1. Data Processing Controller
The controller for the processing of your personal data when you visit our website rewe-digital.com/ is REWE Digital GmbH (“REWE”) whose contact details are:
REWE Digital GmbH
Domstraße 20
50668 Cologne
Germany
Telephone: +49 (0) 221 975 842-0
Email: empfang@rewe-digital.com
2. Data protection officer
You may submit questions concerning the processing of your data to our data processing officer at any time whose address is:
REWE Digital GmbH
Domstrasse 20
50668 Cologne
Germany
For general inquiries concerning data protection or to exercise data subject rights, please contact datenschutz@rewe-digital.com
You can contact our data protection officer at:
REWE Digital GmbH
Data protection officer
Domstrasse 20
50668 Cologne
Germany
rewe-group@datenschutz-nord.de
3. Processing Personal Data
Personal data (e.g., your name, address, email address, IP address or personal data you submit to us as part of your application) you disclose to us via our website or by email will only be processed to correspond with you and for the purpose for which you provide this data to us.
Your personal data (name, address or email address) you disclose to the REWE Group will be processed in compliance with legal regulations. The following principles apply:
4. Voluntary Disclosure of Your Personal Data
You are not required by law to disclose your data. However, some of the stated data is necessary, e.g., to fully assess your application or to advise you based on your inquiry.
We will inform you if certain data is necessary for the respective service or function when you enter data. Such fields are marked as mandatory. Non-disclosure of mandatory data will prevent you from using the respective service or function. For optional data, non-disclosure may prevent us from providing our services in the normal form or to the full extent.
5. Purposes and Legal Bases for Processing Personal Data
a) Recruiting
We will process your personal data if we consider you suitable for a certain position on Xing or LinkedIn.
Data Categories:
This may include the following data:
Data Processing Description:
Our employees will contact you about this via the respective platform. Your name and the date on which we contacted you will be recorded by us internally. In case of an application process, the information under "Applications" will be used. If you are not interested in the offered position, we will document this internally to not contact you again. This will be erased after 2 years.
Legal Basis for Data Processing:
Processing is performed on the legal basis of Article 6(1) Letter f of the General Data Protection Regulation and, if applicable, Article 88 of the General Data Protection Regulation in conjunction with Section 26 of the German Federal Data Protection Act due to our legitimate interest in recruiting new employees for our company.
b) Applications
We will process your personal data if you visit our website rewe-digital.com/career and use the online application system or contact us otherwise.
Due to the current situation concerning the COVID-19 virus, you may also conduct your job interview with us via Google Hangouts video call. This will enable us to reduce personal contact as required by the German government.
Please note that this is an offer, not an obligation. If you do not consent to the use of Google Hangouts, this will not have a negative impact on the application procedure. We will conduct the personal job interview when on-site meetings are possible again.
Regarding the data processing by Google Ireland Limited, we refer to the corresponding privacy policy:https://policies.google.com/privacy
Data Categories:
This may include the following data:
Data Processing Description:
As part of the application process, your data will be assessed and may be forwarded to the division to which you applied. Your data will also be used for job interviews and acceptance or rejection.
If you authorize REWE Digital to use your data for job offers, your data will be processed for this process.
Legal Basis for Data Processing:
We primarily process data to establish, perform and terminate the employment relationship.
The primary legal basis for this is Article 88 of the General Data Protection Regulation in conjunction with Section 26(1) Sentence 1 of the German Federal Data Protection Act.
If special categories of personal data under Article 9(1) of the General Data Protection Regulation are processed, this will be done as part of the employment relationship to exercise rights or to comply with legal obligations under employment law, the right to social security and social protection (e.g., disclosing health data to health insurance providers, registering a severe disability for additional leave or determining disability contributions). This is done on the basis of Article 9(2) Letter b of the General Data Protection Regulation pursuant to Section 26(3) of the German Federal Data Protection Act. In addition, processing health data may be necessary to assess your inability to work in accordance with Article 9(2) Letter h pursuant to Section 22(1) Letter b of the German Federal Data Protection Act.
Furthermore, special categories of personal data may be processed on the basis of consent under Article 9(2) Letter a of the General Data Protection Regulation pursuant to Section 26(2) of the German Federal Data Protection Act (e.g., company health management).
If we collect additional categories of personal data not stated herein or if we need to process such data for purposes not stated herein, we will inform you about this in advance.
Storage Duration:
Any personal data collected by us will be erased when it is no longer required for the application process or subsequent employment relationship or when the employment relationship ends and no further legal storage requirements apply. Such storage requirements may result from legal evidence and storage obligations as regulated, e.g., by the German General Act on Equal Treatment, the German Commercial Code or German Fiscal Code. The German General Act on Equal Treatment requires storage periods of 6 months-during an employment relationship the German Commercial Code and the German Fiscal Code require storage periods of up to 10 years. In addition, we may store personal data for as long as claims may be exercised against us (legal limitation period of up to 30 years).
c) Transfer to Social Media Services
Our website offers links to the platform operators of Xing, Linkedin, GitHub, Stack Overflow and Kununu. You may recognize links to Internet pages of social media services by the respective company logo. Activating these links will open REWE's presence on the respective social media service. When clicking on a link to a social media service, a connection to the server of the social media service will be established. This will inform the social media's server of your visit to our website. Furthermore, additional data will be transferred to the social media service's provider.
This includes:
- The URL of the website from which the link was activated - The time and date on which you accessed the website or activating the link - Information about the browser and operating system used - IP address Social media services use web tracking methods. As stated, we have no influence over a platform's web tracking methods and cannot, e.g., disable them. Please be aware of this. For more information about data processing by the social media service provider and ways to object, please see the respective provider's privacy policy.
6. Cookies and other technologies (website analysis/tracking)
We use cookies in some areas of our website, e.g. to identify the preferences of visitors and to be able to design the website accordingly. This makes navigation easier and provides a high degree of user-friendliness. Cookies also help us identify especially popular areas on our website.
Cookies are small text files that are stored on the hard drive of your device. They make it possible to store information for a certain period of time and to identify your device. We use permanent cookies for better user guidance and individual performance presentation. We also use so-called session cookies, which are automatically deleted when you close your browser. You can configure your browser so that it informs you about the placement of cookies. This makes the use of cookies transparent for you. Important: If you completely turn off the use of cookies, you may not be able to use certain functions of our website.
6.1. Necessary technologies
These services, technologies and cookies are necessary to ensure central functions of the portal as well as the fulfilment of contracts with customers and cooperation partners. The legal basis for their use is Article 6(1) Sentence 1 Letter b) (initiation or performance of contracts), Letter c) (if legal obligations exist) and/or Letter f) GDPR (overriding legitimate interests). The latter interests especially include the monitoring of the technical performance of the website and our interest in the economic use of partner sales channels. They therefore cannot be deactivated by our Consent Management System or by you as a website user. They are the following services.
6.1.1. Tag Management System
Processing in this category controls the presentation of services, technologies and cookies without storing the data collected in the context of these services. No data is collected or stored by the Tag Management System itself. The system is used for the technical implementation of your choice of privacy settings.
The following technologies and service providers are used:
6.1.2 Consent Management Platform (CMP)
Processing in this category enables the user to individually control their data transfer. The Consent Management Platform is used to ask for the user's decision, document it and transfer it to other systems.
The following technologies and service providers are used:
6.2 Statistical technologies
These services, technologies and cookies are needed to understand the use of our portal by our visitors, to detect errors and to continuously improve the portal. They are used on the legal basis of Article 6(1) Sentence 1 Letter f) GDPR (the overriding legitimate interests to prevent fraud, monitor errors in website functions and to present out website content). You can object to data processing at any time with effect for the future (see No. 10.5 and 10.6 of this Privacy Policy and in the privacy settings at the bottom of the footer). The withdrawal of consent does not affect the lawfulness of the data processing carried out prior to the withdrawal of consent.
6.2.1 Measurement of success and optimisation of marketing measures
Processing in this category is used to measure the success of specific marketing measures and to make deductions for optimised control.
The following technologies and service providers are used:
6.2.2 Website statistics and analysis
Processing in this category is used to measure the reach of our website, to understand visit paths on the website and to identify potential for optimisation.
The following technologies and service providers are used:
6.3. Marketing Technologies
These services, technologies and cookies are used to understand your interests and to provide you with individual content that is relevant to you. They are used on the legal basis of Article 6(1) Sentence 1 Letter a) GDPR (your consent). Data processing will only start once you have given the appropriate opt-in. You have the right to withdraw your consent(s) at any time with effect for the future (see No. 10.9. of this privacy policy and in the privacy settings at the bottom of the footer). The withdrawal does not affect the lawfulness of the data processing carried prior to the withdrawal of consent.
6.3.1 Personal advertising and remarketing on third-party sites, social channels, search engines or sites of cooperation partners
Processing in this category is used to provide the user with interest-based advertising on third-party sites, social media, search engines or sites of cooperation partners. The aim is to increase the relevance of the contents of the advertising for our visitors.
The following technologies and service providers are used:
6.3.2 Session Monitoring
Processing in this category is used to understand the scrolling and clicking behaviour of our visitors and to detect problems with the use of the website and display errors.
The following technologies and service providers are used:
7. Automated Decision-Making & Profiling
Automated decision-making or profiling are not performed on our website for your personal data.
8. Data Transfers to Third Parties
Within REWE, access to your data is only granted to persons who require your data for their assigned tasks. Outside of REWE, service providers of the following categories who assist us with the performance of our tasks may receive access to your data
Service providers used by us must satisfy special confidentiality requirements and will only obtain access to your data for as long as necessary to complete their tasks.
In case of indications of a crime, we may transfer your data to law enforcement authorities (police or prosecution).
To process your data, we also use service providers based in third countries outside the European Union. Countries outside the European Union handle the protection of personal data differently than countries in the European Union. The European Commission has not issued an adequacy decision certifying that these third countries provide an appropriate level of protection. We therefore implemented special measures to ensure that your data will be processed as securely as in the European Union. We conclude standard data protection clauses adopted by the European Commission for processing data in third countries with service providers in third countries. These standard data protection clauses require appropriate guarantees for the protection of your data from service providers in third countries. You may request a copy of these standard data protection clauses at the above-stated contact details.
9. Storage Durations & Erasure Periods
We will only store your data for as long as necessary for the respective processing purposes. When your data is no longer necessary for the processing purposes specified by this Privacy Policy, your data will be erased, unless further storage is necessary for compliance with storage obligations.
For further details, please see the above.
We generally store data related to point 6 for 7 days to 6 years.
10. Website User/Applicant Rights
10.1 Access
You may obtain information about your personal data that is processed by us.
10.2 Rectification
If your data is not accurate (anymore), you may obtain rectification of your data. If your data is incomplete, you may obtain completion.
10.3 Erasure
You have the right to obtain erasure of your data. Please note that your right to erasure requires a legitimate reason. In addition, no regulations must require us to store your data.
10.4 Restriction of Processing
You have the right to obtain restriction of processing of your data. Please note that your right to restriction of processing requires a legitimate reason.
10.5 Objection
You have the right to object to the processing of your data on grounds related to your particular situation. In case of a legitimate objection, we will no longer process your data.
10.6 Objection to the Processing of Your Data for Direct Marketing Purposes
You have the right to object to the processing of your personal data for direct marketing purposes at any time. This also applies to profiling related to such direct marketing. You may submit your objection to us informally, preferably at the above-stated contact details with the subject line "Objection to the Processing of My Personal Data for Marketing Purposes
10.7 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you object to the processing of your data.
10.8 Data Portability
You have the right to receive in electronic format the personal data you disclosed to us.
10.9 Withdrawal of Your Consent
You have the right to withdraw any consent you granted to us to process your data at any time. This also applies to the withdrawal of consent declarations you issued to us before the General Data Protection Regulation came into effect, i.e., before 25 May 2018. You may withdraw your consent most easily by emailing us at the above-stated contact details. However, withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.
Valid: 01/07/2020
