to Withdraw Consent (Art. 7(3) GDPR)
Where processing is based on your consent, you have the right to withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
7. Right to Lodge a Complaint (Art. 77 GDPR)
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work or place of the alleged infringement.
8. No Automated Decision-Making / Profiling (Art. 22 GDPR)
We do not use automated decision-making, including profiling, in relation to your personal data.
9. Right to Object (Art. 21 GDPR)
Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.