Data protection information of Otto (GmbH & Co KG), as of: 17/02/2022

In the following data protection information, we will inform you about the processing of personal data by Otto (GmbH & Co. KG) (“Otto,” and/or “we,” and/or the “Controller”) in accordance with the GDPR and the Bundesdatenschutzgesetz (the Federal Data Protection Act (“BDSG 2018”)).

Please read through our data protection information carefully. Should you have any questions or comments concerning our data protection information, please contact us at datenschutzbeauftragter@ottogroup.com.

This data protection information applies to data processing by:

OTTO (GmbH & Co. KG)

Werner-Otto-Strasse 1-7

22179 Hamburg

Germany

Represented by the managing director(s) Alexander Birken (Chair), Dr. Marcus Ackermann, Sergio Bucher, Sebastian Klauke, Petra Scharner-Wolff, Kay Schiebur

Tel.: +49 1806-303030

Email: service@otto.de

for the following websites
www.otto.market

www.api.otto.market

https://portal.otto.market

https://servicepartner.otto.market

You can reach the company data protection officer(s) of the Controller at:

OTTO (GmbH & Co. KG)

- Data Protection Officer -

Werner-Otto-Strasse 1-7

22179 Hamburg

Germany

E-Mail: datenschutzbeauftragter@ottogroup.com

Each time access is made to websites/applications, information is sent by the respective internet browser on your respective end device to the server of our website/application, and temporarily stored in log data files, the so-called log files. The data sets stored in this way contain the following data which are stored up until automatic erasure: date and time of the retrieval, name of the site retrieved, referrer URL (source URL, from which you arrived at our websites), the data quantity transferred, loading time, and the product and version information of each browser used as well as the name of your access provider.

The legal basis for the processing of the IP address is Article 6(1)(f) GDPR. We have a legitimate interest in

• guaranteeing that connections are established smoothly,
• guaranteeing that our website/application is easy to use,
• evaluating system security and stability.

No immediate inference as to your identity is possible by means of the information; nor do we draw any such inference.

The data are stored and automatically erased after the aforementioned purposes have been achieved. The standard periods for erasure are determined by the criterion of necessity.

In order to provide you with the greatest possible convenience, we offer the long-term storage of your personal data in a password-protected user account.

Setting up a user account is entirely voluntary. After your user account is set up, no new data need be entered. What is more, you can view and change any data stored regarding you in your user account at any time.

Please treat your personal access data confidentially and, in particular, please do not make the data accessible to any unauthorized third parties. Please note that you will automatically remain logged in after you leave our website, unless you logout actively. Your data will be automatically erased after the expiration of the retention duties applicable to us under commercial and tax law. The legal basis for such data processing is Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

On our websites/applications, we offer you the opportunity to subscribe to our newsletter. We only send newsletters to the verified email address that you have provided to us as part of your Otto Partner Connect account. The legal basis for this data processing is Article 6(1)(a) GDPR. 

Notice of right of revocation:

You can revoke your consent at any time with effect for the future in the partner portal or by sending a message to contact@otto.market or by post to 

OTTO Market

OTTO (GmbH & Co. KG)

Werner-Otto-Strasse 1–7

22179 Hamburg

Germany

Brief summary

OTTO, as the operator of the domains mentioned in Section 1, collects data about the behaviour of users on the websites (tracking data). This includes, among other things, which individual subpages were viewed. For this purpose, OTTO may, among other things, set cookies in the browser used by the respective user. The collection of tracking data is only permitted if you have given your prior consent. You can give such consent by clicking on the “OK” button in the cookie banner displayed. However, consent does not need to be given for the processing of such tracking data, which is required for the provision of the website. Tracking data that OTTO collects and stores itself is processed by OTTO exclusively in pseudonymised form. This prevents the data from being assigned to you personally. If you would like to delete individual cookies set in your browser or find out which service providers / suppliers have set cookies in your browser, you can do this using a preference manager. This can be found at www.youronlinechoices.com, for example. You also have the option of setting your browser to prevent the setting of cookies or to only allow the setting of certain types of cookie. Details on the possibility of changing the settings of common browser types (including Google Chrome, Firefox) can be found in Section 4.2. of this Privacy Policy.

Cookies are used on this website. Cookies are small text files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.). Information which respectively results in connection with the specifically used end device is stored in the cookie. However, this does not mean that we obtain direct knowledge of your identity in this way. Some of the cookies we use are erased at the end of the browser session (session cookies). Other cookies remain on your computer and enable us to recognise your computer upon your next visit (persistent or permanent cookies). 

According to the legal requirements, the storage of information on end devices (desktops, mobile phones, tablets, etc.) – e.g. by setting cookies – and the retrieval of information from end devices (tracking) is only permitted if you have given your prior consent. However, consent does not need to be given if such storage/retrieval is necessary for the provision of the website. A necessity exists, for example, with regard to ensuring the following functionalities / achieving the following purposes:

• displaying the shopping basket
• displaying the wish list
• enabling and maintaining the log-in
• ensuring system security

You have no right to object to data processing that is necessary for the operation of the website.

You can use the websites mentioned in Section 1 without data being retrieved from or stored on your terminal device for purposes that are not necessary for the provision of the website.

To be sure, you can set up your browser in such a manner that it does not store our cookies on your hard drive. The help function in the menu bar of most web browsers explains how to prevent your browser from accepting new cookies, provided that you set up your browser to notify you whenever you receive a new cookie, or how you can delete all of the cookies already received and block any additional ones.

Please proceed as follows

In Internet Explorer:

Select “Internet Options” in the “Tools” menu.
Click on the “Privacy” tab.
Now you can make security adjustments for the internet. Here, you can set whether and which cookies are supposed to be allowed or blocked.
Confirm your setting by clicking on “OK.”

In Firefox:

Click the menu button and choose “Options.”
Click on “Privacy & Security.”
Select the entry “Use custom settings for history” in the drop-down menu.
Now you can set whether cookies ought to be accepted, how long you wish to keep these cookies and make exceptions for the websites that you wish to always or never allow to use cookies.
Confirm your setting by clicking on “OK.”

In Google Chrome:

Click on the Chrome menu on the symbols bar of the browser.
Select “Settings.”
Click on “Advanced.”
Under “Privacy and security,” click on “Content settings.”
Under “Cookies” you can make the following settings for cookies:
 

• Delete cookies
• Block cookies by default
• Delete cookies and website data by default after closing the browser
• Allow exceptions for cookies from particular websites or domains

Insofar as you wish to delete individual cookies set in your browser or want to know which service providers/vendors have set cookies in your browser, you can do this via a 'preference manager.' One such manager is available at www.youronlinechoices.com

As already explained in Section 4.1. of this Privacy Policy, OTTO collects and processes tracking data partly on the basis of consent. You give this consent by clicking on the “OK” button in a banner linking to this consent text on one of the websites mentioned in Section 1. By clicking on the “OK” button, you consent to OTTO storing data on your end device (e.g. by setting cookies) or retrieving data from your end device. Furthermore, by clicking on the “OK” button, you consent to the use of certain advertising functionalities from third-party providers, the use of which requires consent in itself. All data processing that you have consented to by clicking on the “OK” button serves the same purpose, namely that of “advertising”.

Revocation of all consent
All consent that you have given by clicking on the “OK” button shown in the banner can be viewed here with a single click.

Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies (text files) and similar technologies that are stored on your end device and enable your use of the website to be analysed. This information is used to analyse your use of the website and to compile reports on website activity. It is possible that Google may also use the data collected via the website about your usage behaviour for its own purposes or for the purposes of other Google customers. The processing of the data after its transmission by us to Google Ireland Limited is carried out by Google as the sole controller under data protection law. In this context, Google Ireland Limited, as the sole controller under data protection law, may store data about you in the USA. The European Court of Justice has ruled that the USA is a country with an inadequate level of data protection. In this context, there is a particular risk that your data will be processed by American institutions/authorities for control and monitoring purposes without you having sufficient legal recourse against this.
 

You can revoke the consent you have given us for the described data processing here. As a result of this revocation, Google Analytics will no longer collect data about the end device used by you when issuing the revocation on the websites mentioned under Section 1.

We use the “Google Ads Conversion” service of Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”) to monitor the success and optimisation of our advertisements. Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms in Google. As soon as the user reaches otto.market via an advertising campaign displayed on Google, we can measure the success of the advertisement by tracking which campaign the entry on this website led to. This data collected as part of success optimisation is evaluated quantitatively, for example by analysing which search terms have led to the display of our advertisements and how many advertisements have led to corresponding clicks. This enables us to optimise our future advertising campaigns. It is possible that Google may also use the data collected via the website otto.de about your usage behaviour for its own purposes or for the purposes of other Google customers (e.g. by displaying personalised advertisements from third parties). Such further processing and the processing of the data after its transmission by OTTO to Google is carried out by Google as the sole controller under data protection law. In this context, Google, as the sole controller under data protection law, may store data about you in the USA. The European Court of Justice has ruled that the USA is a country with an inadequate level of data protection. In this context, there is a particular risk that your data will be processed by American institutions/authorities for control and monitoring purposes without you having sufficient legal recourse against this.

The legal basis for the further processing of the data is Article 6(1)(a) GDPR.

You can revoke the consent you have given us for the described data processing here. As a result of this revocation, Google will no longer collect data about the end device used by you when issuing the revocation on the websites mentioned under Section 1.

This website uses the “LinkedIn Insights Tag”, an analysis tool of the social network LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) for the purpose of monitoring the success and optimisation of advertisements. The LinkedIn Insights Tag enables the collection of data about visits to our website, including the URL, referrer URL, IP address, device and browser characteristics, timestamps and page views, after consent has been given. This is done for the purpose of tracking the success of campaigns and the associated actions, optimising the display of targeted advertising outside our website (retargeting) and obtaining additional information about LinkedIn members who view our advertisements.

The legal basis for the further processing of the data is Article 6(1)(a) GDPR.

You can revoke the consent you have given us for the described data processing here. As a result of this revocation, Google will no longer collect data about the end device used by you when issuing the revocation on the websites mentioned under Section 1.

We use the Google service reCaptcha to determine whether a human or a computer is making a certain entry. Google uses the following data to check whether you are a human or a computer: the IP address of the end device used, the website that you visit with us and on which the captcha is integrated, the date and duration of the visit, the identification data of the browser and operating system type used, your Google account if you are logged in to Google, your mouse movements on the reCaptcha areas and tasks in which you have to identify images. The legal basis for the data processing described is Article 6(1)(f) GDPR. We have a legitimate interest in this data processing to ensure the security of our website and to protect us from automated entries (attacks). You can find out more in the Google Privacy Policy and the Google terms of use

We embed content from the YouTube platform on our website. This service is generally inactive, but can be activated by the user. When you play content from YouTube, personal data may be transmitted to the platform. We have no influence on the use of the data by the platform. For information regarding further data processing, please refer to YouTube’s Privacy Policy. You can access this under the following link: https://policies.google.com/privacy

You have the opportunity to contact us in several ways: via email, telephone, or surface mail. If you contact us, then we will use the personal data that you provide us voluntarily in this context, exclusively for the purpose of getting in touch with you and being able to process your inquiry.

Article 6(1)(a), Article 6(1)(b), Article 6(1)(c), and Article 6(1)(f) GDPR establish the legal basis for this data processing.

With the exception of the processing set forth herein, we do not share your data with any recipients having their seat outside the European Union or the European Economic Area. The data transfer is effected upon the basis of so-called standard contractual clauses of the EU Commission.

Alongside the right to withdrawal of the consents you have given to us, if the respective statutory prerequisites are fulfilled, then you are entitled to the following additional rights:

• the right of access to your personal data stored by us (Article 15 GDPR), in particular, you can obtain access to information on the purposes of the processing, the category of the personal data, the categories of recipients to whom your data were or are being disclosed, the envisaged period of storage, and the source of your data, insofar as these were not collected directly from you;
• the right to rectification of inaccurate data or to completion of accurate data (Article 16 GDPR),
• the right to erasure of your data stored with us (Article 17 GDPR), to the extent that we do not have to comply with any statutory or contractual retention periods or other duties or rights by operation of law concerning further storage by us,
• the right to the restriction of processing of your data (Article 18 GDPR), to the extent that the accuracy of the data is contested by you, that the processing is unlawful, but you oppose its erasure; the Controller no longer needs the data, but that you, however, require the data for the establishment, exercise, or defense of legal claims, or have filed an objection to the processing as contemplated under Article 21 GDPR,
• the right to data portability in accordance with Article 20 GDPR, i.e., the right to receive selected data stored with us about you transferred in a commonly used, machine-readable format, or to obtain the transfer to another controller,
• the right to lodge a complaint with a supervisory authority. As a rule, for this purpose you can turn to the supervisory authority at your habitual residence or place of work, or at our company seat.

You can avail yourself of the above rights to which you are entitled with regard to us at datenschutzauskunft@otto.de.

You can avail yourself of your right to data portability under datenschutzauskunft@otto.de.

Right to object: 
It is possible under the prerequisites of Article 21(1) GDPR to object to the data processing on grounds relating to the particular situation of the data subject.

The general right to objection above applies to all processing purposes described in this data protection information, which purposes are processed on the basis of Article 6(1)(f) GDPR. In contrast to the special right of objection oriented to data processing for promotional purposes, we are obligated under the GDPR to implement such a general right of objection only if you set forth to us reasons of overarching significance (e.g., a potential risk to life or health).