Privacy Policy
Privacy Policy
1. Introduction
1.1 This Privacy Policy (“Policy”) describes how FC Red Bull Salzburg GmbH, as the company listed in the legal notice on this website (hereinafter also referred to as “Red Bull Salzburg GmbH,” “we,” “us,” “our”), collects and processes personal data about you when you visit our website (“Website”), use our mobile applications and games (“Apps”), or attend or participate in one of our games or events. By continuing to use this Website, you confirm that you have read this Policy.
1.2 If we make material changes to this Policy (regarding what data we collect, how, or why we use that data), we will highlight these changes at the beginning of this Policy for a period of 30 days after the change is made and before it takes effect, and we will place a prominent link to this information in a clearly visible location.
2. Data We Collect
2.1 Data You Provide to Us. When you visit our website, correspond with us, participate in one of our contests or promotions, take part in our surveys, post on our websites, subscribe to one of our newsletters, purchase our goods or services, book events through the website, create an account, use our apps, or communicate with us via one of our social media platforms—such as our chatbot tools—you may provide us with information about yourself. This may include information that can be used to identify you (“personal information”). When we ask you to provide certain information, we collect the information contained in the respective forms or on the corresponding pages. In addition, you may voluntarily provide us with further information when you contact us or interact with us in any other way.
2.2 If you are a regular visitor to our website or apps, you can create a user account (“My RBS Account”) with us if you wish. The data you provide to us when setting up your My RBS Account includes, among other things, your name, your email address (which also serves as your username), your gender, your country of residence, your phone number, and, if applicable, your date of birth. When you register for a user account with us, you also create a unique password that allows you to access your account. We also collect data regarding your preferred content on our apps and websites (such as videos you like) as well as data regarding the content you have selected for offline access (such as videos on our apps that you download to watch later).
2.3 If you decide to purchase games, apps (including in-app purchases), or other goods or services on our website, we will also collect your shipping address, billing address, and payment information. Please note that we do not store your payment information; this is handled by an external payment service provider.
2.4 If you decide to subscribe to one of our newsletters or receive other forms of direct communication from us, you may provide us with your name, email address, gender, date of birth, and interests.
2.5 When you visit our website or use our apps, we may use your personal data to improve your user experience through recommendations tailored specifically to you. This may include recommending certain content to you based on your search history or your Facebook likes and interests. We do not collect your username or password for Meta, X (formerly Twitter), Apple, or Google. However, we may collect certain information from these websites that indicates whether you are logged into the app via your Meta, X (formerly Twitter), Apple, or Google accounts. This data is used to access or obtain certain information about you from your Meta, X (formerly Twitter), Apple, or Google account, thereby improving your user experience and providing you with content that is relevant to you. This refers to information that you publish on your profile. We do not access your personal page settings.
2.6 With your consent, our apps may use GPS tracking to provide you with location-based features. The apps may access the photos and videos you store on your mobile devices to allow you to upload videos and photos for use within these apps. The apps may use push notifications to inform you, for example, when tickets go on sale, when prediction games or sweepstakes are taking place, or when other interactions are offered. When you use an app for the first time, you will be asked whether you would like to use these features in your settings menu. If you decide not to enable these features or to enable them at a later time, you may not be able to use the full range of features offered by the app.
2.7 Data Collected Automatically. When you visit our website or use our apps, we may automatically collect the following data: your IP address, login information, location, browser type and version, browser plug-in types and versions, operating system and platform, information about your visit—including the URL clickstream (sequence of page views) to, through, and from our website, your advertising ID (if supported by your device, such as an Apple or Google product), products you’ve viewed or searched for, videos you’ve opened, download errors, duration of visits to specific pages and interactions between pages and apps, media downloads for offline use, screen resolution, device processing and storage capacity, playback errors and buffering issues, user behavior such as the duration of app use, and device IDs (for example, an IMEI address—a unique identifier assigned to mobile phones that is used by GSM networks to enable them to recognize valid mobile devices). Automatic data collection is carried out through the use of various technologies, including “cookies” and “web beacons.”
2.8 We may also collect data about you through our security systems when you visit our business premises or attend our events.
2.9 Data we receive from other sources. We may receive data about you from other sources if you use any of the other services we offer on our website or in our apps, or if you have provided data to other Red Bull Salzburg GmbH companies or companies affiliated with Red Bull Salzburg GmbH. We also work closely with third parties (including, for example, business or sponsorship partners, subcontractors for technical services, payment and delivery services, advertising networks, analytics providers, search engine operators, and credit bureaus) and may receive personal data about you from them (including publicly available data).
3. Why We Use Your Data
3.1 We use the data we collect to provide you with the best possible user experience when you use our digital services (in particular, our website and app) and interact with us, including when you use our services and products. This includes using your data for the following purposes:
• (a) Providing and improving our products and services: We use your data to provide you with the products and services you have requested through the website, including when you make purchases, book an event, when we send you a confirmation email, or when we contact you regarding your account. We use your data to improve and customize our website, apps, products, and services so that they better align with our users’ behavior and technical capabilities.
• (b) Setting up and managing your My RBS account: We use your data to set up your account and manage our relationship with you. We also use your data to communicate with you regarding your account and our services. This is done with the involvement of a third-party service provider (currently Unidy; their privacy policies can be found here: https://www.unidy.io/privacy-policy).
• (c) Website and app management: We use your data to manage our website and apps for internal operations, including for troubleshooting purposes, and to better understand any errors you may encounter while using our website and apps.
• (d) Improving the user experience and content of our websites and apps: We use your data to improve the content of our websites and apps and to ensure that the content is displayed as effectively as possible for you and on your devices.
• (e) Protection and security: We use data collected on our website and apps as part of our efforts to ensure the protection and security of our website and apps and to better manage our IT systems. We use the data collected by our security systems to provide better protection and enhanced security for our event venues and attendees.
• (f) Marketing: We use your data to communicate with you, keep you informed about our activities and events as well as those of third parties that may interest you, and provide you with suggestions and recommendations on our website and apps regarding goods or services that might be of interest to you. You will receive this information from us via email, in the form of push notifications on our apps, personalized messages on our websites, targeted advertisements on our website, our apps, and external platforms, text messages, via social media, or by phone (in each case subject to your prior consent, where required by law).
• (g) Online Marketing: We use your data to measure and understand the effectiveness of the advertising we deliver to you and others, and to provide you with relevant advertisements. We also use your data when we communicate with you via social media to build and maintain our social media brand (subject to your prior consent, where required by law).
• (h) Personalization and Improvement of the User Experience: To the extent permitted by law, we may combine data from external sources, including social media websites, with data you have provided and data we have collected, including data obtained through cookies and web beacons. We may use this data and the aggregated data to learn more about your preferences as our customer, improve your user experience on our website and apps, and provide you with information, content, and offers tailored to you.
• (i) Enabling a seamless experience across all devices and platforms: We align the data we have collected from you and received from you on one device or platform with the data we have collected or received from you on other devices or platforms.
• (j) Providing customer service and handling complaints and inquiries: We may use your data to provide you with more efficient customer service and to handle your complaints or inquiries.
• (k) Making required disclosures and complying with legal obligations: We may use your data to make the necessary disclosures in response to requests for information that we are required by law to provide to law enforcement or regulatory authorities, regulatory bodies, or supervisory authorities, or in the context of defending legal claims, as well as to enforce our terms and conditions and/or this policy.
• (l) Conducting sales, transfers, or restructurings of one of our business units.
4. Legal Basis for the Use of Your Data
4.1 The processing of your personal data is based on a broad legal basis, including:
• (a) When you have given your consent: for example, we need your consent to process your personal data for direct marketing activities, when we use cookie technologies, or when we process special categories of personal data, such as your dietary needs.
• (b) When processing is necessary for the performance of a contract: for example, so that we can process a booking for an event, deliver goods you have ordered from our online store, or facilitate an in-app purchase,
• (c) When we must comply with a legal obligation: for example, we may need to disclose your data to a law enforcement agency or to your or our legal representatives who are representing us in a legal dispute.
• (d) When processing is necessary based on our legitimate interests; these include, among other things: (1) providing our products and services to you, (2) ensuring that your account is adequately protected and that our website, apps, network, and information technology are secure and used properly, (3) better understanding how you use our products, services, apps, and website, and making improvements, (4) researching and analyzing the products and services you request, (5) tailoring our content, marketing, advertising, and offers to your specific interests, (6) maintaining a presence on traditional and social media, (7) efficient communication, as well as social analytics and content performance on social media, (8) ensuring the security of our business operations and those of our business partners, as well as monitoring the areas surrounding and within our business premises to protect our employees, customers, and the general public from misconduct or criminal acts, (9) Developing and maintaining relationships with suppliers, partners, and other companies, as well as managing the individuals who work for them, (10) staying informed about current market practices to ensure that we offer a service that is competitive and meets our customers’ expectations, and (11) determining the effectiveness of advertising on our website, our apps, and on partner websites. In some states, this type of data processing requires appropriate consent. We will obtain your consent if we are legally required to do so.
5. Sharing and Disclosure of Data
5.1 We may disclose your data to companies affiliated with Red Bull Salzburg GmbH and to third parties for the purposes specified in Section 3 of this Policy, including external online platforms, social media platforms, entities that provide services to us or act as our agents—including, among others, subcontractors (including their agents) and consultants, advertising agencies, advertising networks, IT vendors, database vendors, backup and disaster recovery specialists, email providers, and other service providers necessary for improving our products and services.
5.2 (a) We share aggregated, anonymized, or other non-personal data with advertising partners, ad networks, and social networks that need this data to provide you and others with selected, relevant advertisements. We also use aggregated data to help advertising partners reach the type of audience they wish to target. (b) We use the personal data we have collected from you to help our advertising partners show their ads to a target audience and to present our advertising messages to you. This means that you will be shown ads that are of greater interest to you based on the personal data we have collected from you, and
* (c) We share certain personal data you provide and access data from analytics services and search engine providers that help us improve and optimize the website and apps to better tailor content and advertising to you.
5.3 Our suppliers and service providers are required to comply with our data processing and security standards. The data we provide to them, including your personal data, is made available solely in connection with the performance of their duties. They are not authorized to use your personal data for any purposes other than those set forth in this policy.
6. Opt-in or Opt-out with Regard to Direct Marketing
6.1 We and selected third parties may use the information you provide to us on our website and in our apps for direct marketing purposes, to send you updates, newsletters, event notifications, or other communications that we believe may be of interest to you.
6.2 If required by law, we will obtain your consent before sending you direct marketing materials. In any case, we will provide you with the option to opt out in every communication we send.
6.3 You may object to receiving direct marketing materials from us at any time by contacting us via email at the address provided in Section 26 or by using the opt-out options provided in our email communications.
7. Analytics and Reporting Tools
7.1 To ensure that our online advertising is tailored to you and of interest to you, we analyze your behavior on our websites, partner websites, and apps, as well as your interactions with us. For example, we track when you click on articles or our ads (whether on our websites or external websites), when you interact with us on social media (by mentioning us or our products), when you communicate directly with us (including via our chatbottools used on social media), when you purchase tickets for one of our events, when you buy products from us, when you attend our events, when you open and interact with our marketing communications, and where you come from when you visit our website or download our apps.
8. Cookies and Other Technologies
8.1 We collect data automatically through the use of “cookies.” Cookies may be set by us or by third parties. A cookie is a text file containing a small amount of data that a website can send to your browser and that is then stored on your computer as an anonymous tag to identify your computer, but not you. Some pages on our website use cookies to provide you with better service when you return to the site. You can use our Cookie Settings to specify which cookies we are permitted to enable.
8.2 We also use web beacons, which are commonly known as “single-pixel GIFs,” “clear GIFs,” or “tags.” Web beacons are small graphic files that may be included on our website. Web beacons allow us to optimize our products and services and provide us and third-party partners with analytical data, such as the number of visitors to our website. We may also use web beacons in our email correspondence to determine whether you open an email or take further actions. We also collaborate with other organizations to place our web beacons on their websites or in their advertisements. We do this so that we can compile statistics on how often clicking an advertisement on a Red Bull Salzburg GmbH website or an advertising partner’s website leads to a purchase or other interaction on an advertising partner’s website.
8.3 For our apps, we automatically collect data through the use of device identifiers (“IDs”). An ID is a specific sequence of numbers and letters (“string”) that is assigned to your device but does not identify you personally. The ID allows us and third parties selected by us to track your behavior when you use the app. Virtually every app uses ID technology. IDs serve various purposes; for example, they remember your preferences and generally ensure a better user experience. For example, IDs can tell us whether you have used our app before or if this is your first time. They also help ensure that the ads you see through the app are tailored to you and your interests. Because of how they work, IDs are extremely useful for improving your user experience.
9. Google reCAPTCHA (Google's Privacy Policy is available here)
9.1 Purpose of Data Processing
To provide an experience that is as safe and secure as possible, and to prevent unwanted bots or spam software, we integrate Google reCAPTCHA from Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). We therefore do everything we can to ensure your safety and to provide you with the best possible user experience. Through reCAPTCHA, personal data is transmitted to Google to verify that you are indeed a human. reCAPTCHA thus ensures the security of our website and, in turn, your security. Without reCAPTCHA, for example, a bot could register as many email addresses as possible during the registration process in order to subsequently send spam containing unwanted advertising content. With reCAPTCHA, we can prevent such bot attacks.
We will process this information to provide a safe and secure user experience.
9.2 Legal Basis for Data Processing
The processing of this personal data is based on your consent. If consent has not been granted, the Google reCAPTCHA content will not be loaded, and therefore no personal data will be transmitted or stored. You may withdraw your consent at any time without providing a reason. However, the withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.
Google reCAPTCHA also sets cookies in your browser to store personal data. We therefore recommend that you read our policy carefully and review Google’s Privacy Policy.
9.3 Categories of Personal Data
Depending on whether the user is signed in to their Google Account on their device, the following personal data may be collected:
• IP address;
• Referrer URL;
• Information about the operating system;
• Mouse and keyboard behavior;
• Cookie-based data;
• Date and language settings;
• All JavaScript objects;
• Screen resolution.
9.4 Data Recipients
If you consent to the use of Google reCAPTCHA, your personal data may be transferred to the following company:
Google Ireland Ltd.
Gordon House, Barrow Street, Dublin 4, Ireland.
Google operates data centers worldwide. Data transfers to Google LLC in the U.S. may be based on the EU-U.S. Privacy Shield Framework and the corresponding adequacy decision by the European Commission.
9.5 Data Controller
We are the data controller for the data processing. If your personal data is collected and transmitted via the embedded Google reCAPTCHA API, Google acts as an independent data controller for the data processing carried out by Google. If you have any questions regarding data collection and processing by Google, you can contact the company directly or review Google’s Privacy Policy.
9.6 Retention Period
Please refer to Google’s Privacy Policy for information on Google’s data retention period.
Day 10: Management System
10.1 Purpose
We use a tag management system that helps us implement and manage cookies and other tags. We use Google Tag Manager from Google Ireland Ltd., located at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The tag management system does not use its own cookies, but it triggers other cookies and tags (such as Google’s Analytics service), which in turn may collect data. You can find detailed information in the privacy policies for these services. When the tag management system is triggered, Google may process information (including personal data). It is possible that data may be processed outside the European Union or the European Economic Area (“EEA”) in so-called third countries. Google operates data centers worldwide. You can find detailed information about the locations of the servers here. Google uses Standard Contractual Clauses adopted by the European Commission as the basis for data transfers to recipients outside the EEA. These clauses require Google to comply with EU data protection standards when processing relevant data outside the EEA. You can find the European Commission’s decision and the clauses here https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en. Google’s data processing terms, which comply with the Standard Contractual Clauses, can be found here. Further information is available here. A list of subcontractors can be found here.
Information about the data processed can also be found here and here.
10.2 Legal Basis for Data Processing
The processing of this personal data is based on your consent. Unless consent has been granted, Google Tag Manager content will not be retrieved. You may withdraw your consent at any time without providing a reason. However, the withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.
10.3 Categories of Personal Data
Depending on whether users are signed in to their Google Account on their device, the following personal data may be collected:
• IP address;
• Referrer URL;
• Information about the operating system;
• Mouse and keyboard behavior;
• Cookie-based data;
• Date and language settings;
• All JavaScript objects;
• Screen resolution.
10.4 Data Recipients
If you consent to the use of Google Tag Manager, your personal data may be transferred to the following company:
Google Ireland Ltd.
Gordon House, Barrow Street, Dublin 4, Ireland.
Google operates data centers worldwide. Data transfers to Google LLC in the U.S. may be based on the EU-U.S. Privacy Shield Framework and the corresponding adequacy decision by the European Commission.
10.5 Data Controller
We are the data controller for data processing. If your personal data is collected and transmitted via the embedded Google tags, Google acts as an independent data controller for the data processing carried out by Google. If you have questions about data collection and processing by Google, you can contact the company directly or review Google’s Privacy Policy.
10.6. Retention Period
Please refer to Google’s Privacy Policy for information on how long Google retains data.
11. Vertex AI Search
11.1 Purpose
We use features of the “Vertex AI Search” tool provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to provide an intelligent search function and to automatically answer user queries using generative artificial intelligence. The system enables structured searching of content, semantic understanding of search queries, and the automated provision of appropriate answers or content. To this end, entered search queries are processed and technically analyzed to generate relevant results. When Vertex AI Search is triggered, Google may process information (including personal data). It is possible that data may be processed outside the European Union or the European Economic Area (“EEA”) in so-called third countries. Google operates data centers worldwide. You can find detailed information about the locations of the servers here. Google uses Standard Contractual Clauses adopted by the European Commission as the basis for data transfers to recipients outside the EEA. These clauses require Google to comply with EU data protection standards when processing relevant data outside the EEA. You can find the European Commission’s decision and the clauses here https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en. Google’s data processing terms, which comply with the Standard Contractual Clauses, can be found here. Further information is available here. A list of subcontractors can be found here. Information about the data processed is also available here and here.
11.2 Legal Basis for Data Processing
The processing of this personal data is based on your consent, which is given through your active use of Vertex AI Search. If consent has not been granted, Vertex AI Search content will not be accessed. You may withdraw your consent at any time by discontinuing your use of Vertex AI Search, without providing a reason. However, the withdrawal of consent does not affect the lawfulness of the processing that took place prior to the withdrawal.
11.3 Categories of Personal Data
When using the search or AI functions, the following data in particular may be processed:
• search queries and text entries;
• IP address;
• technical usage data (e.g., browser type, operating system, device settings);
• timestamps and interaction data;
• log data for system security and error analysis;
• pseudonymous identifiers or session data, if applicable;
• content data, provided it is actively entered into search or input fields.
We expressly note that entered content may be transmitted to Google for processing. Users should therefore not enter any sensitive personal data into search fields.
11.4 Data Recipients
If you consent to the use of Vertex AI Search, your personal data may be disclosed to the following company:
Google Ireland Ltd.
Gordon House, Barrow Street, Dublin 4, Ireland.
Google operates data centers worldwide. Data transfers to Google LLC in the United States may be based on the EU-U.S. Privacy Shield Framework and the corresponding adequacy decision by the European Commission.
11.5 Data Controller
We are the data controller for data processing. When your personal data is collected and transmitted via Vertex AI Search, Google acts as an independent data controller for the data processing performed by Google. If you have questions about Google’s data collection and processing, you can contact Google directly or review Google’s Privacy Policy.
11.6 Duration of Storage
Please refer to Google's Privacy Policy for information on how long Google stores data.
12. Amplitude
12.1. Purpose and Other Information
On our website and in our apps, we use the Amplitude analytics service (Amplitude Inc., 631 Howard Street, Floor 5, San Francisco, CA 94105, USA) on our website and in our apps to analyze our users’ behavior and continuously improve our digital offerings. Amplitude collects and statistically analyzes pseudonymized usage data (e.g., pages or app sections visited, interactions, device information, operating system, time of access). The pseudonymized usage data obtained in this way helps us optimize our content and features. To technically integrate Amplitude into the website, we use the Amplitude SDK, which enables the management and deployment of analytics and tracking tools.
Whether data is collected by Amplitude depends on the cookie selection in the banner (on the website) or on the tracking consent provided during app installation. You can disable app tracking at any time via your device settings.
Amplitude is the recipient of the data and processes some of it in the U.S. We have entered into a Data Processing Addendum (DPA) with Amplitude based on the EU Standard Contractual Clauses to ensure an adequate level of data protection. For more information, see: https://amplitude.com/legal.
12.2. Legal Basis for Data Processing
The processing of this personal data is based on your consent. Unless consent has been granted, Google Tag Manager content will not be retrieved. You may withdraw your consent at any time without providing a reason. However, the withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.
For more information on categories of personal data, data recipients, the data controller, and the duration of storage, please refer to the section “Tag Management System” (Section 10 of this Privacy Policy).
13. Google Firebase
13.1 Purpose of Data Processing
We use Google Firebase to technically operate and improve our website and apps. Depending on the Firebase features used, this may involve processing data specifically related to providing app functionality, delivering push notifications, and detecting and resolving technical errors. This processing is intended to ensure the functionality, stability, and security of our digital offerings.
13.2 Legal Basis for Data Processing
To the extent that processing is necessary to provide a contractual service you have requested, it is carried out on the basis of Article 6(1)(b) of the GDPR. The processing required to ensure system security is based on our legitimate interest in secure operation pursuant to Article 6(1)(f) of the GDPR. To the extent that consent is required—in particular for non-essential analytics features—processing is carried out exclusively on the basis of your prior consent in accordance with Article 6(1)(a) of the GDPR. You may revoke this consent at any time with future effect using the settings provided.
13.3 Categories of Personal Data
Depending on the Firebase feature used, the following data in particular may be processed: IP addresses, device and installation identifiers, push tokens, information about the operating system and app version, technical usage data, and error and crash reports. When using storage features, the content provided via the respective feature may also be processed.
13.4 Data Recipients
Depending on the Firebase service used and the contractual relationship, the recipients of the data are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, as well as their designated subprocessors. Google operates data centers worldwide. Processing outside the European Union or the European Economic Area—in particular in the USA—is possible. For such transfers, Google’s terms and conditions specifically provide for the EU-U.S. Privacy Shield Framework for appropriately certified recipients or the EU Standard Contractual Clauses.
13.5 Data Controller
We are responsible for the data processing we initiate. Google generally processes the personal data transmitted as part of the Firebase services as a data processor in accordance with our instructions. For more information, please see the Firebase Privacy Policy, the Firebase Data Processing Terms, and Google’s Privacy Policy.
13.6 Duration of Storage
The retention period depends on the Firebase feature used and the specific purpose of processing. Data is deleted as soon as it is no longer necessary for that purpose and there are no legal retention requirements that prevent its deletion. You can find information on service-specific retention and deletion periods in the Firebase Privacy Policy.
14. WonderPush
14.1 Purpose of Data Processing
We use WonderPush, a service provided by the Brevo Group, to send you push notifications via our website and apps after you have given your consent. This allows us, for example, to inform you about ticket sales, upcoming games, contests, and other offers. The service enables the technical delivery of notifications, the management of your notification settings, and the analysis of interactions with the notifications sent.
14.2 Legal Basis for Data Processing
Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without providing a reason, in particular by disabling push notifications in your browser or device settings or by using the opt-out option provided. Withdrawal does not affect the lawfulness of processing that took place prior to the withdrawal.
14.3 Categories of Personal Data
In particular, we process a pseudonymous installation ID, push tokens used to identify your device, technical device information, operating system, language settings, the time of login, and information about your use of and interactions with push notifications. If such features are used, your notification preferences and usage information relevant to the selection of notifications may also be processed.
14.4 Recipients of Data
The recipient of the data is WonderPush, 19 avenue d’Italie, 75013 Paris, France. According to information published by the provider, the data is processed on servers located within the European Union in the Brussels region. WonderPush uses Google Cloud as its hosting service provider for this purpose. For any transfers to additional subprocessors outside the European Economic Area, the data processing terms require compliance with legal requirements, in particular through EU Standard Contractual Clauses.
14.5 Data Controller
We are responsible for data processing. WonderPush processes the data to provide the service as a data processor on our behalf. For more information, please see the WonderPush Privacy Policy.
14.6 Duration of Storage
The data required for shipping is generally processed for the duration of your subscription. According to WonderPush’s published standard retention periods, automatically collected navigation and notification events are deleted after 90 days. Different retention periods apply to other data, depending on the data category and your unsubscribe status. For more information, see WonderPush’s Data Processing Terms.
15. Unidy als Single-Sign-On-Provider
15.1 Purpose of Data Processing
We use the single sign-on service provided by Unidy GmbH, Spitaler Str. 10, 20095 Hamburg, Germany (“Unidy”), to set up and manage your Mein RBS account. Single Sign-On allows you to log in to our connected digital services using a single, centralized user account. In this process, the necessary account and login information is processed to verify your identity, grant you access to the respective services, and manage your profile and consent settings.
15.2 Legal Basis for Data Processing
The processing required to set up and use your user account is carried out to fulfill the user agreement in accordance with Article 6(1)(b) of the GDPR. The processing required to secure your login and prevent unauthorized access is based on our legitimate interest in the security of our digital services in accordance with Article 6(1)(f) of the GDPR. Separate marketing consents are independent of the registration process and may be revoked at any time.
15.3 Categories of Personal Data
In particular, we process your email address, user ID, the profile and contact information you have provided, authentication and session data, as well as your consent and communication settings. In addition, technical access data such as your IP address, browser and device information, as well as the time and status of login attempts, may be processed.
15.4 Recipients of Data
The recipient of the data required to provide the single sign-on service is Unidy GmbH, Spitaler Str. 10, 20095 Hamburg, Germany. When logging in to a connected service, the identification and profile data required for this purpose are transmitted to that service. According to Unidy, the platform is hosted within the European Union.
15.5 Data Controller
We are responsible for the processing of data in connection with your Mein RBS account. Unidy processes the data to provide and manage the single sign-on service as a data processor on our behalf. For more information about the provider, please see Unidy’s Privacy Policy.
15.6 Duration of Storage
Your account information will generally be stored for as long as your Mein RBS account remains active. Upon termination of the user relationship, they will be deleted, unless there are statutory retention requirements or if individual data are still necessary for the settlement of the user relationship or for the assertion, exercise, or defense of legal claims. Technical session and security data are stored only for as long as is necessary for their respective functions.
16. Microsoft Dynamics CRM
16.1 Purpose of Data Processing
We use Microsoft Dynamics CRM to centrally manage our contacts and customer relationships. The system helps us process inquiries, document our communication with you, and consolidate information about the services you use. Provided you have given your consent, your data may also be used to manage your communication preferences and to select relevant information and offers for you.
16.2 Legal Basis for Data Processing
The processing of your inquiries and the administration of existing contractual relationships are carried out in accordance with Article 6(1)(b) of the GDPR. Our contact management and customer service are organized based on our legitimate interest in efficient and transparent communication in accordance with Article 6(1)(f) of the GDPR. To the extent that data is used for marketing activities requiring consent, this is done on the basis of your separate consent in accordance with Article 6(1)(a) of the GDPR.
16.3 Categories of Personal Data
Depending on your relationship with us, we process, in particular, your name, email address, mailing address, phone number, user ID, communication content, and previous contact history. This may also include information about orders, ticket purchases, events, interests you have shared, as well as your consents and communication settings. Only the data necessary for the specific purpose will be processed in each case.
16.4 Data Recipients
The recipient of the data is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In connection with the provision of services, affiliated companies—in particular Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA—as well as subcontractors may also process data. This may involve transfers outside the European Union or the European Economic Area. The relevant safeguards for this are set forth in the Microsoft Privacy Addendum.
16.5 Data Controller
We are responsible for processing the personal data we manage in the CRM system. Microsoft generally processes this data as a data processor in accordance with our instructions to provide the service. To the extent that Microsoft processes certain data for its own business purposes under its own responsibility, Microsoft’s Privacy Policy applies in addition.
16.6 Duration of Storage
The retention period depends on the specific purpose of processing. Contact and communication data are stored for as long as necessary to handle your requests and maintain the existing relationship. In addition, data relevant to contracts and billing is stored for the duration of statutory retention requirements. After you revoke your consent for marketing, the relevant data will no longer be used for that purpose. Necessary records and restriction notes may continue to be stored to document and account for the revocation.
17. Break Game with registration via Unidy
17.1 Purpose of Data Processing
If you participate in our digital break game, you’ll sign up through your “My RBS” account using Unidy’s single sign-on service. We process the data required for this purpose to identify you as a registered user, associate your participation with your user account, and run the break game. If prizes are offered in a particular game, we also use the necessary participation and contact information to determine and notify the winners, as well as to process the prizes.
17.2 Legal Basis for Data Processing
The data processing required for registration and conduct of the recess game is carried out to fulfill the terms of participation in accordance with Article 6(1)(b) of the GDPR. Measures necessary to prevent manipulated or abusive participation are taken based on our legitimate interest in the proper conduct of the event pursuant to Article 6(1)(f) of the GDPR. Any use beyond this for advertising purposes requiring consent requires your separate consent.
17.3 Categories of Personal Data
In particular, we process your user ID, login and session data, the time and content of your participation, game inputs and results achieved, as well as technical access data. To the extent necessary for conducting the game or processing winnings, your name, email address, and, if applicable, any other contact information you provide will also be processed.
17.4 Data Recipients
The recipient of the data required for registration is Unidy GmbH, Spitaler Str. 10, 20095 Hamburg, Germany. The user ID required for the break game and, if applicable, any additional profile information needed are transmitted to the game application via the single sign-on connection. The information in Section 15 of this Privacy Policy also applies to processing in connection with registration.
17.5 Data Controller
We are responsible for data processing in connection with the Pausenspiel. Unidy acts as a data processor on our behalf for the technical registration process. You can find more information about the provider in Unidy’s Privacy Policy. Additional information regarding participation in the game may be found in the Terms and Conditions.
17.6 Duration of Storage
Participation data will be stored for as long as necessary to conduct and evaluate the halftime game and to process any winnings. Afterward, the data will be deleted, unless there are legal retention requirements or further storage is necessary to resolve any claims arising from participation. Section 15.6 applies to the data from your “My RBS” account that is stored separately from this.
18. Links to Other Websites and Social Media
18.1 Links to other websites are provided for informational purposes only. Other websites are beyond our control and are not covered by this policy. When you access other websites via the links provided, the operators of those websites may collect data about you, which they may then use in accordance with their respective privacy policies in ways that may differ from our policy.
18.2 Some pages on our website may feature third-party content, applications, or plug-ins that track your use of such content, applications, or plug-ins and/or optimize your experience with them. For example, if you share an article on our website with others via a social media share button (e.g., Meta, X (formerly Twitter), or similar), this action is recorded by the social network that created the button.
19. Data Retention
19.1 We will not retain your data for longer than is necessary for our business purposes or as required by legal or regulatory obligations.
19.2 We will retain your data for as long as you have a “Mein RBS” account with FC Red Bull Salzburg GmbH and, beyond that, for as long as necessary to fulfill our legal obligations, such as retaining data for tax and accounting purposes. Your data will be retained in accordance with our internal data retention policies.
19.3 If you object to receiving direct marketing materials from us or opt out of them, we will remove your contact information and your consent to marketing campaigns to ensure that you no longer receive promotional communications from us in the future. We will not delete personal data if it is required for investigative or inquiry purposes or in connection with a legal dispute. In such cases, the data will be retained until the matter is fully resolved.
19.4 In all cases, we will continue to protect your personal data in accordance with the provisions set forth in this policy. We will also routinely update our data to ensure that it remains current.
20. Your Rights
20.1 Depending on applicable law, you may, under certain circumstances, have the following rights with respect to your personal data:
• (a) The right to access your personal data. If you would like a copy of the personal data we have stored about you, please contact us at the email address provided below. Before we respond to your request, we may ask you to verify your identity and provide further details about your request. We will endeavor to process your request within a reasonable timeframe, and in any case within the timeframe required by law.
• (b) Right to rectification, erasure, or restriction of processing of your personal data. If you wish to correct or erase your personal data or restrict its processing, please contact us at the email address provided below. It is your responsibility to ensure that you provide truthful, accurate, and complete information and to keep it up to date at all times.
• (c) Right to Withdraw Consent. If you have given your consent to the processing of your data, you may withdraw it at any time by contacting us at the email address provided in Section 26 below.
• (d) Right to Data Portability. You may ask us to assist you in transferring some of your data to other companies. In this context, you have the right to request that we transfer your data to another company in a machine-readable format. You may submit your request via email using the email address provided below.
• (e) Right to Object. You may object to the manner in which we process your personal data or to direct marketing based on profiling, provided there is a legitimate interest in doing so, by submitting your request via email to the email address provided below.
• (f) The right not to be subject to automated decision-making. (For further details, please see Section 26 below.)
• (g) Right to lodge a complaint with a supervisory authority. You may contact your local supervisory authority if you have a complaint regarding the way we handle your personal data.
20.2 If you have created a user account, you can access the personal data we hold about you through your user account, obtain a copy of it, and correct, supplement, or delete any inaccurate data. You may also close your “My RBS” account at any time.
20.3 If you wish to exercise any of the rights listed above, please contact us at the email address provided in Section 26 below.
21. Profiling
21.1 We may use your data to try to learn more about you so that, where appropriate, we can better predict which products and services you might be interested in.
21.2 On the e-commerce website, which is operated by a third party, service providers that use automated decision-making processes are engaged to verify your address and creditworthiness. This helps ensure that accurate address information is used and that the risk of non-payment for products and services is assessed.
22. Data Security
22.1 We use physical, technical, and administrative measures to protect your personal data stored by us against unauthorized access, collection, use, disclosure, copying, alteration, or deletion. All data you provide to us is stored on secure servers.
22.2 If you have a password to access our website or app, you are responsible for keeping the password secure and confidential.
23. Global Transmission
23.1 Because the Internet is a global environment, the collection and processing of personal data via the Internet inevitably involves the international transfer of data. Although we typically store the personal data we collect about you through our website in your region (for example, in the European Economic Area for visitors from Europe), it may happen that your personal data is also transferred to parties outside your region (where different data protection laws apply, e.g., in the U.S.), including to affiliates of FC Red Bull Salzburg GmbH.
23.2 When this occurs, we have implemented safeguards and data protection measures to ensure that your data is adequately protected in third countries, e.g., through the use of standard contractual clauses. If you would like more information on this, please contact us at the email address provided in Section 26.
24. Use of the Website or Our Apps by Minors
24.1 By using this website or app, you confirm that you are over 16 years of age. If you are 16 years old or younger, you must first obtain consent from your parents or legal guardians before providing us with any data through our website or apps. Without this consent, providing data is prohibited. If you nevertheless provide us with data, we will cease processing that data as soon as we become aware of it.
25. Amendments to the Policy
25.1 This policy was last updated on February 12, 2026. Whenever this policy is materially amended, a notice will be posted on our website for a period of 30 days. By continuing to use our website or app, you agree to the respective changes.
26. Questions, Concerns, and Complaints Regarding the Policy; Contact Information for the Data Protection Officer
26.1 If you have any questions, concerns, or complaints regarding this policy or our handling of your data, please send us an inquiry at: datenschutz@redbullsalzburg.at
Version: November 5, 2026
