Skip to content
Kick&Care Fußball hilft – About us

Privacy policy

This English version is provided for convenience only. In case of any discrepancy, the German version prevails.

Last updated: October 2026

Protecting your personal data matters to us. Below we explain which data we process when you visit this website, for what purposes and on what legal basis, and which rights you have.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

KICK & CARE – Fußball hilft, Oliver Hongla, Forststr. 5a, 56864 Bad Bertrich, Germany

2. Hosting, Cloudflare and server logs

This website is operated by [Contrum – legal form and address to be added before go-live] on a virtual private server (VPS) within the European Union. The server is provided by [VPS provider, address – to be added before go-live]. We have concluded a data processing agreement with both in accordance with Art. 28 GDPR.

Cloudflare. All requests to this website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (DNS and an encrypted “Cloudflare Tunnel” connection to our server). Cloudflare processes the connection data this requires, in particular your IP address, the address requested, date and time and browser details, in order to deliver the pages and to fend off attacks. Processing in the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework, and we have concluded a data processing agreement with Cloudflare. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in delivering the website securely and quickly. More information: Cloudflare’s privacy policy.

Server logs. Our web server does not keep access logs of your page views. Only technical error messages are stored. In individual cases these can contain an IP address and the address requested. We use them only to detect and fix faults and attacks. The error log is limited in size; older entries are overwritten automatically. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and reliable operation of the website.

3. Consent, no cookies

This website does not set any cookies of its own. On your first visit, a notice asks which optional services you want to allow (the TicketPAY ticket shop and, where enabled, audience measurement with PostHog). We store your choice in your browser’s local storage (localStorage, entry “kac_consent”): the selected categories, date and time, and a random consent ID. The entry never leaves your device and expires after 6 months; we then ask again.

Storing your choice is necessary so that we can respect it (Section 25 (2) no. 2 TDDDG). You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. Your language choice (German, English, French) is reflected solely in the address (URL) of the page you visit.

4. Audience measurement with PostHog (only with consent, cookieless)

To understand how our website is used and to improve it, we use the analytics service PostHog, provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog’s European cloud instance; data is processed and stored on servers in Frankfurt am Main, Germany.

We have configured PostHog in cookieless mode:

  • No cookies are set and no identifiers are stored in localStorage or anywhere else on your device.
  • There is no cross-site tracking; no user profiles are created across different websites.
  • IP addresses are not stored.

We collect information about how our website is used, such as pages viewed, time spent on the site, the previously visited page (referrer) and general information about device type, browser and operating system. So that individual visits can be distinguished statistically, PostHog generates a hash on the server that changes daily and does not allow any conclusions to be drawn about you personally.

PostHog is only loaded if you consent to the “Statistics” category in the cookie settings. The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw it at any time via the “Cookie settings”; measurement then stops immediately.

We have concluded a data processing agreement with PostHog in accordance with Art. 28 GDPR. Insofar as access by PostHog Inc. from the USA cannot be ruled out, it is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which PostHog Inc. is certified.

Even after you consent, we respect your browser’s Do Not Track signal.

5. Helper and volunteer form

If you sign up as a helper or volunteer using our form, we process the information you provide – in particular your name, contact details (email address and, if provided, phone number), age, details of how and where you would like to get involved, and your message to us.

  • Purpose: processing your registration, getting in touch with you and coordinating your possible involvement with KICK & CARE.
  • Storage: your data is stored in the database of our content management system on our own server (see section 2).
  • Notification: our team is notified of every new registration by email. We send these notifications through a mailbox at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
  • Legal basis: Art. 6 (1) (a) GDPR (the consent you give in the form) and Art. 6 (1) (b) GDPR (steps taken at your request prior to an agreement, i.e. coordinating your voluntary involvement).
  • Retention period: we delete your data as soon as it is no longer needed for this purpose, and at the latest 12 months after our last contact – unless you become an active volunteer with us, in which case we keep your data for the duration of your involvement.

Providing your data is voluntary; however, we cannot process your registration without the information marked as mandatory. You can withdraw your consent at any time with effect for the future, e.g. by emailing [email protected].

6. Contact by email

If you contact us by email, we process your email address and the content of your message in order to deal with your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR (our legitimate interest in responding to enquiries). We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations apply.

7. TicketPAY ticket shop (only with consent)

We sell tickets for our events through the ticketing service provider TicketPAY Europe GmbH, Herbert-Rust-Weg 27, 59071 Hamm, Germany.

The TicketPAY ticket shop is only loaded on our website if you have consented to the “Ticket shop” category in the cookie settings or activate it on the page by clicking “Buy tickets”. Only then is a connection established to TicketPAY’s servers, and TicketPAY receives technical data such as your IP address, the date and time and information about your browser; TicketPAY may set cookies. No data is transferred to TicketPAY before that. The click on “Buy tickets” applies to that page only and is not stored.

The legal basis for loading the ticket shop is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw it at any time via the “Cookie settings”. Your ticket order – including the data you enter in the ticket shop and the payment – is processed by TicketPAY. For details, please refer to TicketPAY’s privacy policy.

8. External links (GoFundMe and social networks)

Our website contains plain links to our donation page on GoFundMe and to our profiles on social networks (Facebook, Instagram, TikTok, LinkedIn and YouTube). These are ordinary hyperlinks, not embedded plugins: no data is transferred to these providers simply because you visit our website.

Only when you click on such a link do you leave our website and get redirected to the respective provider. The respective provider is responsible for any data processing there, and its own privacy policy applies.

9. Fonts

The fonts used on this website are loaded locally from our own server. No connection is made to servers operated by Google or any other third party.

10. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content – such as the information you enter in the volunteer form – this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar starting with “https://” and a padlock symbol.

11. Your rights

With regard to the personal data concerning you, you have the following rights:

  • access to the data we process about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of any consent given, with effect for the future (Art. 7 (3) GDPR)

Right to object: where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, simply send an informal message to [email protected].

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)

Hintere Bleiche 34, 55116 Mainz, Germany – www.datenschutz.rlp.de

13. Changes to this privacy policy

We will update this privacy policy whenever our website or the legal requirements change. The current version published here applies.