1. Data Processing Controller
The controller for the processing of your personal data when you visit our website rewe-digital.com/ is REWE Digital GmbH (“REWE”) whose contact details are:
REWE Digital GmbH
Domstraße 20
50668 Cologne
Germany
Telephone: +49 (0) 221 975 842-0
Email: empfang@rewe-digital.com
2. Data protection officer
You can contact the controller’s data protection officer at:
REWE Digital GmbH
Domstraße 20
50668 Cologne
Germany
For general inquiries about data protection and/or the assertion of data subject rights, please contact: datenschutz@rewe-digital.com
3. Processing Personal Data
We will process your personal data if you visit our website rewe-digital.com/career and use the online application system or contact us otherwise. Personal data (e.g., your name, address, email address, IP address or personal data you submit to us as part of your application) you disclose to us via our website or by email will only be processed to correspond with you and for the purpose for which you provide this data to us.
Data documenting our contact on Xing or LinkedIn (date relating to our contact, your response to our request)
Data that you must provide as part of your online application (e.g. first name, last name, email address, telephone number, address, possibly details regarding your driving licence and your date of birth, application photo, details of your professional experience and language skills, salary expectations)
Data that we can take from your application profiles on Xing or LinkedIn, if you use it in the context of your online application
Data that you provide to us via an online form or in any other way (e.g. through your application account) when you contact us
Data that we can take from your application documents (e.g. first name, last name, email address, password, place of residence (country), address, telephone number, date of birth, interest in job offers, consent to be included in the candidate pool, documents that you upload such as CV and certificates, application photo if applicable)
Data we need to prove that your application profile has been properly set up online (including IP address and timestamp of profile set up)
Data we need as proof of your consent, e.g. in the case of inclusion in the candidate pool (IP address and time stamp, submitted declarations of consent)
4. Purposes and Legal Bases for Processing Personal Data
4.1 Recruiting
We process your personal data if we assess you as suitable for a particular position based on the information you have published about yourself on the Xing or LinkedIn platform. Our employees will contact you about this via the respective platform. Your name and the date on which we contacted you will be recorded by us internally. In case of an application process, the information under "Applications" will be used. If you are not interested in the offered position, we will document this internally to not contact you again. This will be erased after 2 years.
Processing is performed on the legal basis of Article 6(1) Letter f of the General Data Protection Regulation and, if applicable, Article 88 of the General Data Protection Regulation in conjunction with Section 26 of the German Federal Data Protection Act due to our legitimate interest in recruiting new employees for our company.
4.2 Applications
We will process your personal data if you visit our website rewe-digital.com/career and use the online application system or contact us otherwise.
Due to the current situation concerning the SARS-Cov-2 virus, you may also conduct your job interview with us via Google Hangouts video call. This will enable us to reduce personal contact as required by the German government.
Please note that this is an offer, not an obligation. If you do not consent to the use of Google Hangouts, this will not have a negative impact on the application procedure. We will conduct the personal job interview when on-site meetings are possible again.
Regarding the data processing by Google Ireland Limited, we refer to the corresponding privacy policy: https://policies.google.com/privacy
Your data will be evaluated as part of the application process and, if necessary, forwarded to the management of the department to which you have applied. Your data will also be used in the context of the job interviews and corresponding acceptances.
If you have given REWE permission to consider your data for further job offers, your data will be processed accordingly as part of this process.
Processing is performed on the legal basis of Article 6(1) Letter b GDPR and Article 88 GDPR in conjunction with Section 26(1) Sentence 1 German Federal Data Protection Act (implementation of the application procedure and decision on the establishment of an employment relationship).
If we enter into an employment contract with you, we will continue to process your data for the purposes of the employment relationship if this is necessary for its performance or termination. Processing is performed on the legal basis of Article 6(1) Letter b GDPR and Article 88 GDPR in conjunction with Section 26(1) Sentence 1 German Federal Data Protection Act.
If special categories of personal data under Article 9(1) of the General Data Protection Regulation are processed, this will be done as part of the employment relationship to exercise rights or to comply with legal obligations under employment law, the right to social security and social protection (e.g., disclosing health data to health insurance providers, registering a severe disability for additional leave or determining disability contributions). This is done on the basis of Article 9(2) Letter b of the General Data Protection Regulation pursuant to Section 26(3) of the German Federal Data Protection Act. In addition, processing health data may be necessary to assess your inability to work in accordance with Article 9(2) Letter h pursuant to Section 22(1) Letter b of the German Federal Data Protection Act.
Furthermore, special categories of personal data may be processed on the basis of consent under Article 9(2) Letter a of the General Data Protection Regulation pursuant to Section 26(2) of the German Federal Data Protection Act (e.g., company health management).
In addition, there is the possibility that we offer our interview via the platform Pitch Club of Go Big GmbH. This is a cloud solution that allows us to conduct video/audio conferences but also to document job applications. This is an additional offer and not an obligation, so refusal to use the platform also has no negative impact on the application process.
Please note that we have only limited influence on the scope, type and purpose of data processing by the provider of Pitch Club. You can find Pitch Club's data protection notice at the following link: https://devlane.de/privacy
You can object to data processing at any time with effect for the future. The withdrawal of consent will not have a negative impact on the application procedure.
4.3 Signing of the employment contract by Docusign
Should an acceptance occur, you will receive your employment contract from our HR partner. This can be done with the Docusign software. For this purpose, your employment contract and related documents will be uploaded in encrypted form and attributed to your name and email address. The legal basis for this processing is Article 6 (1) Letter b of the General Data Protection Regulation (contract).
4.4. Talent pool
If you have given your consent to this as part of the application process, we will store your application in our talent pool and contact you in the event of other vacancies that may match your profile.
Unless your consent has been revoked, we will erase your data from the talent pool after 2 years from the receipt of your consent. Processing is performed on the legal basis of Article 6(1) Letter a GDPR (Consent of the data subject)
If you authorize REWE Digital to use your data for job offers, your data will be processed for this process.
When applying for positions at REWE Digital Bulgaria/ BILLA Bulgaria EOOD (hereinafter "BILLA"), REWE Digital GmbH processes your personal data on behalf of BILLA by providing the online application system for use by BILLA employees.
The controller for the application process is then
BILLA BULGARIA EOOD
Sofia 1404
55 Bulgaria Blvd
Email: mydata@billa.bg
Website: www.billa.bg
For the processing of your data within the scope of such an application process, the following BILLA privacy policy applies exclusively
5. Cookies and Social Media
5.1. Transfer to Social Media Services
Transfer to Social Media Services Our website offers links to the platform operators of Xing, Linkedin, GitHub, Stack Overflow and Kununu. You may recognize links to Internet pages of social media services by the respective company logo. Activating these links will open REWE's presence on the respective social media service. When clicking on a link to a social media service, a connection to the server of the social media service will be established. This will inform the social media's server of your visit to our website. Furthermore, additional data will be transferred to the social media service's provider.
This includes:
The URL of the website from which the link was activated
The time and date on which you accessed the website or activating the link
Information about the browser and operating system used
IP address Social media services use web tracking methods.
As stated, we have no influence over a platform's web tracking methods and cannot, e.g., disable them. Please be aware of this. For more information about data processing by the social media service provider and ways to object, please see the respective provider's privacy policy.
5.2 Cookies and other technologies (website analysis/tracking)
We use cookies in some areas of our website, e.g. to identify the preferences of visitors and to be able to design the website accordingly. This makes navigation easier and provides a high degree of user-friendliness. Cookies also help us identify especially popular areas on our website.
Cookies are small text files that are stored on the hard drive of your device. They make it possible to store information for a certain period of time and to identify your device. We use permanent cookies for better user guidance and individual performance presentation. We also use so-called session cookies, which are automatically deleted when you close your browser. You can configure your browser so that it informs you about the placement of cookies. This makes the use of cookies transparent for you. Important: If you completely turn off the use of cookies, you may not be able to use certain functions of our website.
5.2.1. Necessary technologies
These services, technologies and cookies are necessary to ensure central functions of the portal as well as the fulfilment of contracts with customers and cooperation partners. The legal basis for their use is § 25 (2) Nr. 2 TTDSG i.c.w. Article 6(1) Sentence 1 Letter b) (initiation or performance of contracts), Letter c) (if legal obligations exist) and/or Letter f) GDPR (overriding legitimate interests). The latter interests especially include the monitoring of the technical performance of the website and our interest in the economic use of partner sales channels. They therefore cannot be deactivated by our Consent Management System or by you as a website user. They are the following services.
5.2.1.1. Tag Management System
Processing in this category controls the presentation of services, technologies and cookies without storing the data collected in the context of these services. No data is collected or stored by the Tag Management System itself. The system is used for the technical implementation of your choice of privacy settings.
The following technologies and service providers are used:
e.g. Adobe Launch
5.2.1.2 Consent Management Platform (CMP)
Processing in this category enables the user to individually control their data transfer. The Consent Management Platform is used to ask for the user's decision, document it and transfer it to other systems.
The following technologies and service providers are used:
e.g. Usercentrics (https://usercentrics.com/privacy-policy/)
5.2.1.3 Website statistics and analysis
Processing in this category is used to measure the reach of our website, to understand visit paths on the website and to identify potential for optimisation.
The following technologies and service providers are used:
e.g. Adobe Analytics (https://www.adobe.com/privacy/policy.html)
5.2.1.4 Technically required website technologies.
The processing operations within this category are used to ensure the smooth use of the website and its functions. Without their use, it is not possible to use functions such as the shopping cart compilation.
The following technologies and service providers are used for this purpose:
e.g. Own website cookies
5.2.2 Statistical technologies
These services, technologies and cookies are needed to understand the use of our portal by our visitors, to detect errors and to continuously improve the portal. They are used on the legal basis of § 25 (1) TTDSG (Consent for the setting or reading of the cookies) i.c.w. Article 6(1) Sentence 1 Letter a) GDPR (Consent for the data processing based on it). You can object to data processing at any time with effect for the future (see No. 10.5 and 10.6 of this Privacy Policy and in the privacy settings at the bottom of the footer). The withdrawal of consent does not affect the lawfulness of the data processing carried out prior to the withdrawal of consent.
5.2.2.1. Measurement of success and optimisation of marketing measures
Processing in this category is used to measure the success of specific marketing measures and to make deductions for optimised control.
The following technologies and service providers are used:
e.g. Google AdWords (https://policies.google.com/privacy?hl=en)
5.2.2.2. Advanced web analysis (incl. customer IDs)
In addition to the basic web analysis, customer IDs are also collected in the extended web analysis after your approval. "Customer IDs" shall mean the REWE-specific pseudonyms of the customer number and the order number. These pseudonyms can be linked to natural persons by REWE and can be linked to online transaction data (orders, cancellations), offline transaction data via customer loyalty programmes (Payback) and usage data (REWE Web & App). This link enables REWE to perform extended analyses such as cross-device use of digital features (use of the shopping list in Web & App) or use of the REWE App for stationary shopping.
The following technologies and service providers are used:
e.g. Adobe Analytics (https://www.adobe.com/de/privacy/policy.html )
5.2.3 Marketing Technologies
These services, technologies and cookies are used to understand your interests and to provide you with individual content that is relevant to you. They are used on the legal basis of § 25 (1) TTDSG (Consent for the setting or reading of the cookies) i.c.w. Article 6(1) Sentence 1 Letter a) GDPR (Consent for the data processing based on it). Data processing will only start once you have given the appropriate opt-in. You have the right to withdraw your consent(s) at any time with effect for the future (see No. 10.9. of this privacy policy and in the privacy settings at the bottom of the footer). The withdrawal does not affect the lawfulness of the data processing carried prior to the withdrawal of consent.
5.2.3.1 Personal advertising and remarketing on third-party sites, social channels, search engines or sites of cooperation partners
Processing in this category is used to provide the user with interest-based advertising on third-party sites, social media, search engines or sites of cooperation partners. The aim is to increase the relevance of the contents of the advertising for our visitors.
The following technologies and service providers are used:
e.g. Adform (https://site.adform.com/privacy-center/platform-privacy/)
Google Adwords (https://policies.google.com/privacy?hl=en )
5.2.3.2 Session Monitoring
Processing in this category is used to understand the scrolling and clicking behaviour of our visitors and to detect problems with the use of the website and display errors.
The following technologies and service providers are used:
e.g. Mouseflow (https://mouseflow.com/privacy/)
5.3 YouTube video embedding
Videos from YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA are embedded on our website, which are not stored on our servers.
When our pages with embedded videos are accessed, the contents of the third-party provider that provides the videos are loaded. As a result, YouTube receives the usage data that is technically necessary in this context. We have no influence on the further data processing by the third-party provider. However, when embedding the videos, we made sure to activate the extended data protection mode offered by YouTube. The extended data protection mode means that the third-party provider does not set cookies until the video is clicked.
The embedding of YouTube videos is based on Article 6(1) Sentence 1 Letter f GDPR (legitimate interest in an appealing design of the site, public relations and communication).
If you want to make sure that no cookies are set by YouTube, do not click on the embedded videos. For more information about the privacy policies in place at YouTube/Google, click here: https://policies.google.com/privacy .
6. Voluntary Disclosure of Your Personal Data
You are not required by law to disclose your data. However, some of the stated data is necessary, e.g., to fully assess your application or to advise you based on your inquiry.
We will inform you if certain data is necessary for the respective service or function when you enter data. Such fields are marked as mandatory. Non-disclosure of mandatory data will prevent you from using the respective service or function. For optional data, non-disclosure may prevent us from providing our services in the normal form or to the full extent.
7. Storage Duration
We will only store your data for as long as necessary for the respective processing purposes. If an employment relationship is not established, we may store your data for a longer period, insofar as this is necessary for the defence against possible legal claims. As a rule, application documents are erased six months after notification of the rejection decision, unless longer storage is necessary due to legal disputes. When we conclude an employment contract with you, we transfer your data from the online system to our personnel data system. If you wish to be included in our talent pool, we will erase your data no later than 12 months after you have given your consent, or after a further 12 months if you wish to extend your contract. We usually store data related to point 5 for 7 days to 6 years.
8. Automated Decision-Making & Profiling
Automated decision-making or profiling are not performed on our website for your personal data.
9. Data Transfers to Third Parties
Within REWE, access to your data is only granted to persons who require your data for their assigned tasks. Outside of REWE, service providers of the following categories who assist us with the performance of our tasks may receive access to your data
Hosting service providers for the operation of our servers
Development service providers for programming, development, maintenance and support of software applications
Postal service providers for verifying, correcting or completing address data
Email service providers for sending emails
Service providers who provide survey tools
Analysis service providers for assessing data and analysing use of electronic media (website, app, REWE service point at the market)
HR service providers for assistance with applicant selections
Service providers used by us must satisfy special confidentiality requirements and will only obtain access to your data for as long as necessary to complete their tasks.
In case of indications of a crime, we may transfer your data to law enforcement authorities (police or prosecution).
To process your data, we also use service providers based in third countries outside the European Union. Countries outside the European Union handle the protection of personal data differently than countries in the European Union. The European Commission has not issued an adequacy decision certifying that these third countries provide an appropriate level of protection. We therefore implemented special measures to ensure that your data will be processed as securely as in the European Union. We conclude standard data protection clauses adopted by the European Commission for processing data in third countries with service providers in third countries. These standard data protection clauses require appropriate guarantees for the protection of your data from service providers in third countries. You may request a copy of these standard data protection clauses at the above-stated contact details.
10. Website User/Applicant Rights
10.1 Access
You may obtain information about your personal data that is processed by us.
10.2 Rectification
If your data is not accurate (anymore), you may obtain rectification of your data. If your data is incomplete, you may obtain completion.
10.3 Erasure
You have the right to obtain erasure of your data. Please note that your right to erasure requires a legitimate reason. In addition, no regulations must require us to store your data.
10.4 Restriction of Processing
You have the right to obtain restriction of processing of your data. Please note that your right to restriction of processing requires a legitimate reason.
10.5 Objection
You have the right to object to the processing of your data on grounds related to your particular situation. In case of a legitimate objection, we will no longer process your data.
10.6 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you object to the processing of your data.
10.7 Data Portability
You have the right to receive in electronic format the personal data you disclosed to us.
10.8 Withdrawal of Your Consent
You have the right to withdraw any consent you granted to us to process your data at any time. This also applies to the withdrawal of consent declarations you issued to us before the General Data Protection Regulation came into effect, i.e., before 25 May 2018. You may withdraw your consent most easily by emailing us at the above-stated contact details. However, withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.
Valid: 30.01.2022
