1. Data Processing Controller
The controller for the processing of your personal data when you visit our website rewe-digital.com/ is REWE Digital GmbH (“REWE”) whose contact details are:
REWE Digital GmbH
Domstraße 20
50668 Cologne Germany
Telephone: 0221 975 842-0
E-Mail: jobs@rewe-digital.com
2. Data Protection Officer
You may submit questions concerning the processing of your data to our data processing officer at any time whose address is:
REWE Digital GmbH
Data Protection Officer
Domstraße 20 50668 Cologne Germany
For general inquiries concerning data protection or to exercise data subject rights, please contact: datenschutz@rewe-digital.com
You can contact our data protection officer at: rewe-group@datenschutz-nord.de
3. Processing Personal Data
Personal data (e.g., your name, address, email address, IP address or personal data you submit to us as part of your application) you disclose to us via our website or by email will only be processed to correspond with you and for the purpose for which you provide this data to us.
Your personal data (name, address or email address) you disclose to the REWE Group will be processed in compliance with legal regulations. The following principles apply:
• We will inform you about the purpose for processing the data you disclose.
• We will use all means available to us to protect your data against unauthorized access, loss and alteration.
• We will only process and use your data to provide your desired information and services to you. Your data will not be transferred to members of the REWE Group or to other third parties. Members of the REWE Group include REWE Zentral AG, REWE Finanz eG and its subsidiaries of whom the REWE Group is the majority shareholder, REWE Dortmund eG and independent REWE partners.
• For online marketing measures, we commission service providers through processing agreements to manage databases and perform services. Access to your personal data is only granted to such external service providers to the extent and for the time necessary. Commissioned service providers will erase personal data without undue delay upon completion of their orders.
• Upon receiving notification from you (e.g., objection or withdrawal), we will erase without undue delay any personal you disclosed to us.
4. Voluntary Disclosure of Your Personal Data
You are not required by law to disclose your data. However, some of the stated data is necessary, e.g., to fully assess your application or to advise you based on your inquiry.
We will inform you if certain data is necessary for the respective service or function when you enter data. Such fields are marked as mandatory. Non-disclosure of mandatory data will prevent you from using the respective service or function. For optional data, non-disclosure may prevent us from providing our services in the normal form or to the full extent.
5. Purposes and Legal Bases for Processing Personal Data
a) Recruiting
We will process your personal data if we consider you suitable for a certain position on Xing or LinkedIn.
Data Categories:
This may include the following data:
Data Processing Description:
Our employees will contact you about this via the respective platform. Your name and the date on which we contacted you will be recorded by us internally. In case of an application process, the information under “Applications” will be used. If you are not interested in the offered position, we will document this internally to not contact you again. This will be erased after 2 years.
Legal Basis for Data Processing:
Processing is performed on the legal basis of Article 6(1) Letter f of the General Data Protection Regulation and, if applicable, Article 88 of the General Data Protection Regulation in conjunction with Section 26 of the German Federal Data Protection Act due to our legitimate interest in recruiting new employees for our company.
b) Applications
We will process your personal data if you visit our website rewe-digital.com/karriere and use the online application system or contact us otherwise.
Due to the current situation concerning the COVID-19 virus, you may also conduct your job interview with us via Google Hangouts video call. This will enable us to reduce personal contact as required by the German government.
Please note that this is an offer, not an obligation. If you do not consent to the use of Google Hangouts, this will not have a negative impact on the application procedure. We will conduct the personal job interview when on-site meetings are possible again.
Regarding the data processing by Google Ireland Limited, we refer to the corresponding privacy policy: https://policies.google.com/privacy
Data Categories:
This may include the following data:
Data Processing Description:
As part of the application process, your data will be assessed and may be forwarded to the division to which you applied. Your data will also be used for job interviews and acceptance or rejection.
If you authorize REWE Digital to use your data for job offers, your data will be processed for this process.
Legal Basis for Data Processing:
We primarily process data to establish, perform and terminate the employment relationship.
The primary legal basis for this is Article 88 of the General Data Protection Regulation in conjunction with Section 26(1) Sentence 1 of the German Federal Data Protection Act.
If special categories of personal data under Article 9(1) of the General Data Protection Regulation are processed, this will be done as part of the employment relationship to exercise rights or to comply with legal obligations under employment law, the right to social security and social protection (e.g., disclosing health data to health insurance providers, registering a severe disability for additional leave or determining disability contributions). This is done on the basis of Article 9(2) Letter b of the General Data Protection Regulation pursuant to Section 26(3) of the German Federal Data Protection Act. In addition, processing health data may be necessary to assess your inability to work in accordance with Article 9(2) Letter h pursuant to Section 22(1) Letter b of the German Federal Data Protection Act.
Furthermore, special categories of personal data may be processed on the basis of consent under Article 9(2) Letter a of the General Data Protection Regulation pursuant to Section 26(2) of the German Federal Data Protection Act (e.g., company health management).
If we collect additional categories of personal data not stated herein or if we need to process such data for purposes not stated herein, we will inform you about this in advance.
Storage Duration:
Any personal data collected by us will be erased when it is no longer required for the application process or subsequent employment relationship or when the employment relationship ends and no further legal storage requirements apply. Such storage requirements may result from legal evidence and storage obligations as regulated, e.g., by the German General Act on Equal Treatment, the German Commercial Code or German Fiscal Code. The German General Act on Equal Treatment requires storage periods of 6 months—during an employment relationship the German Commercial Code and the German Fiscal Code require storage periods of up to 10 years. In addition, we may store personal data for as long as claims may be exercised against us (legal limitation period of up to 30 years).
c) Transfer to Social Media Services
Our website offers links to the platform operators of Xing, Linkedin, GitHub, Stack Overflow and Kununu. You may recognize links to Internet pages of social media services by the respective company logo. Activating these links will open REWE’s presence on the respective social media service. When clicking on a link to a social media service, a connection to the server of the social media service will be established. This will inform the social media’s server of your visit to our website. Furthermore, additional data will be transferred to the social media service’s provider.
This includes:
• The URL of the website from which the link was activated
• The time and date on which you accessed the website or activating the link
• Information about the browser and operating system used
• IP address
Social media services use web tracking methods. As stated, we have no influence over a platform’s web tracking methods and cannot, e.g., disable them. Please be aware of this. For more information about data processing by the social media service provider and ways to object, please see the respective provider’s privacy policy.
d) Cookies
Some areas of our website use so-called cookies, e.g., to recognize visitor preferences and for corresponding optimal design of our website. This makes navigation easier and provides a high degree of user-friendliness for our website. Cookies can also help identify especially popular areas of our Internet offer. Cookies are small files saved on a visitor’s hard disk. Cookies enable information to be retained for a certain period and visitors’ computers to be identified. We use permanent cookies for better user management and individual performance reports. In addition, we use so-called session cookies that are automatically erased when you close your browser. Your browser may be configured to inform you before cookies are saved. This will make use of cookies transparent to you. Notice: Completely disabling cookies may prevent you from using certain functions of our website.
Our website uses the following categories of cookies:
Necessary cookies: These cookies are necessary for you to navigate and use functions of our website, e.g., when accessing password-protected areas. Without these cookies, we cannot provide certain services requested by you. We use necessary cookies to identify registered users so that they can be recognized during their current or future visits to our website. The legal basis for this processing is Article 6(1) Letter f of the General Data Protection Regulation. Our legitimate interests consist of the above-stated purposes.
Performance cookies: These cookies collect information about how visitors use our website, e.g., which pages they open most often and whether they receive error messages. These cookies do not collect data that could be used to identify visitors. Any information collected through these cookies is anonymous and is used exclusively to improve the functionality and service of our website. We therefore use performance cookies to compile statistics about how our website is used.
Functional / personalized cookies: These cookies enable websites to remember previous entries of visitors (e.g., username, language or selected sections) to offer optimized features tailored to the visitor. This allows our website to, e.g., provide you with current information about your preferred section by saving a cookie in your preferences. These cookies are also used to retain settings you configure on our website (e.g., font type and size and other options that may be adjusted by you). In addition, these cookies are used to provide the services you request, e.g., when you want to watch a video. These cookies cannot track your browser activities on other websites. They do not collect information about you that could be used for marketing purposes and cannot trace which Internet pages you visited apart from our website. We only use functional / personalized cookies to recognize you when you return to our website and to personalize content and save your settings. The legal basis for this processing is Article 6(1) Letter f of the General Data Protection Regulation. Our legitimate interests consist of the above-stated purposes.
e) Adobe Analytics (Omniture) Web Analysis
To offer our website in a need-based manner, we use Adobe Analytics (Omniture) to prepare pseudonymized usage profiles. Adobe Analytics (Omniture) uses cookies, i.e., text files saved on your computer that enable your use of our website to be analyzed. The information generated by the cookie on your use of our website will normally be transferred to an Adobe server in the US and saved there. Because we activated IP anonymization on our website, our server settings ensure that your IP address will be shortened prior to geolocalization by replacing the last octet of your IP address with zeros. Before the information generated by the cookie is saved, your IP address will be replaced with a generically generated IP address. Adobe uses this information to assess your use of our website, prepare website activity reports and perform other services related to use of our website and of the Internet for us.
This web analysis will only be activated with your consent (Article 6(1) Letter a of the General Data Protection Regulation). You may withdraw your consent at any time for the future. However, the described processing of your personal data will remain lawful until then.
Furthermore, you may object to the creation of pseudonymous usage profiles at any time. This may be done in several ways:
f) Pixel / Adform
Our website uses a pixel of the ad server Adform that is integrated on the applicant page. This pixel collects your personal data (IP address) through tracking whereby Adform disguises the last eight numbers of the user’s IP address with 0s. This disguise is used for all accounts within Europe. For all other accounts, the tracking function may be adjusted in the account settings. This requires contacting Adform’s support service.
The pixel is used to document visits to our website via the website’s online campaign to determine the online campaign’s success rate and how many website users applied per marketer or marketing ad.
The legal basis for the described data processing is Article 6(1) Letter f of the General Data Protection Regulation based on REWE’s and Facebook’s legitimate interest in providing ads based on the target’s individual interests.
Your personal data will be stored by Adform for up to 1 year.
6. Automated Decision-Making & Profiling
Automated decision-making or profiling are not performed on our website for your personal data.
7. Data Transfers to Third Parties
Within REWE, access to your data is only granted to persons who require your data for their assigned tasks. Outside of REWE, service providers of the following categories who assist us with the performance of our tasks may receive access to your data:
Service providers used by us must satisfy special confidentiality requirements and will only obtain access to your data for as long as necessary to complete their tasks.
In case of indications of a crime, we may transfer your data to law enforcement authorities (police or prosecution).
To process your data, we also use service providers based in third countries outside of the European Union. Countries outside of the European Union handle the protection of personal data differently than countries in the European Union. The European Commission has not issued an adequacy decision certifying that these third countries provide an appropriate level of protection. We therefore implemented special measures to ensure that your data will be processed as securely as in the European Union. We conclude standard data protection clauses adopted by the European Commission for processing data in third countries with service providers in third countries. These standard data protection clauses require appropriate guarantees for the protection of your data from service providers in third countries. You may request a copy of these standard data protection clauses at the above-stated contact details.
8. Storage Durations & Erasure Periods
We will only store your data for as long as necessary for the respective processing purposes. When your data is no longer necessary for the processing purposes specified by this Privacy Policy, your data will be erased, unless further storage is necessary for compliance with storage obligations.
For further details, please see the above.
9. Website User/Applicant Rights
9.1 Access
You may obtain information about your personal data that is processed by us.
9.2 Rectification
If your data is not accurate (anymore), you may obtain rectification of your data. If your data is incomplete, you may obtain completion.
9.3 Erasure
You have the right to obtain erasure of your data. Please note that your right to erasure requires a legitimate reason. In addition, no regulations must require us to store your data.
9.4 Restriction of Processing
You have the right to obtain restriction of processing of your data. Please note that your right to restriction of processing requires a legitimate reason.
9.5 Objection
You have the right to object to the processing of your data on grounds related to your particular situation. In case of a legitimate objection, we will no longer process your data.
9.6 Objection to the Processing of Your Data for Direct Marketing Purposes
You have the right to object to the processing of your personal data for direct marketing purposes at any time. This also applies to profiling related to such direct marketing. You may submit your objection to us informally, preferably at the above-stated contact details with the subject line “Objection to the Processing of My Personal Data for Marketing Purposes.”
9.7 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you object to the processing of your data.
9.8 Data Portability
You have the right to receive in electronic format the personal data you disclosed to us.
9.9 Withdrawal of Your Consent
You have the right to withdraw any consent you granted to us to process your data at any time. This also applies to the withdrawal of consent declarations you issued to us before the General Data Protection Regulation came into effect, i.e., before 25 May 2018. You may withdraw your consent most easily by emailing us at the above-stated contact details. However, withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.
Valid: 17.04.2020
