Privacy Policy OLYMPIASTADION BERLIN GMBH

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is:

Olympiastadion Berlin GmbH
Olympischer Platz 3
14053 Berlin
Germany
Managing Director Timo Rohwedder (same contact information as the data controller)
Tel.: +49 (0)30 306 88 100
Email: info(at)olympiastadion(dot)berlin
Website: www.olympiastadion.berlin

Olympiastadion Berlin GmbH
Data Protection Officer
Olympischer Platz 3
14053 Berlin
Germany
Email: datenschutz(at)olympiastadion(dot)berlin

1. Scope of the Processing of Personal Data

The protection of personal data is very important to us. Therefore, we generally collect and use our users’ personal data only to the extent necessary to provide a fully functional website, as well as our content and services. The collection and use of our users’ personal data generally takes place only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

2. Legal Basis for the Processing of Personal Data

Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data to the extent that we obtain the data subject’s consent for the processing of personal data.

If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis.

This also applies to processing operations necessary for the implementation of precontractual measures.

Article 6(1)(c) of the GDPR serves as the legal basis insofar as the processing of personal data is necessary to comply with a legal obligation to which our company is subject.

In cases where the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(b) of the GDPR serves as the legal basis.

Article 6(1)(f) of the GDPR serves as the legal basis for processing when the processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the former interest.

3. Data Deletion and Retention Period

The data subject’s personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is provided for by European or national legislation in Union regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned regulations expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

1. Collection and Storage of Personal Data, as well as the Nature, Purpose, and Use of Such Data

As part of the provision of contractual services, we process the data of our contractual partners. Contractual partners may include: prospective customers, customers, business partners, or contractual partners themselves. In the following, we will use the term “contractual partners” to refer to all of these groups.
The data we collect in this context includes:

• Master data, such as title, first name, last name, address, company name,
• Contact information, such as a valid email address and phone number
• Information necessary for the provision of the contractual services (contractual terms, customer’s interests)
• Payment information (e.g., bank account information, payment history)

The purpose of collecting this data is set forth in the applicable contract and may include, in particular,

• To identify you as our contractual partner;
• To provide them with appropriate advice;
• to fulfill our contractual obligations;
• corresponding with you;
• Billing;
• Handling of Warranty Claims

2. Legal Basis

Data processing is carried out at your request and is necessary, pursuant to Article 6(1)(b) of the GDPR, for the stated purposes of properly processing the order and for the mutual fulfillment of obligations under the respective contract.

3. Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. We are required by commercial and tax law to retain your address and payment information for a period of ten years. However, three years after the completion of the order, we restrict the processing of your data, meaning it will be used solely to comply with legal obligations.

4. Disclosure of Data to Third Parties

Unless it is necessary for the fulfillment of the contract with you pursuant to Article 6(1)(b) of the GDPR, your personal data will not be disclosed to third parties.

1. Description and Scope of Data Processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the user accessing the site.
The following data is collected in this process:

1. Time Zone Difference from Greenwich Mean Time (GMT)
2. Content of the Request (specific page)
3. Access Status/HTTP Status Code
4. amount of data transferred in each case
5. Information about the browser type and version being used
6. The user’s operating system
7. The user’s Internet service provider
8. The user’s IP address
9. Date and time of access
10. Websites from which the user’s system accesses our website
11. Websites accessed by the user’s system via our website

The data is also stored in our system’s log files, and we anonymize the user’s IP address. This data is not stored together with any other personal data belonging to the user.

2. Legal Basis for Data Processing

The legal basis for the temporary storage of the data is Article 6(1)(f) of the GDPR.

3. Purpose of Data Processing

The system’s temporary storage of the IP address is necessary to enable the website to be delivered to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session. The data is stored in log files to ensure the website functions properly. In addition, we use the data to optimize the website and to ensure the security of our IT systems. The data is not analyzed for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

4. Duration of Storage

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected to provide the website, this occurs when the respective session ends. In the case of data stored in log files, this occurs after seven days at the latest. Storage beyond this period is possible. In this case, the users’ IP addresses will be deleted or anonymized so that it is no longer possible to identify the client that accessed the site.

5. Right to Object and Request Removal

The collection of data for the purpose of providing the website and the storage of that data in log files is absolutely necessary for the operation of the website. Consequently, users have no right to object.

1. Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. For example, when a user visits a website, a cookie named “
” may be stored on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again.

We use cookies solely to make our website more user-friendly. Some elements of our website require that the browser accessing the site can be identified even after a page has been refreshed.

Data regarding language settings is stored and transmitted via cookies.

2. Legal Basis for Data Processing

The legal basis for processing personal data through the use of cookies is Article 6(1)(f) of the GDPR.

3. Purpose of Data Processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognized even after changing pages. The function of our website for which we require cookies is the application of language settings. The user data collected through technically necessary cookies is not used to create user profiles.

This purpose also constitutes our legitimate interest in the processing of personal data pursuant to Article 6(1)(f) of the GDPR.

4. Duration of Storage, Right to Object, and Right to Erasure

Since cookies are stored on the user’s computer and transmitted from there to our site, you, as the user, have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your web browser accordingly. Cookies that have already been stored can be deleted at any time. If cookies are disabled on our website, you may no longer be able to use all of the website’s features to their full extent; in particular, the language in which content is displayed on our website may differ from the one you have selected.

1. Description and Scope of Data Processing

On our website, you can subscribe to a free newsletter. When you sign up for the newsletter, the data you enter in the form is transmitted to us.

• Email address
• First and Last Name

In addition, we log the following data as part of your registration:

• IP address,
• Date and time.

Your consent to the processing of your data is obtained as part of the registration process, and reference is made to this privacy policy.
In connection with the processing of data for the distribution of newsletters, no data is disclosed to third parties. The data is used exclusively for the distribution of the newsletter.

2. Legal Basis for Data Processing

The legal basis for processing data following a user’s subscription to the newsletter is, provided the user has given consent, Article 6(1)(a) and Section 7(2)(3) of the German Unfair Competition Act (UWG).

3. Purpose of Data Processing

The user’s email address is collected for the purpose of sending the newsletter.
We collect your name so that we can address you personally. We collect other personal data as part of the registration process to prevent misuse of the services or the email address you provide.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. The user’s email address will therefore be stored for as long as the newsletter subscription remains active.

5. Right to Object and Remedy

The user may cancel their newsletter subscription at any time. A link for this purpose is included in every newsletter. This also allows the user to withdraw their consent to the storage of the personal data collected during the registration process.

6. Newsletter Distribution Service Provider

Our newsletter is sent via the email marketing service MailChimp. This service is provided by the U.S. company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can find the mailing service provider’s privacy policy at mailchimp.com. The Rocket Science Group LLC, doing business as MailChimp, is certified under the Privacy Shield Framework and thereby guarantees compliance with European data protection standards (www.privacyshield.gov). The mailing service provider is engaged on the basis of our legitimate interests pursuant to Art. 6(1)(f) of the GDPR and a data processing agreement pursuant to Art. 28(3), sentence 1 of the GDPR.

While MailChimp may use the data of newsletter recipients in an anonymized form—that is, without linking the data to a specific recipient—to improve its own services, MailChimp does not under any circumstances use the data of our newsletter recipients to contact them directly or to share the data with third parties.

1. Description and Scope of Data Processing

Our newsletter contains what is known as a “web beacon.” These are single-pixel images that are loaded from the Mailchimp server when the newsletter is opened. When the image is delivered, the Mailchimp server then collects certain data about the recipient, such as the time the newsletter was opened, the IP address, details about the email program (client) used, information about the recipient’s browser, and the operating system the recipient is using.

2. Legal Basis for Data Processing

The legal basis for newsletter tracking is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

3. Purpose of Data Collection

The information collected through newsletter tracking is used to improve the technical aspects of newsletter distribution based on technical data, recipient groups, their reading behavior, and access times. We also collect information on whether the newsletter was opened, when it was opened, and which links within it were clicked. While this information can be linked to individual newsletter recipients, However, we do not in any way intend to monitor the recipients of our newsletter. The information we collect allows us to tailor our newsletter service even better to the interests of our recipients—for example, by adapting content to their interests and gaining insight into their reading habits.

This purpose also constitutes our legitimate interest in processing personal data pursuant to Article 6(1)(f) of the GDPR.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. This occurs once we have analyzed the information from the newsletter tracking, but no later than seven days after the data was collected.

5. Right to Object and Request Removal

The user may cancel their newsletter subscription at any time. A link for this purpose is included in every newsletter. This also allows the user to revoke their consent to the storage of personal data collected during the registration process and to the future processing of their personal data.

1. Description and Scope of Data Processing

On our website, we provide a contact form for press inquiries, which can be used to contact us electronically. If a user takes advantage of this option, the data entered in the form is transmitted to us and stored. This data includes:

• First Name
• Last Name
• Email
• Phone
• the issue

We request your consent for the processing of your data as part of the submission process and also refer you to this Privacy Policy.

You can also contact us using the email addresses provided. In this case, we will store the user’s personal data included in the email. We will not share this data with third parties. The data will be used exclusively to process the conversation.

2. Legal Basis for Data Processing

The legal basis for processing the data, where the user has given consent, is Article 6(1)(a) of the GDPR.
The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

3. Purpose of Data Processing

The sole purpose of processing the personal data entered in the form is to handle the inquiry. If the inquiry is made via email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. For personal data entered in the contact form and data sent via email, this occurs when the respective conversation with the user has ended. The conversation is considered concluded when the circumstances indicate that the matter in question has been fully resolved.

5. Right to Object and Remedy

You may revoke your consent to the processing of your personal data at any time. If you contact us via email, you may object to the storage of your personal data at any time. In such a case, the conversation cannot continue.

If you would like to revoke your consent and/or object to the storage of your data, please send an email to datenschutz@olympiastadion.berlin.

In this case, all personal data stored when you contact us will be deleted.

This is an external service offered by Unikat PR GmbH, which has been entrusted with the independent organization and conduct of guided tours and visits to the Olympic Stadium in Berlin. The agency we have commissioned acts as the organizer for the entire tourist visitor program.

1. Booking Group Tours (Unikat PR GmbH)

On our website, you can use a contact form to request various types of group tours from the event organizer. Group tours are handled exclusively by Unikat PR GmbH. We do not process any personal data in this context. During the booking process, the event organizer will provide you with separate information regarding data protection.

2. Online Ticket Pre-sales for Guided Tours of the Olympic Stadium in Berlin

You can purchase tickets for public tours of the Berlin Olympic Stadium through the websites https://tickets.olympiastadion.berlin and https://olympiastadion.berlin/de/fuehrungen/. To make a reservation, you will be redirected to an external online store operated by “Unikat PR GmbH,” which runs the ticket shop mentioned above. We do not process any personal data in this context. During the booking process, the operator will provide you with separate information regarding data protection.

This page includes a virtual 360-degree tour. The provider is Durch die Stadt GmbH, Weißenseer Weg 37, 13055 Berlin.

When you visit one of our pages featuring the virtual 360-degree tour, a connection is established to the servers of Durch die Stadt GmbH. The use of the virtual 360-degree tour serves the purpose of presenting our online offerings in an appealing manner and making it easy to locate the places listed on our website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. The virtual 360-degree tour uses the open-source web analytics service Matomo. Matomo is configured so that no cookies are set. The IP address is anonymized before being stored.

For more information on how user data is handled, please see the privacy policy of Durch die Stadt GmbH:“https://www.durchdiestadt-agentur.de/datenschutzbestimmungen”.

We have integrated the social media platforms Facebook, Instagram, Twitter, and TripAdvisor into our website via links, which may result in the social media providers receiving data from you. If you click on a social media link, you will be redirected to the website of the respective social media provider. When you access the websites of the respective social media providers via our website, we transmit the relevant reference data to the respective social media provider. This informs the social media provider that you have visited our site.

Note on Data Processing in the United States:

If you click on a social media link, your data may be processed by the respective provider in the United States. According to the European Court of Justice, data protection standards in the U.S. are inadequate, and there is a risk that your data may be processed by U.S. authorities for surveillance and monitoring purposes, potentially without any means of legal recourse. Unless you click on the links provided by social media providers, no data will be transferred.

For more information on data processing by social media providers, click here:

Facebook:
https://de-de.facebook.com/business/help/144825579583746
https://de-de.facebook.com/about/privacy
https://de-de.facebook.com/full_data_use_policy

Instagram:
https://help.instagram.com/155833707900388
https://www.instagram.com/about/legal/privacy/

Twitter:
https://twitter.com/privacy?lang=de

TripAdvisor:
MediaRoom – PRIVACY POLICY AND COOKIE POLICY

1. Description and Scope of Data Processing

In connection with the sale of VIP tickets, we process personal data necessary for the performance and fulfillment of the contractual relationship. This includes, in particular:

• First and Last Name
• Email address
• Address
• Phone number
• Payment information (e.g., account information for bank transfers)
• Payment Status
• The data is collected either through an order form, via email, or as part of other communication with the buyer.

Payments are processed exclusively via bank transfer. Payment data is processed through the respective participating financial institution.

2. Legal Basis for Data Processing

The legal basis for data processing is your consent pursuant to Article 6(1), first sentence, subparagraph (b) of the GDPR.

3. Purpose of Data Processing

Personal data is processed for the purpose of conducting VIP ticket sales, processing payments, issuing invoices, and organizing and conducting the event.

Without providing the required personal information, it is not possible to enter into and fulfill the contract.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Once the statutory retention periods have expired, the data will be deleted unless it is still required for the performance of a contract or for the assertion, exercise, or defense of legal claims.

5. Right to Object and Remedy

Since the processing of personal data is necessary for the performance of the contract, there is no right to object as long as the contractual relationship exists and the data is required for the performance of the contract.

Once the contract has been fully executed and the statutory retention periods have expired, you may request that your data be deleted, provided that no statutory retention obligations or other legitimate reasons preclude such deletion.

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights with respect to the controller:

1. Right to Access Information

You may request confirmation from the data controller as to whether we are processing personal data concerning you.
If such processing is taking place, you may request the following information from the data controller:

1. the purposes for which the personal data is processed;
2. the categories of personal data that are processed;
3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
4. the planned duration of the storage of your personal data or, if specific details cannot be provided, the criteria used to determine the storage period;
5. the existence of a right to have personal data concerning you rectified or erased, a right to restrict processing by the controller, or a right to object to such processing;
6. the existence of a right to file a complaint with a supervisory authority;
7. all available information regarding the source of the data, if the personal data is not collected directly from the data subject;
8. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR; and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on the data subject.

You have the right to request information regarding whether your personal data will be transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

2. Right to Correction

You have the right to request that the data controller correct and/or complete your personal data if the personal data being processed concerning you is inaccurate or incomplete. The data controller must make the correction without delay.

3. Right to Restriction of Processing

Under the following conditions, you may request that the processing of your personal data be restricted:

1. if you contest the accuracy of the personal data concerning you for a period that allows the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you object to the erasure of the personal data and instead request that the use of the personal data be restricted;
3. the controller no longer needs the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
4. if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.

If the processing of your personal data has been restricted, such data—with the exception of its storage—may be processed only with your consent or for the purpose of asserting, exercise, or defense of legal claims; to protect the rights of another natural or legal person; or for reasons of a substantial public interest of the Union or a Member State.

If the restriction on processing has been imposed in accordance with the above conditions, the controller will notify you before the restriction is lifted.

4. Right to erasure

a) Obligation to delete

You may request that the data controller delete your personal data without delay, and the data controller is obligated to delete such data without delay if any of the following grounds apply:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
3. You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
4. The personal data concerning you has been processed unlawfully.
5. The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data concerning you was collected in connection with the information society services offered, in accordance with Article 8(1) of the GDPR.

b) Disclosure of Information to Third Parties

If the controller has made the personal data concerning you public and is obligated to erase it pursuant to Article 17(1) of the GDPR, then, taking into account the available technology and the costs of implementation, the controller shall take appropriate measures, including technical measures, to inform the controllers processing the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replicas of such personal data.

c) Exceptions

The right to erasure does not apply if the processing is necessary

1. to exercise the right to freedom of expression and information;
2. to comply with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
4. for archival purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the right referred to in subsection (a) is likely to render impossible or seriously impair the achievement of the purposes of such processing, or
5. to assert, exercise, or defend legal claims.

5. Right to Information

If you have exercised your right to rectification, erasure, or restriction of processing with the controller, the controller is obligated to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed by the data controller about these recipients.

6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another data controller without hindrance from the data controller to whom the personal data was provided, provided that

1. the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
2. the processing is carried out using automated means.

In exercising this right, you also have the right to have your personal data transmitted directly from one data controller to another, provided that this is technically feasible. This must not infringe upon the freedoms and rights of others.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The data controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for those purposes.

You have the option, in connection with the use of information society services—notwithstanding Directive 2002/58/EC—to exercise your right to object through automated means that use technical specifications.

8. Right to Withdraw Consent Under Data Protection Law

You have the right to revoke your consent under data protection law at any time. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of revocation.

9. Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for the conclusion or performance of a contract between you and the data controller,
2. is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests; or
3. is done with your express consent.

However, these decisions must not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.

With respect to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including, at a minimum, the right to request that the controller involve a person, to present your own point of view, and to challenge the decision.

10. Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you reside, where you work, or where the alleged infringement occurred, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority to which the complaint was filed shall inform the complainant of the status and outcome of the complaint, including the possibility of seeking judicial redress under Article 78 of the GDPR.