Privacy
This is a translation for your information. Only the German version is legally binding.
This privacy policy applies to the internal team-wear ordering system of the Blutspendedienst. The privacy policy of blutspendedienst.com applies to the rest of the website.
I. Controller and data protection officer
The controller responsible for processing personal data on this website is:
Blutspendedienst des Bayerischen Roten Kreuzes gemeinnützige GmbH
Kistlerhofstraße 140, 81379 Munich, Germany
Phone: +49 89 5399-0
Fax: +49 89 5399-4005
Free hotline (Germany): 0800 11 949 11
info@blutspendedienst.com
If you have any questions or comments about data protection, you are welcome to contact our data protection department or our data protection officer at any time:
Dr. Florian Modlinger
Data Protection Officer
Blutspendedienst des Bayerischen Roten Kreuzes gemeinnützige GmbH
Kistlerhofstraße 140, 81379 Munich, Germany
E-mail: datenschutz@blutspendedienst.com
E-mail to the data protection officer, personal/confidential: datenschutzbeauftragter@blutspendedienst.com
II. Collection and use of personal data
We process personal data that we receive from you when you use this website or enter it in the corresponding fields. Specifically, we process your personal data for the following purposes:
1. Provision of the website and IT security
(1) Description and scope of processing
When you visit our website, we automatically process the log files of our web server. These log files contain technical information about your use of the website (usage data): referrer URL (the page from which you came to the current page), time of access, name of the page or file accessed, amount of data transferred, status of the request, browser type and version, operating system type and version and your IP address (“server data”).
To protect against misuse, we also count sign-in attempts, requests and contact messages per IP address and e-mail address. These counters are deleted automatically after one hour at the latest.
(2) Legal basis
The legal basis for processing this personal data is Art. 6(1)(b) GDPR (performance of a contract).
(3) Purpose
We process this personal data to operate the website and to ensure IT security, so that the website works properly and securely for you.
(4) Duration
We delete your personal data once it is no longer needed for the purpose. For data collected to provide the website, this is the case when the session has ended and the data is no longer needed for IT security. Beyond that, we only store your usage data to comply with any statutory retention periods.
2. User account
(1) Description and scope of processing
Accounts for employees and managers are created by the administration (individually or by import). We process first name, last name, business e-mail address, phone number (optional), location, the e-mail address of the responsible manager, the preferred language, the role in the system, the password (only as an encrypted hash), the time of the last sign-in and, if enabled, the two-factor sign-in setting. We send you a link by e-mail to invite you and to reset your password.
(2) Legal basis
The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG (performance of the employment relationship, provision of work clothing).
(3) Purpose
The account is used to sign in, to prefill requests and to show your own requests.
(4) Duration
We store the account data as long as the account exists. Requests already submitted are kept after the account is deleted (see No. 3).
3. Team-wear requests
(1) Description and scope of processing
For a request we process first name, last name, e-mail address, the selected manager, the location, the requested items (size, colour, cut, quantity) and an optional note. You receive a confirmation by e-mail and the selected manager receives the request for approval. After approval, we transmit the order with location and items to the supplier CAP-Teamwear, which produces and delivers the team-wear. We log the history of the request (approval, rejection, e-mails sent).
(2) Legal basis
The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG (provision of work clothing).
(3) Purpose
Processing, approval and delivery of the requested team-wear.
(4) Duration
We store requests as long as they are needed to process and document the order. Beyond that, we only store them to comply with any statutory retention periods.
4. Contact
(1) Description and scope of processing
If you contact us using the contact form, we process your first name, last name, e-mail address and the content of your message as well as any further communication between you and us. We also process server data in connection with your request and our communication.
Please only share health data with us if you consider it absolutely necessary. If you do, you consent to us processing your health data for your contact request.
(2) Legal basis
The legal basis for processing this personal data is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). The legal basis for processing any health data is Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future. Processing carried out before the withdrawal remains lawful.
(3) Purpose
We process the contact data to handle your request. The server data helps us prevent misuse of the website and ensure the security of our IT systems.
(4) Duration
Your personal data is deleted as soon as it is no longer needed for the purpose for which it was collected. We only process it until your request has been answered in full. Beyond that, we only store your personal data to comply with any statutory retention periods.
5. Cookies and storage in the browser
We only use cookies that are technically necessary for signing in and for security (session, protection against cross-site request forgery, optionally “Stay signed in”). The cart and the first and last name of the signed-in person are stored locally in your browser (localStorage) so that they are still there on your next visit; the number of the last request sent is stored only until the browser window is closed (sessionStorage). This data does not leave your device. We do not use any analytics or marketing tools and do not load fonts or content from third parties.
The legal basis is Section 25(2) No. 2 TDDDG (storage that is strictly necessary) in conjunction with Art. 6(1)(b) GDPR.
III. Disclosure of your data to service providers and third parties
Where your personal data is disclosed for specific purposes as part of the processing described in this privacy policy, we have described this in the relevant place. In addition, we generally disclose your personal data as follows:
1. Processors
We disclose your personal data to service providers who support us as processors in operating the website and for the purposes above (Art. 28 GDPR), in particular:
- CAP-Teamwear (operation of the ordering system and handling of orders);
- eSoul s.r.o. (programming, operation and hosting of the ordering system).
2. Legal obligation or enforcement of legal claims
In individual cases, we also transmit your personal data to authorities, courts or organisations if this is necessary to protect the legitimate interests of us or third parties or if we are legally obliged to do so. Reasons can include asserting legal claims and defending against legal disputes, ensuring the IT security and IT operations of the Blutspendedienst, or preventing and investigating criminal offences. We will inform you separately about any such transmission in accordance with data protection law.
3. Transfers to countries outside the European Union
Personal data is not transferred to countries outside the European Union / European Economic Area (third countries).
IV. Your rights
You have the following statutory rights towards the Blutspendedienst regarding your personal data, provided the respective conditions are met. You can find more information about your rights and their conditions on the website of the European Commission at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens_en.
1. Right of access
As a data subject, you have the right to request confirmation as to whether we process personal data concerning you. If so, you have the right to access this personal data and to further information, e.g. the purposes of processing, the recipients and the planned storage period or the criteria for determining it.
2. Right to rectification and completion
You have the right to request the rectification of inaccurate personal data without undue delay. Taking into account the purposes of processing, you have the right to request the completion of incomplete personal data.
3. Right to erasure (“right to be forgotten”)
You may have a right to erasure of your personal data, for example if it is no longer needed for the original purposes, if you have withdrawn your consent or if the personal data has been processed unlawfully.
4. Right to restriction of processing
You have a right to restriction of processing in the cases provided for by law.
5. Right to data portability
In the cases provided for by law, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
6. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.
In the case of direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing.
7. Right to withdraw your consent
You can withdraw your consent to the processing of your personal data at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
8. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data concerning you infringes the GDPR.
The competent supervisory authority for the Blutspendedienst is the Bavarian State Office for Data Protection Supervision (BayLDA) (https://www.lda.bayern.de/de/kontakt.html).
V. Automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR to achieve these purposes and provide these services.
VI. Changes
This privacy information may change from time to time, for example due to changes to our services on the website, changes in the law and/or the introduction of new technologies or services on the website. Updates to the privacy policy will be published on this page. We will point out any significant changes.
VII. Further questions
If you have any further questions that this privacy policy has not answered, please send an e-mail to: datenschutz@blutspendedienst.com.
Last updated: September 2026