Privacy Policy

Fielmann Group AG takes the protection of your personal data seriously and complies with the statutory provisions of the General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG") on the processing of personal data. In the following, we would like to inform you about the processing of your personal data on our websites and when using our online services.

What are personal data?

Personal data within the meaning of the GDPR (Art. 4 (1) No. 1 GDPR) are all data that relate to an identified or identifiable person. This includes, for example, your name or your e-mail address, but also the IP address with which you use our services.

Data Controller

Responsible for the processing is Fielmann Group AG, Weidestraße 118a, Hamburg, E-mail: datenschutz@fielmann.com.

Data protection contact

For questions and concerns regarding data protection, please contact us at datenschutz@fielmann.com or by post at Fielmann Group AG, Weidestraße 118a

Processing of your personal data when accessing our websites and online services

a) Logging of the access

Certain data on our servers are automatically processed for system administration purposes and for statistical or security purposes, particularly for protection against attacks on our IT infrastructure. Provided such data qualify as personal data as defined in Art. 4 No. 1 of the GDPR, they shall be processed on the basis of Art. 6 Para. 1 (f) of the GDPR for these purposes. This involves the following data:

• IP address
• accessed page/name of the accessed file
• date and time of the access
• amount of data transferred
• Report whether the access/retrieval was successful
• the referring page, if the access/retrieval was made via an external link, and the search term, if the access/retrieval was made via an external search engine
• Browser software used for the access (language, version and configuration)
• information on the operating system of your device and its interface

The afore-mentioned log data shall be stored on our servers for a standard 7 days and then erased, provided Oaktree Technologies is not legally obliged to store the data for longer. In such cases, storing data for longer periods shall be based on Art. 6 Para. 1 (c) of the GDPR.

b) Use of cookies and preferences

Cookies are small files that are stored on your terminal device and that record certain settings and data for exchange with our systems or the systems of our service providers via your web browser. Different types of cookies may be used: So-called session ID cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored on your data carrier for a longer period of time. These are cookies from Fielmann Group AG or also third-party providers, as indicated below. Furthermore, we inform you below about similar technologies.

Detailed information on the cookies we use can be found in the list below.

Cookie List

Functional

These cookies are absolutely necessary to use the website. They enable important basic functions without which this website does not work or does not work completely.

List of functional cookies (Host, Cookies, first/third party supplier, validity)
Qvi.do, kirby session cookie, first party supplier, 5 hours

Statistics

These cookies allow us to record page views and usage of the website. This allows us to analyze which pages are the most popular, which are the least used and which content users prefer.

List of statistics cookies (Host, Cookies, first/third party supplier, validity)
Google.com, _ga, first party supplier, 2 years, used to distinguish users.
Google.com, _gid, first party supplier, 24 hours, used to distinguish users.

You have the option at any time to revoke any consent given or to deactivate cookies used due to our legitimate interests and to object to the processing of your data ("opt-out").

You can change your settings for the use of cookies via the button below and freely revoke your consents with effect for the future:

You can also remove already stored cookies in your browser settings and disable the future storage of cookies. We would like to point out that if cookies are deactivated, it may not be possible to use all the functions of the websites. An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

c) Services with cookies and similar technologies

The legal basis for processing by the services mentioned below, which use cookies or also similar technologies, are as follows

• Your consent (Art. 6 Para. 1 lit. a GDPR), insofar as we ask for it,
• otherwise, and unless otherwise specified, the purposes of our legitimate interests (Art. 6 Para. 1 lit. f GDPR).

Google Analytics (Analysis and Marketing)

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google LL.C., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

On our behalf, Google processes usage data and device information to evaluate the use of the website and to compile reports on website activity. Cookies and similar technologies are used for this purpose. The statistics obtained enable us to improve our offer and make it more interesting for you as a user. This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID.

If you have a Google user account, you can also deactivate the cross-device analysis of your usage in the settings there under "My data", "Personal data".

We would like to point out that on this website Google Analytics has been extended by the code "_anonymizeIp();" to ensure a shortened collection of IP addresses. This prevents the identification of persons via IP addresses. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. In cases where personal data is transferred to the USA, suitable guarantees are in place in accordance with Art. 46 GDPR. When Google Analytics is used, other usage data is collected which may enable your identification in individual cases, such as the link to an existing Google account.

You can find Google's privacy policy here: policies.google.com/privacy

Google Ads, Google Search Ads, Remarketing

We use the online marketing tool Google Ads as well as the services Search Ads 360, Remarketing and Google Ad Manager from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to place and optimally control advertisements in Google's advertising network via websites and other offers.

Google Ads uses cookies to display ads that are relevant to users, to improve reports on the performance of the advertising campaign, and to prevent a user from seeing the same ads more than once. In addition, Google Ads may use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a Google Ads ad and immediately or later calls up the advertiser's website with the same browser and makes a purchase there.

Search Ads 360 processes real-time user data from Google Analytics to display relevant ads based on your presumed interests.

Google's remarketing function is used to recognize users when they visit websites that belong to Google's advertising network. On these pages, the user can then be presented with advertisements that relate to content that the visitor has previously accessed on websites that use Google's remarketing function.

Due to the tools used, your browser automatically establishes a direct connection with Google's server. If you are registered with a Google service, Google can associate the visit with your account.

For more information on Google Ads and the services mentioned, please visit policies.google.com/technologies/ads and on data protection at Google in general: google.de/intl/de/policies/privacy.

Contact us, contact form

Personal data are also processed when you contact us. The data you provide, such as your name and e-mail address as well as the content of your contact, will be forwarded to the relevant contact person at Oaktree Technologies, who will use your data exclusively to process your request.

In this case, your personal data are processed in connection with the performance of a contract concluded with you, or in order to take steps upon request prior to entering into a contract, or for the general processing of your request (Art. 6 Para. lit. b GDPR).

Processing beyond this does not take place unless otherwise specified and there are no retention obligations to the contrary. Your data will be stored until the respective purpose of the processing has been achieved.

Information for applicants

Through our pages, we enable you to submit applications for advertised jobs or on your own initiative. For this purpose, you can also contact us by e-mail or via the portal offered. We use the tool and service of Personio GmbH Rundfunkplatz 4, 80335 Munich, Germany (Personio), as part of an order processing process. We use your data as part of the application process and store it for a maximum of 6 months, provided that there is no legal retention obligation. If you have consented to your application being included in our applicant pool, we will store your data for a correspondingly longer period, generally for 12 months. Any further processing will not take place. The processing operations described above are carried out at your request for the purpose of implementing the applicant procedure (decision on the establishment of an employment relationship) in accordance with § 26 (1) 1 BDSG.

Direct advertising and satisfaction surveys

a) Information and advertising measures for similar products and services (direct advertising)

We also use the personal data provided by you in connection with a purchase or the use of our services to send you interesting and promotional information by mail or e-mail.

This includes your name, postal address, e-mail address and information about the categories of products you have purchased or services you have used.

We will send you e-mails with promotional content without your express consent only about those products and services that are similar to those you have already purchased or used from us and to the extent that you have not objected to this.

The legal basis for the use of personal data for the aforementioned information and advertising purposes is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in informing our customers about interesting news as well as advertising our offers and services. If we ask for your consent, the legal basis is Art. 6 Para. 1 lit. a GDPR.

You can object to this use or revoke your consent at any time. To do so, please contact customer service, for example by e-mail to datenschutz@fielmann.com. or click on the unsubscribe link at the end of the message in the e-mails you receive.

We would like to point out that, in exceptional cases, advertising material may still be sent temporarily after receipt of your objection/revocation. This is technically due to the necessary lead time within the selection process and does not mean that we have not implemented your objection.

b) Newsletter

We would also like to provide the opportunity to sign up to receive our e-mail newsletter. These newsletters contain information for those interested in our products and services as a whole, as well as other interesting promotional information.

In order to register for the newsletter, it is sufficient to provide the e-mail address.

The registration for interested parties takes place in a so-called double opt-in procedure. After registration, you will receive an e-mail asking you to confirm your registration. This serves to verify the e-mail address provided.

Registrations for the newsletter are logged by Fielmann Group AG in order to carry out the service and to be able to prove compliance with statutory requirements. This includes the storage of the registration and confirmation time, as well as the IP address.

To manage and send the e-mail newsletter we use the service Mailchimp of the processor Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA.

An analysis of the sending of the newsletters is made on our behalf. The newsletters contain a so-called “web beacon”, i.e. a pixel file that is accessed when the newsletter is opened. As part of this access, technical information such as information about the browser and system, your IP address and the time of the access is collected, as is information on whether the e-mail was opened and which hyperlinks were used. This information (opening rate, access times, link use) is used to improve the service.

The providers also use this data in part to optimize or improve the services, for example to technically improve the dispatch or presentation of the newsletters or to determine which countries the recipients come from. Your personal data will not be passed on to third parties. The legal basis is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can unsubscribe our newsletter at any time and thereby revoke your consent with effect for the future. For this purpose, you will find an unsubscribe link at the end of each e-mail. An adequate level of data protection for the transfer of data to third countries is ensured in accordance with Art. 44f. GDPR or through appropriate guarantees in accordance with Art. 46 GDPR.

Disclosure to third parties and processors

Your personal data will only be passed on to third parties or order processors in accordance with the information in the Privacy Policy.

All service companies are carefully selected by us and are contractually bound to our high level of security.

The legal basis here is provided by the legal bases for processing described in more detail above. Personal data may also be forwarded based on the GDPR, the German Federal Data Protection Act (BDSG) and, where applicable, other relevant statutory regulations, provided we are legally obliged to do so (Art. 6 Para. 1 (c) of the GDPR).

Secure processing of your data in the EU

Fielmann Group AG takes technical and organisational measures to protect your data from unauthorised access or loss. Our security measures are continuously improved in line with technological developments.

Your data is generally processed within the EU. If, in exceptional cases, data are transferred to a third country, this is only done if it is essential to be able to offer you the respective services and in compliance with the strict requirements of the GDPR, including compliance with the appropriate guarantees (Art. 44, 46f. of the GDPR).

Duration of storage

We store your personal data at the longest until the processing purposes stated in each case have been achieved.

Your rights

You can assert the following rights with regard to the processing of your personal data

• Right to access/information in accordance with Art. 15 GDPR, which data concerning you we are processing;
• Right to rectification of incorrect or incomplete data in accordance with Art. 16 GDPR and/ or erasure including the "right to be forgotten" in accordance with Art. 17 GDPR, in particular insofar as this does not conflict with any retention obligations;
• Right to restriction of processing in accordance with Art. 18 GDPR;
• Right to object to processing, in the cases specified by law in accordance with Art. 21 Para. 1 GDPR, and in particular the right to object at any time to processing for the purposes of direct marketing, Art. 21 Para. 2 GDPR (see in detail below);
• Right to data portability pursuant to Art. 20 Para. 1 GDPR.

In addition, you are also entitled to lodge a complaint to a supervisory authority for data protection.

If you have given your consent to the processing of your data, you can revoke it any time with effect for the future.

To the extent that we base the processing of your personal data on our prevailing legitimate interests, you have the right to object to the processing (Art. 21 Para. 1 GDPR).

This applies where the processing is not necessary, example for the performance of a contract with you, as outlined in this Privacy Policy. When exercising your right to object, we ask you to provide the reasons why we should not process your personal data, as carried out by us. In case of a justified objection, we shall examine the situation and shall either cease or adapt the data processing, or demonstrate our compelling legitimate grounds for continuing the processing.
Irrespective of this, you may object at any time and without providing reasons to the processing of your personal data for marketing and data analysis purposes (Art. 21 Para. 2 GDPR).