Under the heading "Controller", we provide you with initial information about the controller, the data protection officer and any contact options. Under "General information on using the Online Marketplace Websites/app area", we then provide you with generally applicable information. Under the headings "Further information for customers" and "Further information for sellers", we provide you with information specific to the respective user group.
Should you have any further questions about how your personal data is collected, processed and used or any specific processes, we or our data protection officer will be happy to respond to them via the contact options set out below.
In the event of any significant changes to the privacy policy, the marketplace operator will notify users via e-mail.
A. Controller
I. Name and address of the controller
In the interests of transparency, we would first like to point out that the entire marketplace business of real GmbH was transferred to Kaufland e-commerce GmbH with effect as of September 29, 2020 pursuant to a spin-off and contribution agreement.
The "controller" within the meaning of the GDPR and other national data protection laws of the member states and any other data protection law provisions is:
Kaufland e-commerce GmbH
registered office: Stiftsbergstraße 1,
74172 Neckarsulm, Germany
HRB no.: HR B 774318, Local Court (Amtsgericht) of Stuttgart
II. Contact details and address of our data protection department
Should you have any questions relating to the processing of your personal data, you can contact us at the following addresses:
Contact details
By e-mail:
datenschutz@kaufland-online.com
By mail:
Kaufland e-commerce GmbH
Data protection officer
Marketplace postal address:
Marktplatz, c/o Kaufland e-commerce Services GmbH & Co. KG
Habsburgerring 2
50674 Cologne, Germany
III. Contact details and address of the data protection officer
datenschutz süd GmbH
Dr. Christian Borchers
Wörthstraße 15
97082 Würzburg, Germany
office@datenschutz-sued.de
B. General information on using the Online Marketplace Websites/app area
We collect and use personal data of our users primarily for the specific purpose for which the data was provided to us, i.e., specifically for providing the contractual services, processing your order, sending newsletters or coupons subscribed/ordered by you, for notifications in connection with prize draws, or where this is necessary in order to provide functional websites as well as our content and services.
Information on the specific processes:
I. Provision of the Online Marketplace Websites/App area and creation of log files
1. Description and scope of data processing
Each time you access our website, our system automatically collects data and information from the computer system of the requesting computer. The following data is collected in this process, insofar as it is transmitted due to your browser settings:
- information on the browser type and version used
- the user's operating system
- the user's IP address
- date and time of access
- the last web page from which the user's system accessed our website
- country and location of access
The data is stored in our system's log files for a short time. It is not stored together with other personal data of the user.
2. Legal basis for the data processing
The legal basis for storing the data and the log files is Article 6(1)(f) GDPR.
3. Purpose of the data processing
The temporary storage of the IP address by the system is necessary to allow for delivery of the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session. Log files are stored in order to ensure the functionality of the Online Marketplace Websites. We also use the data to optimize the Online Marketplace Websites and ensure the security of our IT systems. These purposes constitute our legitimate interest in the data processing under Article 6(1)(f) GDPR.
4. Recipients/categories of recipient
The data can generally only be accessed by the departments within the Kaufland Group charged with managing the Online Marketplace Websites. No data will be transferred to third parties outside the Kaufland Group.
5. Duration of storage
The log files are stored in the active systems for 14 days and thereafter archived. Archive log files are stored for two years because they may be required for analytical purposes in order to effectively combat cyber crime.
6. Right to object and removal
Collecting the data for the provision of the website and storing the data in log files is required in order to operate the website. Provided the requirements of Article 21 GDPR are met, you have the right to object to this data processing. However, in addition to objecting to the processing, you must demonstrate grounds relating to your particular situation, because the processing of the data is necessary for the site's operation.
II. Use of cookies in general
We, Kaufland e-commerce GmbH, are also the controller with respect to data processing in connection with the use of "cookies" and other similar technologies to process usage data on the Online Marketplace Websites.
Cookies are small text files that are created automatically by your browser and stored on your end device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not cause any harm to your end device, nor do they contain any viruses, trojans or other malware. The cookie merely stores certain information that results in connection with the specific end device deployed. This does not, however, mean that we will immediately become aware of your identity.
Cookies and the other technologies used to process usage data are deployed for the following purposes, depending on the categories of cookie/other technologies:
Technically necessary: These are cookies and similar technologies that are necessary for you to use our services (for example to correctly display our website/the functions you request, to record you signing in or to fill your shopping cart when making online purchases, etc.).
Preferences: Using these methods, we can take into account your actual or perceived preferences to enhance the user experience. For example, we can use your settings to display the items most recently viewed on our websites.
Statistics: These methods enable us to tailor the design of our services by producing pseudonymized statistics about how they are used. For example, we can use them to determine how better to adapt our websites to user habits.
Marketing: These enable us to display relevant advertising content based on an analysis of your pseudonymized usage behavior. Your usage behavior can also be tracked over various websites, browsers or devices via a user ID (unique identifier). Your consent to the collection of the pseudonymized user profile and its disclosure for marketing purposes together with the pseudonymized user ID enables relevant advertising content to be displayed to you on other Kaufland websites and services and, where applicable, other third-party channels, that corresponds to your presumed interests based on your user profile. We also analyze your use of our Kaufland websites (e.g., advertising banners viewed or clicked), firstly to optimize our advertising and offers for you and other customers, and secondly to provide our advertising partners pseudonymized data for billing purposes and to optimize their marketing campaigns. Our advertising partners cannot use this information to identify you. If you do not give your consent or if you withdraw your consent with effect for the future, you will only be displayed random content on the respective web banners on our services and websites and those of third parties.
Advertising using the IAB TCF: For some advertising, we use a specific standard for obtaining and implementing consent in connection with i.e. personalised advertising, called the Transparency and Consent Framework ("TCF") of the Interactive Advertising Bureau Europe (“IAB”) (see below for more information).
Most browsers have functions which allow users to opt out of cookies generally or to delete cookies accepted by a website after the end of the session. The "help" function in the menu bar of most web browsers explains how to set your browser to reject new cookies, alert you when you receive a new cookie, or even how to delete all cookies you have already received and block your browser from receiving any more. On the other hand, under VII. Right to object and removal, you may withdraw your consent with respect to the use of technically unnecessary cookies on our website. This will delete all cookies that were set for the respective domain of the Online Marketplace Websites and are technically unnecessary.
III. Use of technically necessary cookies in connection with operating the Online Marketplace
1. Description and scope of data processing
1a. Order processing and account services
We use technically necessary cookies to, for example, save your shopping carts or wish lists in order to make it easier for you to place an order next time. Once you have completed your order, and you visit our website the next time, you will be recognized as a customer with the help of a corresponding cookie, which will make it easier for you to place new orders.
For example, the following data is stored in and transmitted via cookies:
- language settings
- items in a shopping cart
- login details
1b. Performance metrics and A/B testing
We also use technically necessary cookies for performance metrics and A/B testing. We use the following technologies for this purpose:
Lux by Speedcurve
We use LUX technology by SpeedCurve to obtain anonymized metrics of the load times of our web pages. This is necessary to ensure proper performance.
For details, see https://support.speedcurve.com/en/articles/2044623-data-protection-gdpr-compliance-at-speedcurve.
Optimizely Full Stack
We also use Optimizely technology in two different ways:
On the one hand, we use the tool to quickly switch on and off or control essential functionalities of the websites ("feature flagging"), such as the display of product descriptions or the display of contact options. We classify the use of Optimizely in the context of the feature flagging as "technically necessary", because it controls essential functionalities of our websites and is the only way we can ensure their stable functionality.
We also use the tool to run and track A/B tests. A/B tests are tests in which certain page features are made visible to only a portion of our users. Certain performance metrics are then measured over the runtime of the A/B test by assigning a user to group A (has not seen feature) or group B (has seen feature). Usage behavior will only be measured by data transfer to Optimizely if a user has consented to "statistics" cookies. The information generated about your use of our website is transmitted to one of Optimizely's servers in the U.S. and stored there. Optimizely will use this information for the purpose of evaluating your use of our website in order to compile reports on website activity for us. To the extent prescribed by law or where third parties process such data on behalf of Optimizely, this information will also be disclosed to those third parties.
The data is used in anonymized form and only in the event that you have been randomly categorized into a tester group, in which case the following data will be stored in particular:
- browser information
- the accessed website (only where a test is being conducted there or target achievement is being measured)
- date, time and duration of the visit to our website
For details, see Optimizely.
2. Legal basis for the data processing
The legal basis for using technically necessary cookies and similar technologies is your consent given pursuant to section 25 (2) no. 2 of the German Telecommunications and Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz – TTDSG).
With respect to section 1a), the data is processed on the basis of Article 6(1)(b) GDPR. With respect to section 1b), the data is processed on the basis of Article 6(1)(f) GDPR.
The legal basis for using cookies and similar technologies associated with A/B tests and processing the data is your consent given pursuant to section 25 (1) TTDSG and Article 6(1)(a) GDPR.
3. Purpose of the data processing
The purpose of using technically necessary cookies is to make websites more user-friendly and consistently maintain their utility. Some functions of our website cannot be offered without the use of cookies because they require that the browser be recognized even after a page change.
These purposes also constitute our legitimate interest in processing the personal data under Article 6(1)(f) GDPR.
4. Recipients/categories of recipient
Insofar as the above-listed service providers are given access to personal data for support purposes, data processing agreements in accordance with Article 28 GDPR have been entered into with them.
5. Duration of storage, right to object and removal
The data will be deleted as soon as it is no longer required for our record-keeping purposes.
6. Right to object and removal
The use of technically necessary cookies is required in order to operate the website. Insofar as the legal basis for the processing is Article 6(1)(f) GDPR and provided the requirements of Article 21 GDPR are met, you have the right to object to this data processing. However, in addition to objecting to the processing, you must demonstrate grounds relating to your particular situation, because the processing of the data is necessary for the site's operation.
IV. Use of cookies to take into account your actual or perceived preferences (preferences)
1. Description and scope of data processing
As described above, cookies are used at this point on our website to enable the convenient use of our websites based on your actual or perceived preferences. To do this, we use settings you choose or information about your interactions to customize the user interface (e.g., to show you your most recently viewed products or make suggestions based on your preferences as determined by us). This data is not linked to a permanent identifier.
2. Legal basis for the processing of personal data
The legal basis for using cookies and similar technologies associated with A/B tests and processing the data is your consent given pursuant to section 25 (1) TTDSG and Article 6(1)(a) GDPR.
3. Purpose of the data processing
Processing users' personal data allows us to optimize our website and customize it so that you receive the offers that are relevant to you.
4. Recipients/categories of recipient
The data can generally only be accessed by the departments within the Kaufland Group charged with managing the Online Marketplace Websites. Insofar as service providers are given access to personal data, data processing agreements in accordance with Article 28 GDPR have been entered into with them.
5. Duration of storage
The data will be deleted as soon as it is no longer required for our record-keeping purposes.
6. Right to object and removal
Please refer to the information under VII. Right to object and removal.
V. Use of cookies for statistical web analytics on the Online Marketplace
1. Description and scope of the processing of personal data
We use various analytical tools on our website , which, among other things, provide information about the web browsing behavior of our users.
Specifically:
1a. Google Marketing Platform/Analytics 360
Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which uses "cookies".
The following data is stored in particular whenever individual pages on our website are accessed:
- two bytes of the IP address of the user's accessing system
- information on the accessing system's operating system
- browser information
- the website accessed
- the website from which the user reached the website accessed (referrer URL)
- the sub-pages accessed from the website accessed
- the time spent on the website
- the date and time of your visit to our website
The information about your use of our website may be transmitted to one of Google's servers in the U.S. and stored there. Google will use this information for the purpose of evaluating your use of our website in order to compile reports on website activity for us and to provide other services relating to the use of the website and the Internet. We have entered into an agreement with Google in this regard to process data on our behalf pursuant to Article 28 GDPR.
To the extent prescribed by law or where third parties process such data on behalf of Google, Google will transfer it to those third parties as well. The data in this case will be used in anonymized or pseudonymized form. For details, see Google.
Cross Device Tracking
If you log in to a third party provider with your own user data, the respective recognition attributes of different browsers and terminal devices can be linked. So if, for example, the third party provider has created a separate attribute for each laptop, desktop PC, or smartphone or tablet you use, these individual attributes can be assigned to each other as soon as you use your login data to access a third party provider's service. This way, the third party provider can precisely manage our advertising campaigns even across multiple terminal devices.
Processing in a third country under data protection law
If the data is processed outside the EU or EEA in this context, please note that there is a risk that authorities may be able to access the data for security and monitoring purposes without you being informed of this or having any legal recourse. Insofar as we use providers in unsafe third countries and you give your consent thereto, the legal basis for the transfer of data to a third country is Article 49(1)(a) GDPR.
You may withdraw your consent to the processing at any time (see information in section 5). The data processing will be lawful until such time as consent is withdrawn. If you do not want Google Analytics to have access to your usage behavior as just described, you can install an opt-out add-on for your browser. For details on this add-on and how to enable it, see: https://tools.google.com/dlpage/gaoptout/.
Google consent mode (behavioral modeling):
As your privacy is very important to us, you have the option to decline statistics cookies. In order to be able to determine the utilization of our website even in these cases, Google Consent Mode employs behavioral modeling estimates. These are used to estimate the behavior of users on our websites who decline cookies. For this purpose, information (the page the user is on, device type, browser, time) is collected so that a suitable behavioral modeling estimate can be used. The IP address is replaced entirely by a general IP address of a kaufland.de server. This way, the user's IP address is not visible for Google and the information cannot be used to directly identify and recognize the user.
1b. Google Optimize
We use Google Optimize to test different variants of our website using so-called A/B tests in order to determine which variant performs best. Google Optimize analyzes the usage of different website variants which allows us to adjust the user experience to match the behavior of the website users. Google Optimize is a tool integrated in Google Analytics and uses cookies.
1c. ContentSquare
Our website also uses ContentSquare, a web analytics service provided by Content Square S.A.S, which uses "cookies".
The following data is stored in particular whenever individual pages on our website are accessed:
- two bytes of the IP address of the user's accessing system
- information on the accessing system's operating system
- the website accessed
- the website from which the user reached the website accessed (referrer URL)
- the sub-pages accessed from the website accessed
- the time spent on the website
- the date and time of your visit to our website
- information on interactions with web page elements (clicks, mouse position, scroll, hover, blur, focus, anonymized HTML content)
- product-related transaction data
ContentSquare will use this information for the purpose of evaluating your use of our website in order to compile reports on website activity for the website operators and to provide other services relating to the use of the website and the Internet. The data in this case will be used in pseudonymized form.
If you do not want ContentSquare to have access to your usage behavior as just described, you can install an opt-out add-on for your browser. Otherwise please refer to the information on your right to object and removal provided below.
2. Legal basis for the processing of personal data
The legal basis for using statistics cookies and similar technologies involving the various providers of web analytics services is your consent given pursuant to section 25 (1) TTDSG and Article 6(1)(a) GDPR.
The legal basis for processing the data collected as part of the Google Consent Mode is Article 6(1)(f) GDPR.
3. Purpose of the data processing
Processing users' personal data allows us to analyze the web browsing behavior of our users. By analyzing the data, we can compile information on the use of the individual website elements in aggregated form and ensure and continuously optimize the user-friendliness and utility of the website.
We use Google Consent Mode so that we can track how many users visit our website, which parts of our website they visit and how often. This allows us to avoid user-unfriendly experiences and optimize the use of our website.
4. Recipients/categories of recipient
Insofar as the above-listed service providers are given access to personal data, data processing agreements in accordance with Article 28 GDPR have been entered into with them.
5. Duration of storage
The data will be deleted as soon as it is no longer required for our record-keeping purposes.
6. Right of withdrawal, right to object and removal
Please refer to the information under VII. Right to object and removal.
VI. Use of marketing cookies on the Online Marketplace
1. Description and scope of the processing of personal data
We work with various targeting service providers for advertising and marketing purposes. For this purpose, we store cookies on our server which allow us to analyze the use of our website by you and others (see information above). These cookies are used to record information about the use of our website, which is then transmitted to one of the servers operated by our service providers and stored there.
1a. Google Remarketing
We also use the remarketing technology offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With this technology, users who had previously visited our websites and online services and were interested in the services offered are re-targeted by interest-based ads on the pages of the Google Partner Network. Ads are displayed by deploying cookies. Specifically, they are used to analyze users' behavior when they visit the website and then place targeted product recommendations and interest-based ads.
You can opt out of Google's interest-based advertising cookies by going to the page https://adssettings.google.de/ or users can opt out of third-party cookies by going to the URL https://optout.networkadvertising.org/. By using our services, you consent to the processing of data about you collected by Google as described herein and for the purpose set out above. Please be advised that Google has its own privacy policies which are independent of ours. We assume no responsibility or liability for such policies and procedures. Before you use our website, please read the information at http://www.google.de/intl/de/policies/privacy/.
1b. Google Marketing Platform/Display & Video 360 and Campaign Manager
With the Google DoubleClick tool, we use a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to display ads of relevance to you. Cookies are used for this purpose, which do not contain any personal data. The DoubleClick cookies use a pseudonymized ID number assigned to your browser, which is used to verify the display and viewing of ads. This allows Google and its partner sites to place ads based on previous visits to the Online Marketplace or other websites. The information that these DoubleClick cookies generate is transmitted by Google to a server in the U.S. and stored there. Data will only be transferred to third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement. By using the Online Marketplace Websites, you consent to Google using the aforementioned data and processing it as described above. You may configure your browser settings to disable cookies. However, please be advised that in such a case you may not be able to use all the functions of our website and pages may not be displayed properly. If you do not want to disable cookies generally but do not want DoubleClick cookies to be used, you can go to Google and download and install the browser plugin to opt out of Google’s DoubleClick service.
1c. Facebook Custom Audiences
As part of our interest-based online advertising, we also use communication tools offered by the social media network Facebook, in particular the product "Website Custom Audiences". Basically, a non-reversible and non-personal code (hash) is generated from your usage data, which can be transmitted to Facebook for analysis and marketing purposes. For Website Custom Audiences, the Facebook cookie is deployed for this process. Further information on the purpose and scope of data collection and further processing and use of the data by Meta Platforms Inc-and your options to protect your privacy is available in Facebook's privacy policy at https://www.facebook.com/policy.php. If you want to opt out of Facebook Website Custom Audiences, you can do so at https://www.facebook.com/.
1d. Google Ads
As an AdWords customer, we also use Google Conversion Tracking, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you are redirected to our websites via a Google ad, Google AdWords places a cookie on your computer. These cookies cannot be used to identify you and expire after 30 days. If you visit our site within the 30-day period and the cookie has not yet expired, we and Google can recognize that someone clicked on the ad and was redirected to our site. Each AdWords customer receives a different cookie. This means that cookies cannot be tracked via the websites of AdWords customers. The information obtained from the conversion cookie allows conversion statistics to be created for AdWords customers who have opted for conversion tracking. AdWords customers thereby receive information about the total number of users who clicked on their ad and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that could personally identify users.
You may configure your browser settings to disable the automatic acceptance of cookies if you do not wish to participate in conversion tracking. You may also disable cookies for conversion tracking by configuring your browser so that cookies from the domain googleleadservices.com are blocked.
Google Consent Mode (Conversion Modeling):
As your privacy is very important to us, you have the option to decline marketing cookies. In order to be able to determine the impact of our marketing efforts even in these cases, Google Consent Mode employs behavioral modeling estimates. These are used to estimate the behavior of users on our websites who decline cookies. For this purpose, information (the page the user is on, device type, browser, time and an anonymized IP address) is collected so that a suitable behavioral modeling estimate can be used. The IP address is replaced entirely by a general IP address of an Online Marketplace server. This way, the user's IP address is not visible for Google and the information cannot be used to directly identify and recognize the user. We do not store any data of yours in the context of using Google Consent Mode. The recipient of the anonymized data is Google. No personal data of yours is disclosed in the process.
1e. Google AdSense
We also use Google AdSense, a web advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to place ads (text ads, banners, etc.). In this case, your browser may store a cookie sent by Google or third parties. The information stored in the cookie may be recorded, collected and analyzed by Google or third parties. Google AdSense also uses "web beacons" (small invisible images) to gather information. Through the use of web beacons, simple actions such as the visitor traffic to the website can be recorded, collected and analyzed. The information generated by the cookie and/or web beacon information will be transferred to a Google server in the U.S. and stored there. Google will use this information to evaluate your use of the site with respect to AdSense ads. Google may transfer this information to third parties if this is prescribed by law or if third parties are processing this data on Google's behalf. Google will not associate your computer's IP address with any other data stored by Google. Here, too, you can prevent cookies from being stored on your hard drive and the display of web beacons. As already described for the other cookies, you must disable the acceptance of cookies in your browser settings.
By using our services, you consent to the processing of data about you collected by Google as described herein and for the purpose set out above. Please be advised that Google has its own privacy policies which are independent of ours. We assume no responsibility or liability for such policies and procedures. Before you use our website, please read the information at http://www.google.de/intl/de/policies/privacy/.
1f. Microsoft Bing Ads
Finally, we use Microsoft Bing Ads. When you are redirected to our websites after clicking on a Microsoft Bing Ad, a cookie is placed on your computer. This allows Microsoft Bing and us to recognize that a user has clicked on an ad, was redirected to our websites and has reached a "conversion site". This only serves to provide us with information on the total number of users who have clicked on a Bing Ad and were then redirected to the conversion site. No personal information on the user's identity is communicated. If you do not wish to participate in tracking, you may also reject the cookie required for this, for example via browser settings that generally disable the automatic acceptance of cookies. For more information on data privacy and cookies used by Microsoft Bing, see: https://privacy.microsoft.com/de-de/privacystatement.
1g. Shopping24
The websites use recomAD, a tool for providing product recommendations offered by shopping24 Gesellschaft für multimediale Anwendungen mbH, Poßmoorweg 2, 22301 Hamburg, Germany. recomAD matches user search requests with suitable product recommendations and displays these to the user.
With each product click, recomAD places cookies which enable recomAD to detect natural clicks.
Whenever a product recommendation is clicked on, recomAD collects and stores data such as the IP address, browser type and the site visited. This data is collected and stored solely for billing-related purposes by detecting non-natural clicks. No data is stored in the cookie that would permit the user to be identified. For more information on data privacy and the cookies used, see Shopping24's website at: https://www.s24.com/datenschutzerklaerung/.
2. Legal basis for the processing of personal data
The legal basis for using marketing cookies and similar technologies involving the various providers of web analytics services and processing the data is your consent given pursuant to section 25 (1) TTDSG and Article 6(1)(a) GDPR.
The legal basis for processing the data collected as part of the Google Consent Mode is Article 6(1)(f) GDPR.
3. Purpose of the data processing
Processing users' personal data allows us to optimize our online marketing and customize it so that you receive the offers that are relevant to you. These services also help finance the website.
We use Google Consent Mode so that we can track the impact of our online marketing efforts and whether they were useful for us as well as for you as a customer.
4. Recipients/categories of recipients
Insofar as the above-listed service providers are given access to personal data, data processing agreements in accordance with Article 28 GDPR have been entered into with them.
5. Duration of storage
The data will be deleted as soon as it is no longer required for our record-keeping purposes.
6. Right to object and removal
Please refer to the information under VIII. Right to object and removal.
VII. Use of cookies for advertising using the IAB TCF
1. Description and scope of the processing of personal data
We cooperate with Virtual Minds GmbH (Ellen-Gottlieb-Straße 16, D-79106 Freiburg im Breisgau, Germany) for the display of personalised advertising outside Kaufland Online Marketplace (accessible via www.kaufland.de), as mutually responsible within the meaning of Art. 26 DSGVO. We use the so-called Transparency and Consent Framework ("TCF") of the Interactive Advertising Bureau Europe ("IAB"), a standard for obtaining and implementing consent declarations in connection with personalised advertising, for example.
With your consent, cookies will be stored on your end device (and read from it), by means of which the data specified in more detail below will be collected and then processed for the purposes stated below.
You can contact either us or Virtual Minds GmbH when exercising your data subject rights described below with regard to the data processing described in this paragraph. In the Virtual Minds GmbH Data Privacy Statement, you will also find further information on how you can exercise your data subject rights directly towards Virtual Minds GmbH.
Advertising using the IAB TCF includes the display of advertising on third-party digital media (i.e. outside the scope of our website), such as other websites, apps, smart TVs, etc. (“third-party media”). If you have consented to this, we may store cookies on your device that enable these third-party media to recognise your browser.
Depending on the specific scope of your consent, the following types of personal data may be processed (for details, please see the buttons of the specific purposes within the consent):
- Data about your use of our website and third-party media, e.g.
-
- content from websites,
- click paths,
- display of and interactions with advertisements
- Your IP address
- The TC string generated for you (a coded string containing information about the granting and scope of your consent)
- Your location data
- Data about the end devices you use
- Products you placed in a shopping cart in our online marketplace and whether you purchased them
- If a member of your household has also given their consent to this, we will also link your data with that of the member of your household, particularly with data about the end devices they use
- Attributes derived from this (e.g. age group, product interest);
2. Legal basis for the processing of personal data
The legal basis for the use of cookies and similar technologies for advertising using the IAB TCF as well as the related data processing is your consent, pursuant to Section 25 (1) TTDSG and Article 6 (1) a) DSGVO.
3. Purpose of the data processing
With your consent, we may, together with Virtual Minds GmbH, create an individual profile about you and/or target groups into which we categorise you (so-called ‘segments’) in order to enable third parties to play personalised advertising on third-party media via the end devices assigned to you and your household members.
Along with the display of the advertising and with your consent, processing is carried out for ad measurement (in particular to determine the performance and success of an advertisement), to gain knowledge about target groups (in particular to learn more about the target groups to which the advertising is displayed), for product development and for the technical safeguarding and optimisation of these advertising displays. If a member of your household has also provided their consent, we will also link your data to that of your household member and process it with their consent for the stated purposes or process your data for the purposes requested by the household member. The individual purposes and functions and the processing operations assigned to the data are specified in more detail in the consent
4. Recipients/categories of recipients
As already described, we are jointly responsible with Virtual Minds GmbH for the data processing described here. We will be happy to provide you with the fundamental content of the underlying agreement upon request – use the options provided under “Contact details”.
We work together with other advertising partners to display the advertising. These partners are only involved in the processing in connection with the display of the advertisements on the third-party media and the related (technical) functions, not in the creation and analysis of your advertising profile as presented in the context of the consent. We only pass on to these advertising partners key figures that only we can assign to a specific usage behaviour – divided into specific customer or usage categories (segments). Information about your individual usage behaviour will not be passed on to advertising partners under any circumstances. Our advertising partners are as follows: The UK Trade Desk Ltd., c/o The Trade Desk, Inc., 42 N. Chestnut Street, Ventura, CA 93001, USA; regarding the Active Agent service: Virtual Minds GmbH, Ellen-Gottlieb-Straße 16, D-79106 Freiburg im Breisgau, Germany; Xandr Inc., 28W. 23rd Street 4th Floor, New York, NY, 10010, USA; Trakken GmbH, Zirkusweg 1, 20359 Hamburg, Germany and Adform A/S, Silkegade 3B, ST &1, 1113 Copenhagen, Denmark DK26434815.
In addition, other contract processors are also involved in the display of advertising, who support us in particular in the planning, control and processing of the respective advertising campaign.
Provided that these advertising partners or other processors receive access to personal data, processing contracts have been concluded with these service providers in accordance with Art. 28 DSGVO.
5. Duration of the storage
The data will be deleted as soon as it is no longer required for the aforementioned purposes. More detailed information about the respective cookie is available below under the “Expiry” column. If “persistent” is entered in the “Expiry” column, the cookie is stored permanently until the corresponding consent is revoked.
6. Possibility of revocation and removal
In this regard, reference is made to the statements under VIII. Right to object and removal.
VIII. Right to object and removal
You may withdraw your consent to the processing at any time. The data processing will be lawful until such time as consent is withdrawn.
If you wish to exercise your right of withdrawal, click on the following link to withdraw your consent to the use of cookies on our website. This will delete all cookies that were set for the domain www.kaufland.de and are technically unnecessary.
IX. Promotional newsletters by e-mail & direct advertising
1. Description and scope of data processing
1.1 Standard newsletter
Our website offers an option to subscribe for a free newsletter. When you sign up for the newsletter, the data from the input screen is transmitted to us. The following data is processed and constitutes required information:
Verarbeitet werden als Pflichtangaben folgende Daten:
- e-mail address
- Date and time of signing up for the newsletter
- Website through which you signed up
- Type of page through which you signed up
If you sign up for the newsletter, you consent to us sending regular you e-mails at the e-mail address you provided with information about current offers, products, special promotions, satisfaction surveys relating to products, services, events and prize draws of the Kaufland Group.
The process will be as follows: First of all, we will send an e-mail to the e-mail address provided containing a link for verifying your e-mail address (double opt-in process). If you do not confirm registration, your data will be deleted after seven days. If you click on the link to verify your e-mail address, we will store this confirmation of your e-mail address in a log file as evidence of your consent. Only then do we process your e-mail address for the purpose of sending the newsletter you signed up for until you withdraw your consent. If you open our e-mail newsletter, click on embedded links or send a website form after clicking on a link, this is recorded, but is not stored in a manner that allows you to be identified personally. This data is anonymous and can only be evaluated in the form of aggregated statistics. We therefore do not create a personal profile about your newsletter reading habits without your express additional consent.
1.2 Consent to newsletter customization
If you additionally consent to the customization of the newsletter you have subscribed for (optional), you consent to us:
- linking the newsletter to your existing Kaufland customer account in order to tailor the content of the newsletter to your presumed interests and shopping preferences based on both past and future transaction data and transaction-related data in your customer account (this includes products purchased, returns, support tickets, ratings, value of goods in shopping cart, purchase frequency, delivery address, name, gender, birthday); and
- provided you separately accept advertising cookies on our websites, also evaluating your click and browsing habits on websites of the Online Marketplace and in the app (this includes clicks on products, search terms, referrer sites (websites through which users are directed to the current site), viewed products, add to cart events, products added to wish list, group for A/B testing, information about the device used, device manufacturer, operating system, browser, IP address and localization data derived from that) so as to also use this information to tailor the content of the newsletter to your presumed interests and shopping preferences.
1.3 Direct advertising
If you have made a purchase through the Online Marketplace, we will also use the e-mail address you provide in connection with the purchase to send you service information such as customer satisfaction surveys and e-mails to advertise our own similar products or services. In such case, only direct advertising for similar products or services will be sent.
2. Legal basis for the data processing
After you sign up for the newsletter, the legal basis for processing this data is the consent of the subscriber referred to in Article 6(1)(a) GDPR. Article 6(1)(a) GDPR is also the legal basis for the processing in connection with customizing the newsletter.
The provision of data is voluntary. If you do not provide your data, you will not be able to receive the newsletter or a customized newsletter based on separate consent.
The legal basis for direct advertising for similar goods and services following the sale of goods or services is Article 6(1) sentence 1 (f) GDPR in conjunction with section 7 (3) of the German Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG).
3. Purpose of the data processing
Processing users' personal data allow us to keep users informed about current offers and to advertise them.
4. Recipients/categories of recipient
The data is processed within the Kaufland Group by Kaufland e-commerce GmbH. We use the system of our processor (Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany), to send the newsletter. It receives and processes the data on our behalf on the basis of Article 28 DSGVO in order to send the e-mails. Furthermore, we use the system of our processor (Heureka Group a.s. Karolinská 706/3, Karlín, 186 00 Prague, Czech Republic), who we have commissioned on the basis of Art. 28 GDPR to receive and process data for sending evaluation requests, with the intention of handling the sending of these evaluation requests in Slovakia and the Czech Republic. Your data is not processed outside the EU/EEA.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected. The user's e-mail address is therefore stored at least as long as the newsletter subscription is active. If you withdraw your consent or the service is discontinued, your personal data is deleted three years after the withdrawal of consent/discontinuation of the service in order to comply with the accountability requirement under Article 5(2) GDPR and defend any damages claims (Article 83(8) GDPR in conjunction with section 41 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and section 31 (2) no. 1 of the German Act on Administrative Offenses (Ordnungswidrigkeitengesetz – OWiG) and legitimate interest under Article 6(1)(f) GDPR), unless statutory retention requirements apply.
6. Right of withdrawal, right to object and removal
You may withdraw your consent to receiving the newsletter at any time. You may also object to direct advertising at any time. Until consent is withdrawn, the processing of data based on this consent is lawful. Please note that for technical reasons, it may take 24 hours for the withdrawal of consent to be registered in the system. Please excuse us if you receive a newsletter during this period, however in certain cases this is unavoidable. You can notify us of your withdrawal in text form by sending an e-mail to: newsletter-info@kaufland-online.de (for newsletters) or emails-abbestellen@kaufland-online.de (for direct advertising), or use the link provided in every e-mail. This also allows you to withdraw your consent/object to direct advertising.
For processing based on Article 6 (1)(f) GDPR, you have a right to object under Article 21 GDPR.
No automated decision-making within the meaning of Article 22(1) and (4) GDPR takes place.
X. Misuse of the Online Marketplace
1. Description and scope of data processing
Where the disclosure of personal data serves to identify any misuse of the Online Marketplace requiring the enforcement of rights or where there is a statutory disclosure obligation, such data will be disclosed to authorities (in particular law enforcement agencies and tax authorities), our legal defense counsel and, if necessary, to injured third parties. Data may also be disclosed if this is necessary for enforcing our standard terms and conditions or other agreements or is required based on a statutory, official or court order. We also use the device information specified in I) 1) no. 1, no. 3, and no. 6 to identify any potential misuse of a customer account. To protect your customer account, we will send you an e-mail if we detect any unusual login activity, such as login attempts from a different location than usual or via a different device.
2. Legal basis for the data processing
The legal basis for the processing is Article 6(1)(f) GDPR.
3. Purpose of the data processing
The data processing is required in order to ensure the security of our IT systems and processes and to comply with statutory and official requirements. The processing also indirectly serves the interests of the data subjects and the integrity of their personal data. These purposes constitute our legitimate interest in the data processing under Article 6(1)(f) GDPR.
4. Recipients/categories of recipient
Authorities (in particular law enforcement agencies and tax authorities), our legal defense counsel and, if necessary, injured third parties.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected.
6. Right to object and removal
You have the right to object to this data processing. However, in addition to objecting to the processing of the data, you must demonstrate grounds relating to your particular situation, because in cases of misuse, the processing of the data is necessary in order to counteract the misuse of the services provided and prevent our rights and the rights of third parties from being infringed.
C. Further information for customers
We only store your personal data if you provide it to us. We require this data, in particular your name, address and e-mail address, for processing your order via the Online Marketplace or, for example, when you participate in a prize draw or subscribe to a newsletter. The data is collected when you enter your data in the respective input screen of the order or contact form. Information on the specific processes:
I. Registration
1. Description and scope of data processing
In order to use all of our websites' services, you must register and provide your personal data. When you enter the data in the required fields, they will be transmitted to us and stored. We collect the following data during the registration process:
- first name
- last name
- gender
- e-mail address
- password (encrypted)
- acceptance of the standard terms and conditions and confirmation of acknowledgment of the Privacy Policy, incl. the date/time of consent
- optionally, whether a newsletter has been subscribed for, incl. date/time of consent
If you have created an Online Marketplace customer account, we specifically use the e-mail provided there so that we can send you important service information or notify you of changes to your customer account. Data will also be disclosed to third parties, including in the context described below. Otherwise, you can select the "stay logged in" box in your customer account and the next time you visit the website, depending on your selected account services, you will be able to access services more quickly without having to log in again first.
2. Legal basis for the data processing
The legal basis for processing in the context of registering a customer account is Article 6(1)(b) GDPR. The legal basis for processing in the context of using the "stay logged in" function is Article 6(1)(a) GDPR.
3. Purpose of the data processing
The registration of users is necessary in order to provide certain content and services, such as the processing of orders, on our websites. This is because, in an Online Marketplace like ours, in contrast to purely online shops, it is particularly important to be able to consolidate customer data in a customer account. Among other things, this allows you as a customer to purchase several products from different sellers in a single order via our Online Marketplace. The requirement of registering a customer account ensures that orders are properly assigned and processed in the event of a complaint. This is also in keeping with the data protection law principle of data minimization because the procedure allows us to reduce the transfer of data to the sellers to the minimum necessary for processing orders.
4. Recipients/categories of recipient
Please refer to the information under II. Order processing.
5. Duration of storage
Customer accounts are generally deleted once a request to delete is received, unless statutory retention obligations apply.
With regard to personal data associated with customer accounts, a distinction is made as to whether or not deletion is precluded by compliance with a legal obligation. If not, the data will be blocked for further processing.
6. Right of withdrawal, right to object and removal
You have the option to cancel your registration as a user at any time. You may have the data stored about you changed at any time. Simply log in to your customer account or contact customer service with your request. If the data is required for the performance of a contract or to take steps prior to entering into a contract, it may only be deleted early to the extent that contractual or legal obligations do not preclude such deletion. As a user, you also have the option to withdraw your consent to the processing of personal data in the context of the "stay logged in" function at any time. Simply de-select the "stay logged in" box.
II. Order processing
1. Description and scope of data processing
The marketplace operator provides an Online Marketplace at the various Online Marketplace Websites, which it itself uses as a direct distribution channel. Various natural persons, legal entities, and partnerships ("marketplace retailers" or "sellers") can post offers to sell products in this Online Marketplace. In addition to selecting the product, the customer can also choose between various sellers. In their capacity as legal sellers, they are designated as such in the product presentation under "seller" and will be listed in the context of order processing.
2. Legal basis for the processing
The legal basis for the processing is Article 6(1)(b) GDPR.
3. Purpose of the data processing
The data is processed for purposes of order processing and thus required for the performance of a contract with the user or to take steps prior to entering into a contract.
4. Recipients/categories of recipient
Data will be disclosed to third parties, including in the context described below:
Marketplace retailers/sellers
In cases where marketplace sellers operate their own shop in the Online Marketplace or sell you their products via the Online Marketplace, they do so in their own name. We merely act as an intermediary between sellers and purchasers. Therefore, it is essential to include the sellers in the processes in order to be able to ensure prompt processing of your order and handling of complaints. For this reason, in addition to receiving the data required for fulfillment of the legal transaction in the context of order processing, sellers also have access to the complaints system and can view the correspondence regarding the tickets (for more information, see below).
Dropshipping suppliers
Where the seller of the goods is the marketplace operator itself, the marketplace operator will procure the goods either from its own warehouses or from warehouses of suppliers, so-called "dropshippers". In such cases, the suppliers need to be included in the processes for purposes of order processing. Therefore, the shipping data necessary for the fulfillment of the legal transaction will be provided to the supplier exclusively for order processing.
Other service providers
In some cases, it may also be necessary to disclose your data to service providers such as call centers, billing offices and carriers in order to process your inquiry. Particularly in the case of transaction-related e-mail correspondence, data may be transferred to a server in the U.S. and stored there.
However, in such cases, data will only be transferred to third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected. Insofar as the data collected does not serve the purpose of entering into a contract with the user, the data collected during the registration process will be deleted if the registration on our websites is canceled or modified. With respect to data collected when orders are placed, in order to perform a contract or to take steps prior to entering into a contract, the data will be deleted once it is no longer required for the performance of the contract. Even after entering into a contract, it may be necessary to store the counterparty's personal data in order to comply with contractual or statutory obligations, such as those arising from the limitation periods for warranty claims or record-keeping obligations under tax law.
6. Right to object and removal
You have the option to cancel your registration as a user at any time. You may have the data stored about you changed at any time. Simply log in to your customer account or contact customer service with your request.
If the data is required for the performance of a contract or to take steps prior to entering into a contract, it may only be deleted early provided that contractual or legal obligations do not preclude such deletion.
III. Payment services and payment methods, credit check
1. Description and scope of data processing
For purposes of settling payments between customers and sellers, the marketplace operator has engaged cflox GmbH (the "Payment Service Provider"). The Payment Service Provider is entered in the commercial register of the Local Court of Hamburg under number HRB 127858. It is authorized to provide payment services and is authorized by the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) as a payment institution within the meaning of section 1 (1) no. 5 of the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG). It is entered in the Register of Payment Institutions published on BaFin's website under ID no. 148789.
The Payment Service Provider offers payment services for the settlement of contracts for the purchase and sale of products between the customer and the marketplace sellers which are entered into via the Online Marketplace. The Payment Service Provider receives payments from customers remitted using various payment methods on behalf of the marketplace sellers on its own account at a credit institution and pays out the funds from the sale of the products to the marketplace sellers.
Customers may select from the payment options available on the online marketplace or the payment methods offered by associated third party providers, such as the financing service of Klarna or Consors Finanz in Germany, to remit payment.
The data that you enter for the purpose of remitting payment at check-out will be processed primarily in the context of your order and the associated payment processing and in this context may be disclosed to third parties, in particular to payment product providers.
At the same time, however, in the context of the payment process, various internal business- and customer-related security measures will also be taken, where applicable with the involvement of third parties, to minimize and control the risks of money laundering and terrorist financing in accordance with the requirements of the German Money Laundering Act, fraud prevention measures will be taken on the part of the Payment Service Provider or one of the affiliated payment product providers, and a credit check for specific payment methods via the credit agencies SCHUFA and/or Bürgel may be performed in individual cases where there is a risk of non-payment or increased risk of fraud.
For example, if the payment methods "payment on Klarna invoice" and "payment by Klarna installments" are selected, Klarna will check and evaluate the information provided by the customer and exchange information with other companies and credit agencies if it has legitimate cause to do so. If the customer's creditworthiness is not guaranteed, the customer's selected payment method(s) may be declined by Klarna and it must be advised of alternative payment options.
If the payment method "Consors Finanz" is selected, Consors Finanz will check and evaluate the information provided by the customer and exchange information with other companies and credit agencies if it has legitimate cause to do so. If the customer's creditworthiness is not guaranteed, the customer's selected payment method(s) may also be declined by Consors Finanz and it must be advised of alternative payment options. Other processing operations worthy of note include, in particular, internal business- and customer-related security measures, such as transaction monitoring or implementing fraud prevention measures in the context of credit card payments in order to minimize the risks of money laundering and terrorist financing.
2. Legal basis for the data processing
The legal basis for the processing of the data is Article 6(1)(b) GDPR and Article 6(1)(c) GDPR in conjunction with section 6 of the German Money Laundering Act (Geldwäschegesetz – GwG). Article 6(1)(f) GDPR also serves as an additional legal basis for the processing of users' personal data.
3. Purpose of the data processing
The processing of data in the context of payment processing is necessary particularly for the processing of orders on our website. Processing in this case serves the purpose of performing a contract with the user or taking steps prior to entering into a contract.
Implementing internal business- and customer-related security measures in order to minimize and control the risks of money laundering and terrorist financing serves the purpose of complying with the requirements of the German Money Laundering Act.
The SCHUFA and/or Bürgel credit checks performed in individual cases or fraud prevention measures in the case of credit card transactions also serve the purpose of minimizing the risk of non-payment and preventing credit card misuse. These purposes constitute our legitimate interest in processing the data under Article 6(1)(f) GDPR.
4. Recipients/categories of recipient
Data collected in the context of payment processing will only be transferred to third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected. With respect to data collected in order to perform a contract or to take steps prior to entering into a contract, the data will be deleted once it is no longer required for the performance of the contract. Even after entering into a contract, it may be necessary to store the counterparty's personal data in order to comply with contractual or statutory obligations, such as those arising from the limitation periods for warranty claims or record-keeping obligations under tax law.
6. Right to object and removal
Until you submit your order, at which point the data will be definitively recorded, you may change the data yourself, delete it from the input screen or change the payment method as you wish. Thereafter, processing is required in order to process the order. Users will no longer have any option to object.
IV. Contact form, e-mail contact and use of the complaints system
1. Description and scope of data processing
As a user of our websites, you have several ways of contacting us (e.g., by telephone, contact form, e-mail, fax, letter or in the context of using the complaints system). If you contact us, all data related to the communication will be collected. This specifically includes:
- name
- e-mail address
- invoice/delivery address
- transaction data
- date of birth and telephone number, if applicable
- IP address (contact via the contact form)
The user's personal data transmitted during this process is stored and used to process the communication.
Disclosure to third parties takes place, inter alia, within the framework described below: For example, it may be necessary to transfer your data to service providers such as call centres, billing offices, suppliers or carriers in order to process your enquiry. In addition, we forward enquiries we have received by mistake regarding Kaufland-branch business, the Kaufland Card and the other Kaufland programmes of Kaufland Dienstleistung, for which we are not responsible in terms of content and thus also as regards data protection, together with the personal data of the inquirer to Kaufland Dienstleistung GmbH & Co. KG, as the responsible contact person.
2. Legal basis for the data processing
The legal basis for the processing of the data is Article 6(1)(f) GDPR for the purpose of responding to your inquiry. If the question is related to a contract, it may be necessary to process the data in order to perform a contract pursuant to Article 6(1)(b) GDPR or in order to take steps prior to entering into a contract at the request of the data subject.
The legal basis for forwarding your enquiry to the correct office is Art. 6 para. 1, letter f) GDPR. The legitimate interest in this (data) transfer lies in the interest of the Group to be able to correctly allocate customer enquiries and to be able to process the content in the interest of the customers.
3. Purpose of the data processing
The personal data from the input screen is processed for the purpose of processing the contact inquiry.
4. Recipients/categories of recipient
Data will be disclosed to third parties, including in the context described below:
Marketplace retailers/sellers
In cases where marketplace sellers operate their own shop in the Online Marketplace or sell you their products via the Online Marketplace, they do so in their own name. We merely act as an intermediary between sellers and purchasers. Therefore, it is essential to include the sellers in the processes in order to be able to ensure prompt processing of your order and handling of complaints. For this reason, in addition to receiving the data required for fulfillment of the legal transaction in the context of order processing, sellers also have access to the complaints system and can view the correspondence regarding the tickets (for more information, see below).
Dropshipping suppliers
Where the seller of the goods is the marketplace operator itself, the marketplace operator will procure the goods either from its own warehouses or from warehouses of suppliers, so-called "dropshippers". In such cases, the suppliers need to be included in the processes for purposes of order processing. Therefore, the shipping data necessary for the fulfillment of the legal transaction will be provided to the supplier exclusively for order processing.
Other service providers
In some cases, it may also be necessary to disclose your data to service providers such as call centers, billing offices and carriers in order to process your inquiry. Particularly in the case of transaction-related e-mail correspondence, data may be transferred to a server in the U.S. and stored there.
However, in such cases, data will only be transferred to third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected.
6. Right to object and removal
Users have the option to object to the processing of their personal data at any time. In that case the communication may not be able to be continued. Contact customer service with your inquiry in this regard.
V. Age verification
1. Description and scope of data processing
The marketplace operator verifies the customer's age by having the SHUFA credit agency perform an identity check, among other things. This check is carried out automatically whenever an age-restricted product is placed in the shopping cart.
No credit check is performed on the basis of the data stored at SCHUFA in this context. The data transmitted to SCHUFA will not be stored in the SCHUFA database or will be stored solely for the purpose of documenting the fact that a "SCHUFA-IdentityCheck Premium" was performed.
For more information on SCHUFA's activity, see the SCHUFA Notification according to Article 14 GDPR or online at www.schufa.de/datenschutz.
2. Legal basis for the data processing
The legal basis for the processing of the data is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.
3. Purpose of the data processing
The exchange of data with SCHUFA also serves to fulfill statutory duties to perform identity checks.
4. Recipients/categories of recipient
The marketplace operator transmits personal data collected in the context of this contractual relationship relating to the application, the performance and the termination of this business relationship to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected.
6. Right to object and removal
Users have the option to withdraw their consent to the processing of their personal data at any time. In such case, certain content and services on our website may no longer be able to be provided. Contact customer service with your inquiry in this regard.
VI. Other services
1. Special benefits from userwerk GmbH
We have integrated an advertising service from userwerk GmbH, Ehinger Str. 19, 89077 Ulm, Germany, e-mail: kontakt@userwerk.com, into our website. userwerk provides benefits to suppliers of a range of products, e.g. trial subscriptions for various media. The offer is aimed exclusively at adults. After the order process, as a thank you for ordering, you will be able to choose from the product providers’ benefits. In order to display these to you, non-personal information comprising country, postcode and the hash of the e-mail address are sent to userwerk in pseudonymised form. The hash of the e-mail address is evaluated in pseudonymous form to detect whether you previously objected to advertising in connection with the e-mail address submitted. The data is only saved in the browser and expires when the browser is closed. After the customer selects their chosen offer, an order form operated by userwerk appears. This is pre-filled with the customer’s personal data that was saved by us during their purchase in the shop system (first name, surname and address). This is also pre-filled in the customer's browser. The data (first name, surname, address, selected offer) is only sent to userwerk when the order is initiated. From there, it is sent to the product provider. The legal basis for temporarily saving the data for the display of the benefits and subsequent display of your order details is Art. 6 para. 1 lit. f GDPR (legitimate interest in displaying the benefits to you as a thank you and facilitating the order process). Under no circumstances will userwerk use the data collected from the advertisement of benefits to draw conclusions about your person. Furthermore, analysis of the hash of the e-mail address is used to exclude a possible advertising objection in a legally compliant manner; the legal basis for this data processing is Art. 6 (1) lit. f GDPR.
The data (first name, surname, address, selected offer) is only sent to userwerk when the order is initiated. Then is it sent to the product provider. This data processing serves the fulfilment of the contract between you and the product provider according to Art. 6 para. 1 lit. b GDPR.
If you do not wish to receive any offers of benefits, you can declare your objection by contacting us via e-mail: datenschutz@kaufland-online.com. Alternatively, you can reach us via post at the following address: Kaufland e-commerce GmbH, Data Protection Officer, marketplace postal address: Marketplace, c/o. Kaufland e-commerce Services GmbH & Co. KG, Habsburgerring 2, 50674 Cologne, Germany.
These parties are responsible for when the personal data which is sent to userwerk and the product provider is deleted. You can find out more about the details in the respective provider’s privacy policy.
There is no third-country processing and no automated decision making.
You can find further information on how userwerk collects and processes personal data here: https://www.userwerk.com/datenschutzerklaerung/
2. Insurance
Finally, we offer you as a customer the opportunity to use various services of cooperation partners via our website. In the context of these collaborative arrangements, the products and services offered by the cooperation partners are included on the Online Marketplace using so-called iFrames. iFrame technology is used to embed content from another source into the website. Therefore, we are happy to inform you about the relevant products and services and the cooperation partner responsible for providing them. However, any personal data will be processed solely by our cooperation partners. For details please contact the partners specified in the given case.
3. YouTube
On some sub-pages and in some cases on the main page of the Online Marketplace, video files may occasionally be provided for viewing in a YouTube frame. If you play the video, you access the website www.youtube.de of Google, Inc. via the frame itself. We have no control over the scope of the data and the handling of your data by Google, Inc. when you access the YouTube website. Google, Inc. itself is legally responsible in this respect. Details on how Google handles your data are however available at https://policies.google.com/privacy?hl=de&gl=de
D. Further information for sellers
I. Registration and use of the Online Marketplace
1. Description and scope of data processing
On our Online Marketplace, we offer sellers the opportunity to register by providing personal data. When the data is entered in the input screen, it will be transmitted to us and stored. Once their data is processed, sellers can post products in the Online Marketplace, sell these to private customers via the Online Marketplace, receive marketing services and participate in the payment processing system.
2. Legal basis for the data processing
The legal basis for processing the data is the user's consent given in accordance with Article 6(1)(a) GDPR.
If registration serves the purpose of performing a contract to which the user is a party or taking steps prior to entering into a contract, Article 6(1)(b) GDPR shall be an additional legal basis for processing the data.
Lastly, a further legal basis for the processing is also Article 6(1)(f) GDPR.
3. Purpose of the data processing
On the one hand, registration of the user is necessary in order to provide certain content and services on our websites. Registration of the user is also necessary for the purpose of performing a contract with the user or taking steps prior to entering into a contract. Lastly, the data processing may also be required in order to ensure the security of our IT systems and processes and to comply with statutory and official requirements. These purposes constitute our legitimate interest in the data processing under Article 6(1)(f) GDPR.
4. Recipients/categories of recipient
Data will be disclosed to third parties in the following cases among others:
For example, your data must be disclosed in the context of payment processing to service providers such as the Payment Service Provider, other payment product providers or the guarantor bank in order to process payment.
Data may also have to be disclosed to the end customer during the order process and when marketing services are provided if this serves to identify any misuse of the Online Marketplace or appears necessary in order for the marketplace operator to prosecute its rights or mount a legal defense. Where we have concrete indications of illegal or abusive activity or at the request of certain public agencies and in the case of cease-and-desist letters issued in connection with infringements of intellectual property rights, copyright or competition law, the provider may disclose personal data to law enforcement authorities, tax authorities or authorities that prosecute administrative offenses subject to fines, as well as to third parties asserting claims based on an infringement of their rights, where applicable. We are under no obligation to first verify whether the third party's claim is justified. Data may also be disclosed if this is necessary for performing the contractual agreement or is required based on a statutory, official or court order.
If the seller participates in the sponsored products program, it acknowledges that the information entered in connection with registering to use the Online Marketplace will be disclosed for purposes of providing sponsored products program services, such as for invoicing, to Cflox GmbH or other service providers and processed by same. In such cases, data will only be transferred to third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected.
Insofar as the data collected does not serve the purpose of entering into a contract with the user, the data collected during the registration process will be deleted if the registration on our website is canceled or modified.
With respect to data collected during the registration process, in order to perform a contract or to take steps prior to entering into a contract, the data will be deleted once it is no longer required for the performance of the contract. Even after entering into a contract, it may be necessary to store the counterparty's personal data in order to comply with contractual or statutory obligations.
6. Right to object and removal
You have the option to cancel your registration as a user at any time. You may have the data stored about you changed at any time. Simply log in to your customer account or contact Marketplace Support with your request.
If the data is required for the performance of a contract or to take steps prior to entering into a contract, it may only be deleted early to the extent that contractual or legal obligations do not preclude such deletion.
II. Identification of the business partner/internal security measures
1. Description and scope of data processing
When you register, you will find, among other things, a link to the online identification procedure of our partner ID-Now, in order to ensure identification of the business partner. In addition, business- and customer-related security measures will be taken in order to minimize and control the risks of money laundering and terrorist financing. The processing of your data is necessary in this context because the associated Payment Service Provider is obligated under the German Money Laundering Act to identify its counterparties and establish appropriate safeguards to prevent money laundering and terrorist financing.
2. Legal basis for the data processing
The legal basis is Article 6(1)(c) GDPR in conjunction with section 11 et seq. GwG.
3. Purpose of the data processing
The personal data is processed for the purpose of complying with a legal obligation to which the marketplace operator or an associated service provider is subject.
4. Recipients/categories of recipient
Data will only be exchanged with third parties in accordance with statutory provisions or in the context of a commissioned data processing arrangement.
5. Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected and there is no longer any legal obligation to retain it.
6. Right to object and removal
The data may only be deleted early to the extent that contractual or legal obligations do not preclude such deletion.
