Here at Kaufland, the protection of your personal data is a top priority. This is why we provide this Privacy Policy to inform you about how we protect your privacy when you share your personal information with us. Alongside naturally observing German data protection laws, we would like to use this Privacy Policy to commit ourselves to the responsible use of your data in order to protect your privacy at all times. It is very important to us that you feel comfortable when you visit our website.
In the section “Data Controller”, we begin by providing information on the Data Controller and the Data Protection Officer along with the available contact options. Under “General information on using the website ‘real-digital.de’”, we next provide information on universally applicable notices. Finally, in the section “Rights for Data Subjects”, we provide information about your rights as a Data Subject in accordance with the GDPR.
A. Data Controller
I. Name and address of the Data Controller
Our Data Controller in accordance with the European General Data Protection Regulation
and other national data protection laws of EU Member States or any other applicable data protection regulations is:
Postal address:
Kaufland e-commerce Services GmbH & Co. KG
Habsburgerring 2
50674 Cologne, Germany
Register court: Local court Stuttgart
Register number: HRA 739855
Contact information:
Phone: +49 221 975 979 50
E-mail: jobs@kaufland-ecom.com
II. Contact data and address of our data protection department
For any questions relating to the processing or use of your personal data, please contact us by using the following addresses:
Via e-mail:
datenschutz@kaufland-online.com
Via post:
Kaufland e-commerce Services GmbH & Co. KG
Data Protection Officer
Address for Marketplace:
Marketplace, c/o. Kaufland e-commerce Services GmbH & Co. KG
Habsburgerring 2
50674 Cologne, Germany
III. Address and contact information for the Data Protection Officer
datenschutz süd GmbH
Dr. Christian Borchers
Wörthstraße 15
97082 Würzburg, Germany
office@datenschutz-sued.de
B. General information on using the website “kaufland-ecommerce.com”
Generally speaking, anonymous use of our website is possible. When you access our website, some general information is collected automatically. This includes information such as your web browser type, the operating system you use, the domain name of your internet service provider and similar information.
This exclusively concerns information that does not allow any conclusions to be made about your person. Furthermore, this kind of data is generated when you access app content or any other website on the internet. This data is therefore not related to any specific functionality of our website. We exclusively collect this type of information on an anonymous basis for statistical analysis.
We only store your personal data when you share it with us. We need this personal data – such as your name and e-mail address – for example when you sign up to a newsletter or use the function for commenting on posts on our website. We exclusively use the data collected in this manner for the purpose for which you have provided it to us, in particular for sending you the newsletter you have signed up for or in the context of displaying a comment under the name you have entered.
Information on the individual processes:
I. Provision of the website kaufland-ecommerce.com and creation of log files
1. Description and scope of data processing
Every time our website is called, our system automatically collects data and information on the computer system of the calling device. To the extent that your browser settings allow for transmission, the following data is thereby collected:
(1) Information about the browser type and version used
(2) The user’s operating system
(3) The user’s IP address
(4) Date and time of access
(5) The last website from which the user’s system reached our website
This data is temporarily stored in our system’s log files. No storage of this data in combination with other personal information about the user will occur.
2. Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 Para. 1 lit. f) GDPR.
3. Purpose of data processing
The temporary storage of your IP address by the system is necessary for enabling delivery of the website to your device. To make this possible, the user’s IP address must be stored for the duration of the session. The storage of log files occurs to ensure the functionality of our website. We also use this data to optimise our website and to ensure the safety of our information technology systems. For these purposes, our legitimate interest is grounded in data processing in accordance with Art. 6 Para. 1 lit. f) GDPR.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected.
5. Possibility of objection and removal
The collection of data for the provision of the website and the storage of this data in log files is absolutely necessary for the operation of the website. There is therefore no possibility of rejection on the part of the user.
II. Use of cookies and similar technologies to process usage data
1. Description and scope of data processing
Cookies are pieces of information that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware. Each cookie stores information which links it to the specific end device used. However, this does not mean that we will immediately become aware of your identity.
Cookies and the other technologies used to process usage data are deployed for the following purposes, depending on the categories of cookies/other technologies:
- Technically necessary: These are cookies and similar technologies without which you cannot use our services (e.g. accurately displaying our website/the functions you request, to save your login in the login area etc.). You can find a list of all technically necessary technologies/cookies in use here.
The use of technically necessary cookies and similar technologies in the “Technically necessary” category is based on section 25 para. 2 no. 2 Telecommunications Digital Services Data Protection Act (TDDDG). - Statistics: These methods enable us to tailor the design of our services by producing pseudonymised statistics about how the services are used. This allows us to determine, for example, how we can customise our websites even better to match our users’ habits. You can find a list of all “Statistics technologies/cookies” in use here.
The use of technically necessary cookies and similar technologies in the “Statistics” category is based on section 25 para. 1 TDDDG. Subsequent data processing is based on your consent in accordance with Art. 6 para. 1 (1 a) GDPR - Marketing: These enable us to display relevant advertising content based on an anonymised analysis of your usage behaviour. Your usage behaviour can also be tracked over various websites, browsers or devices via a user ID (unique identifier).
If you consent to us collecting a pseudonymised user profile and forwarding it along with the pseudonymised user ID for marketing purposes, you can be contacted on other Kaufland websites and services and, if applicable, other third-party channels that correspond to your assumed interests based on your user profile. In addition, we analyse the successful display of advertising banners and your use of our Kaufland websites (e.g. advertising banners viewed or clicked on) both in order to optimise our advertisements and offers for you and other customers, and in order to provide our advertising partners with pseudonymous data for billing purposes and to optimise their marketing campaigns. Our advertising partners cannot trace this information back to you personally. If you do not give your consent or if you revoke it with effect for the future, you will only be shown random content on the corresponding banner areas on our services and websites and those of third parties. You can find a list of all “Marketing technologies/cookies” in use here. The use of technically necessary cookies and similar technologies in the “Marketing” category is based on section 25 para. 1 TDDDG. Subsequent data processing is based on your consent in accordance with Art. 6 para. 1 (1 a) GDPR.
When cookies and similar technologies are used to process usage data, the following specific types of personal data are processed, depending on the purpose:
Technically necessary:
- User input to retain data entered across multiple subpages (e.g. selecting your preferred shop in our store finder);
- Authentication data to identify a user after login in order to gain access to authorised content on subsequent visits (e.g. access to the Kaufland customer account);
- Security-relevant events (e.g. detection of multiple failed login attempts);
- Data for the playback of multimedia content (e.g. playback of [product] videos selected by the user).
Statistics: - Pseudonymised user profiles with information about the use of our websites. These include in particular:
- Browser type/version,
- operating system used,
- referrer URL (the previous page visited),
- host name of the accessing computer (IP address),
- time of the server request,
- individual user ID and
- triggered events on the website (surfing behaviour).
- The IP address is regularly anonymised so that it cannot be traced back to you personally.
- We only merge the user ID with other data about you (e.g. name, e-mail address, etc.) with your separate express consent. It is not possible for us to identify you via the user ID alone.
Marketing:
- Pseudonymised user profiles with information about the use of our websites. These include in particular:
- IP address,
- individual user ID,
- potential product interests,
- triggered events on the website (surfing behaviour).
- The IP address is regularly anonymised so that it cannot be traced back to you personally.
- We only merge the user ID with other data about you (e.g. name, e-mail address, etc.) with your separate express consent. It is not possible for us to identify you via the user ID alone.
Recipients/categories of recipients:
As part of data processing using cookies and similar techniques for processing usage data, we may use specialised service providers, in particular from the online marketing sector. They process your data on our behalf as commissioned data processors. Each is carefully selected and contractually bound in accordance with Article 28 GDPR. All companies listed as providers in our cookie notices are, unless they have been named as (joint) controllers in this section, acting as processors for us.
Storage period/criteria for determining the storage period:
The storage period for cookies can be found in our cookie notices.
If a cookie is labelled as “Persistent” in the “Expiry” column, the cookie is stored permanently until the corresponding consent is revoked.
If a cookie is labelled as “Session” in the “Expiry” column, the cookie is stored for the duration of your visit to the site. As soon as you end the session in question or close your browser, the locally stored cookies are deleted.
1.1. Google Marketing Platform/Analytics 360
Our website uses Google Analytics: A web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which uses technology known as “cookies”.
If individual pages of our website are accessed, the following data in particular is stored:
- Two bytes of the IP address of the system with which the user accesses this website
- Information on the operating system of the system used to access this website
- Information about the browser
- The website accessed
- The website from which the user accessed the website (so-called referrer URL)
- The subpages that are accessed from the accessed website
- The time spent on the website
- Date and time of your visit to our website
The information about the use of our website may be sent to a Google server in the USA and stored there. Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for us and providing other services relating to website activity and internet usage. In this regard, we have made a contract with Google for job processing in accordance with Art. 28 GDPR.
If this is required by law or if third parties process this data on behalf of Google, Google will also pass this information on to these third parties. This use is anonymised or pseudonymised. You can find more information about this directly on Google.
Cross-device tracking
If you log in to the third-party provider with your own user data, the individual recognisable features of different browsers and end devices can be linked with each other. If, for example, the third-party provider has created a separate feature each for the laptop, desktop PC or smartphone or tablet you are using, these individual features can be assigned to each other as soon as you use a service of the third-party provider with your login data. In this way, the third-party provider can also target our advertising campaigns across different end devices.
Processing in a third country under data protection law
If the data is processed outside the EU or EEA in this context, please note that there is a risk that authorities may be able to access the data for security and monitoring purposes without you being informed or having the right to appeal. If we use providers in unsafe third countries and you consent, the transfer to a third country is based on Art. 49 para. 1 lit. a GDPR.
You can revoke your consent at any time via the cookie settings.
Data processing is lawful until consent is withdrawn. If you do not want Google Analytics to have any insight into your usage behaviour, as described above, you can integrate a deactivation add-on into your browser. You can find more information about this add-on and how to activate it at: https://tools.google.com/dlpage/gaoptout/.
IV. Embedded YouTube videos
From time to time, video files can be made available for playback in a YouTube frame on some subpages or partially on the main page of kaufland-ecommerce.de. Playing the video means that you access the website www.youtube.de, from Google Inc., via the frame itself. We have no influence on the scope of the data and the handling of your data by Google Inc. that results from accessing the YouTube website. Google Inc. itself is legally responsible for this. Details on how Google handles your data, however, are available at the following link: https://policies.google.com/privacy?hl=en&gl=en
V. Newsletter
1. Description and scope of data processing
Our website offers the possibility to subscribe to our free newsletter. During registration, the data entered in the sign-up screen is transmitted to us.
(1) E-mail address
(2) where identifiable, the campaign from which the user has reached the called website
(3) Date and time of registration
If you register for our free newsletter on our website, we will regularly notify you via e-mail about current e-commerce topics, campaigns, etc. To process your registration, we require your e-mail address.
After you submit the registration form, you will receive a confirmation e-mail from us (double opt-in). Your registration will not become effective until you have clicked on the link in this e-mail. If you do not confirm your registration, your data will be erased. You can unsubscribe from our newsletter at any time. To do so, please use the unsubscribe link that is provided with every e-mail.
2. Legal basis for data processing
The legal basis for data processing under user consent following newsletter registration by the user is Art. 6 Para. 1 lit. a) GDPR.
3. Purpose of data processing
Collection of the user’s e-mail address is for the purpose of delivering the newsletter. The collection of any other personal data during the registration process serves to prevent misuse of the services or the provided e-mail address.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Accordingly, the user’s e-mail address is stored for at least as long as their newsletter subscription is active. Afterwards, the addresses remain in the newsletter database for a period of 30 days before being deleted in order to prevent misuse of discount offers through repeated subscription and unsubscription to the newsletter.
5. Possibility of objection and removal
The newsletter subscription may be cancelled by the registered user at any time. Please use the link provided with every e-mail to unsubscribe from the newsletter completely. This also enables revocation of consent to the storage of the personal data collected during the registration process.
VI. Use of the comment function
1. Description and scope of data processing
Insofar as you make use of the option to comment posts on our site, we will store the name and e-mail address you provide to us for this purpose by entering this information in the respective screen. This information will be stored in compliance with applicable data protection laws and serves, in particular, to facilitate the provision of services or contact in cases of misuse.
2. Legal basis for data processing
The legal basis for processing personal data through the use of cookies is Art. 6 Para. 1 lit. f) GDPR.
3. Purpose of data processing
The collection of personal data serves to prevent misuse of the services or the provided e-mail address.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected.
5. Possibility of objection and removal
You are free to object to the storage of this data, in particular via e-mail to datenschutz@kaufland-online.de.
VII. Use of the application tool
1. Scope of the processing of personal data
Finally, you can also use our website to apply for employment at our company. Here we collect the following data through the “Apply” screen:
(1) First name
(2) Last name
(3) E-mail address
(4) CV (if uploaded)
(5) Salary expectations
This information is then considered during the application process.
2. Legal basis for data processing
The legal basis for data processing under user consent following activation of the button by the user is Art. 6 Para. 1 lit. a) GDPR.
3. Purpose of data processing
The collection of this data serves to process the respective user’s application during the application process.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected.
5. Possibility of objection and removal
You can object to the further processing of your data at any time. To do so, simply write to us at jobs@kaufland-ecom.com
VIII. Misuse of our website
1. Description and scope of data processing
Insofar as it serves to clarify misuse of our platform, is necessary for prosecution or required to fulfil our statutory obligation to disclosure, personal data will be forwarded to the proper authorities – in particular law enforcement agencies and tax authorities – to our legal counsel or to injured third parties. Forwarding of personal data may also occur where this serves the enforcement of our General Terms and Conditions or other agreements or is required by a legal or other official regulation or a court order.
2. Legal basis for data processing
The legal basis for processing is Art. 6 Para. 1 lit. f) GDPR.
3. Purpose of data processing
This data processing is absolutely necessary to ensure the security of our IT systems and processes and to comply with legal and official requirements. For these purposes, our legitimate interest is grounded in data processing in accordance with Art. 6 Para. 1 lit. f) GDPR.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected.
5. Possibility of objection and removal
The processing of data in cases of misuse is absolutely necessary to prevent the misuse of the services provided or the impairment of our rights of those of third parties. There is therefore no possibility of rejection on the part of the user.
C. Rights for Data Subjects
If we process your personal data, then you are a Data Subject according to the GDPR, and you are fundamentally entitled to the following rights insofar as no exceptions apply:
1. Right to information
You, as a Data Subject, have the right to demand confirmation from the Data Controller regarding whether personal data about you is being processed; if this is the case, you have the right to information on this personal data as well as to the information listed individually in Art. 15 GDPR.
2. Right to rectification
Furthermore, you are also entitled to the right to demand the Data Controller to rectify incorrect information about you without delay or to complete incomplete personal data (Art. 16 GDPR).
3. Right to restriction of processing
Data subjects are further entitled to the right to demand the Data Controller to restrict processing for the duration of investigation by the Data Controller if one of the conditions listed in Art. 18 GDPR applies, such as when the Data Subject has lodged objection to data processing.
4. Right to erasure
Finally, as a Data Subject you have the right to demand the data controller to erase the personal information about you without delay if one of the reasons listed in detail in Art. 17 GDPR applies, such as when the data is no longer needed for the purposes of collection (right to erasure).
5. Right to notification
If you have asserted your right to the rectification, erasure or restriction of processing by the Data Controller, then the Data Controller is obligated to notify all recipients to whom it has disclosed your personal data regarding this rectification or erasure of the data or restriction of its processing except in cases where this proves impossible or involves disproportionate effort.
You have the right to be informed of these recipients by the Controller.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the Data Controller in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this data to another Controller without hindrance from Data Controller you have provided this data to, insofar as:
(1) Processing is based on consent in accordance with Art. 6 Para. 1 lit. a) GDPR or Art. 9 Para. 2 lit. a) GDPR or on a contractual agreement in accordance with Art. 6 Para. 1 lit. b) GDPR, and
(2) the processing is carried out by automated means
In exercising your right, you further have the right to have the personal data transmitted directly from one Data Controller to another as long as this is technically feasible. The rights and freedoms of others shall not be adversely affected thereby.
The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.
7. Right to object
You have the right to object to the processing of your personal data on the basis of Art. 6 Para. 1 lit. e) or f) GDPR for reasons arising from your particular situation at any time; this also applies to profiling based on these provisions.
In such cases, the Data Controller will no longer process the personal data unless they demonstrate compelling legitimate reasons for the processing that override your interests, rights and freedoms as a Data Subject, or for the establishment, exercise or defence of legal claims.
When your personal data is processed for direct marketing purposes, you have the right to object to the processing of your personal data for this form of marketing at any time, which includes profiling related to direct marketing.
If you object to data processing for direct marketing purposes, then your personal data will no longer be processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
8. Right to revoke declaration of consent under data protection law
You have the right to revoke your declaration of consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of processing that is based on consent granted prior to this withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal consequences for you or significantly affects you in a similar way. This does not apply when the decision
(1) is necessary for entering into, or performing, a contract between you and the Data Controller,
(2) is authorised by Union or Member State law to which the Data Controller is subject to and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
(3) is based on your explicit consent.
These decisions, however, shall not be based on the special categories of personal data referred to in Art. 9 Para. 1 GDPR unless Art. 9 Para. 2 lit. a) or g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in nos. (1) and (3) above, the Data Controller must implement suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests – at least the right to obtain human intervention on the part of the Controller, to express their point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, every Data Subject has the right to lodge a complaint with a supervisory authority if the Data Subject considers that the processing their personal data infringes Art. 77 GDPR. The Data Subject is free to exercise this right in the Member State of their habitual residence, place of work or place of the alleged infringement. The supervisory authority for (name of state) is:
State Commissioner for Data Protection and Freedom of Information
Baden-Württemberg
Adress: Lautenschlagerstraße 20, 70173 Stuttgart
Postal adress: Postfach 10 29 32, 70025 Stuttgart
Contact:
Phone: 0711/61 55 41 – 0
Fax: 0711/61 55 41 – 15
E-Mail: poststelle@lfdi.bwl.de
For any other questions, please feel free to contact our Data Protection Officer.