Privacy

Data Protection Declaration

Section 1: Scope and overview

Section 2: Controller, contact person and contact details

Section 3: Your rights as the data subject

Section 4: Overview of data processing at Breuninger

Section 5: Cookies and tracking technologies

Section 6: Integration of YouTube videos

Section 7: Competitions

Section 8: Social media profiles/pages

Section 9: Branch store

Section 10: Gastronomy

Section 11: Data security

Section 12: Country-specific features

Section 13: Updates to this Data Protection Declaration

Status as at 30/11/2020

Breuninger takes data protection regulations and the safeguarding of your personal data very seriously. We are well aware that confidence plays a vital role in our relationship with our customers and the overall success of the business. By fulfilling our information obligations as effectively as possible, we aim to live up to the expectations placed upon us.

To make it easier for you to read, we have chosen to present the information in sections. This should enable you either to obtain a quick overview of all data processing and your rights in this regard, or to obtain more detailed information about the handling of your personal data at Breuninger.

If you have any questions about data protection at Breuninger, please send an e-mail to datenschutz(at)breuninger.de. If you would like to exercise your right of access or data erasure or any other data protection right in accordance with Art. 15-22 of the GDPR, including revocation of consent for marketing purposes and unsubscription from the newsletter, please send an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH).

For more information, please refer to section 3: Your rights as the data subject and Section 2: Controller, contact person and contact details.

Section 1: Scope and overview

This Data Protection Declaration (Privacy Policy) explains the extent to which we collect and process personal data when you visit our websites, our offices or use the mobile applications as well as in various other areas, the purposes for which they are used, who the recipients of the data are and when they are deleted. We process your data in a similar way for most of our offers. Please note that the data that are processed and how they are used depends largely on which services you use and on the country in which you are located. Therefore not all of this information will apply to you.

This Data Protection Declaration applies equally to the online portals and mobile applications operated by E. Breuninger GmbH & Co. ('Breuninger')

www.breuninger.com/ (online shop); www.breuninger.com/at for Austria; www.breuninger.com/ch for Switzerland
www.breuninger.com/magazin (magazine with editorial information about fashion, beauty and lifestyle topics)
https://www.e-breuninger.de/en/ (Breuninger information portal) including service pages
and our help page https://hilfe.breuninger.com/hc/de

In addition, we also process personal data outside these online portals for many of our offers, for example within the framework of the Breuninger Card customer relationship, in the area of human resources, for various services, special services and in our offices. You will find detailed information on this in the following sections.

Section 2: Controller, contact person and contact details

Breuninger & Co, Marktstrasse 1–3, 70173 Stuttgart, Germany is the controller responsible for processing personal data in all areas. You can reach us by phone at 0049 (0) 711/211 - 0, by fax at 0049 (0) 711/211 - 30 53 and by e-mail at kontakt(at)breuninger.de.

If you have any questions about data protection at Breuninger, please send an e-mail to datenschutz(at)breuninger.de.

In addition, Breuninger's Data Protection Officer can be contacted by all data subjects and can be reached at datenschutz(at)breuninger.de or by post at the address given above with the addition 'FAO Data Protection Officer'.

If you have any questions about the processing of your data, please contact the responsible regulatory authority: State Commissioner for Data Protection and Freedom of Information, postal address: Postfach 10 29 32, 70025 Stuttgart, Germany, Tel. +49 (0)711/61 55 41-0, Fax: +49 (0)711 61 55 41 15, e-mail: [email protected]. You can also contact any other Data Protection Authority if you wish.

Section 3: Your rights as the data subject

As the data subject, you have the right to access information about the personal data concerning you in accordance with Art. 15 of the GDPR.

If you would like to exercise your right of access or data erasure or any other data protection right in accordance with Art. 15-22 of the GDPR, including revocation of consent for marketing purposes and unsubscription from the newsletter, please send an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH).

Important notice: In the case of requests for information, we may ask you for further proof of identity to ensure that your data will not be disclosed to third parties. You are welcome to enclose sufficient proof of identity with your application to enable rapid processing.

In accordance with Art. 16 of the GDPR, you have the right to have your data rectified or, if the conditions detailed in Art. 17 of the GDPR are met, erased. You also have the right to restrict the processing of your data in accordance with Art. 18 of the GDPR. If you can assert a special personal situation, you can object to the processing of your data in general or in part in accordance with Art. 21 of the GDPR, provided that the data processing is based on Art. 6 (1) lit. e or f. You also have the right to data portability under the conditions set out in Art. 20 of the GDPR.

If you have given consent for us to process your data, you can withdraw it at any time. Please note that the withdrawal of consent will only affect future activities and any processing performed before then will therefore not be unlawful.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you is in breach of the GDPR.

You can contact the State Commissioner for Data Protection and Freedom of Information of the State of Baden-Württemberg for this purpose.

Section 4: Overview of data processing at Breuninger

Breuninger offers you a wide range of services, which you can also use in a variety of ways. Depending on how you contact us and which offers you use, we process different personal data from various sources.

'Personal data' is one of the most important terms and means any information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, e-mail address, ordered goods and payment data, which have been collected either online or offline. In particular, the General Data Protection Regulation (GDPR) serves as the legal basis for data protection.

We collect much of the data we process from you when you use our offers or contact us, for example when you register and provide your name, e-mail address or postal address. However, we also receive technical equipment and access data that are automatically recorded by us when you use our offers. This could be information about what device you are using, for example. We collect further data through our own data analyses (e.g. within the framework of market research studies and through click and link profiling). We may also receive information about you from third parties, such as credit agencies and payment service providers.

However, you can visit all our websites or use our mobile applications without having to log on or identify yourself.

4.1. Log data

Purposes of processing and legal basis:

When you visit our web pages, the following data are automatically stored by us without your intervention:

IP address
Date and time of visit
Details of protocol version, referrer, HTTP method, user agent string
Accessed page/name of the accessed file and amount of data transferred
Message stating whether the access/retrieval was successful

This happens in order:

to ensure a smooth connection,
to enable convenient use of our websites/applications
and to evaluate the system security and stability.

The legal basis for the processing of the above-mentioned data is Art. 6 (1) lit. f of the GDPR. We have a legitimate interest in the purposes of data processing listed above. If presentation serves the preparation of a contract, the legal basis for the data processing is Art. 6 (1) lit. b of the GDPR.

If you download or use mobile applications/applications from Breuninger and - if possible - you have activated location-based services or have agreed to them, you may transmit information to us about your location and the terminal device you are using as well as an identification number that can be clearly assigned to your terminal device. We may use this information to offer you location-based services, such as push notifications, or other personalised content with your consent in accordance with Art. 6 (1) lit. a of the GDPR. On most terminal devices it is possible to switch off these location-based services in the menu under 'Settings'. If you have further questions about how to turn off location-based services on your device, we recommend that you contact your mobile operator or the manufacturer of your terminal device.

Recipients of the data:

Your data will not be passed on to third parties.

Storage duration:

The log files are stored for 14 days and, in exceptional cases, 30 days to ensure the functionality of the website.

4.2. Newsletter dispatch

Purposes of processing and legal basis:

We offer you a personalised newsletter service within the framework of your customer relationship, as well as independently of registration or goods order.

We use your personal data to send you customised information about products, promotions, events and news from the fashion sector, as well as information about product data from your favourites list and shopping basket and to send you recommendations that match the product you are looking for in the service e-mails of the re-availability notification.

The data processing includes the following data:

Your contact details such as title, surname and e-mail address

Your purchase and order data for sending the satisfaction bonus
Your date of birth for our annual birthday e-mail, if you are registered in our online shop
Your affinities (online/offline, preferred branch, product range, favourites) based on your purchase and order data
Your online usage behaviour, provided you have agreed to the use of cookies, see section 5: Cookies and tracking technologies
Your country of origin and gender
General click behaviour, i.e. whether and when you have opened our newsletter (user profiling)
Click behaviour in the newsletter, i.e. whether and when you clicked on which information in the newsletter to receive information on products and services that are of interest to you (link profiling)
Device tracking, i.e. we record the terminal device with which you have opened the newsletter and the operating system
Product data related to your shopping cart, if you have not completed the purchase: If there is no purchase after two days, you will receive a one-time reminder e-mail from us
Product data related to your favourites list. We will send you an e-mail reminder and information about items on your favourites list, such as availability, price changes and relevant offers

Note: If you subscribed to our newsletter before 30 July 2018 and you have not subsequently agreed to be sent the personalised newsletter, no user and link profiling will take place. You will then receive a standardised, non-personalised newsletter.

In order to prevent errors and misuse, you will receive a confirmation e-mail when you request the newsletter, which should ensure that you have actually requested the newsletter. Only after confirmation on your part will the personalised newsletter be sent to you.

The legal basis for the above-mentioned data processing is your consent in accordance with Art. 6 (1) lit. a of the GDPR.

Recipients of the data:

If external processors are used for the dispatch of the newsletter, they are contractually obliged in accordance with Article 28 of the GDPR.

Storage duration:

You can unsubscribe from the newsletter free of charge at any time using the unsubscribe link at the end of each newsletter or by sending an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH).

The stored response times are then deleted 30 days after unsubscription from the newsletter.

4.3. Contact and WhatsApp service

Purposes of processing and legal basis:

When you contact us, we collect your contact data. Depending on how you contact us (e.g. by phone, e-mail, WhatsApp, chat on the online store), your contact information may include your name, postal address, phone numbers, e-mail addresses, social networking profile details (e.g. we receive your Facebook ID when you contact us through Facebook), usernames, brand preferences and date of birth (for the WhatsApp service) and similar contact details.

We will use your data solely for the purpose of processing your enquiry, or for queries or the WhatsApp service, so that your personal sales consultant in your preferred store can provide you with timely information about newly arrived items/products from your favourite labels.

The legal basis for establishing contact is Art. 6 (1) lit. f (legitimate interest in answering our customers' enquiries and thus ensuring customer satisfaction) or Art. 6 (1) lit. b of the GDPR (enquiries in the framework of a contractual relationship) or Art. 6 (1) lit. a of the GDPR (consent) with regard to the WhatsApp service. You give your consent as part of the WhatsApp service directly to the mobile number communicated by your sales consultant with the word 'Start'.

Recipients of the data:

When answering your enquiries, your data will only be processed within E. Breuninger GmbH & Co. and by the customer service provider obligated in accordance with Art. 28 of the GDPR.

If it is necessary to pass on your enquiry to contractual partners (e.g. manufacturers in case of complaints) for processing, we will render your enquiry anonymous. If, in individual cases, the transfer of your personal data should appear expedient, we will inform you of this in advance and ask you for your consent. We will not pass on your data to third parties for these purposes without your consent.

As part of the WhatsApp service, only your personal sales consultant and his/her representative, IT support and service personnel for maintenance purposes, and the head of your home department receive your personal data. WhatsApp also has access to your personal data. Please take note of WhatsApp's Privacy Policy: https://www.whatsapp.com/legal/#privacy-policy. Data processing may also take place outside the EU/EEA.

With regard to WhatsApp, no adequate level of data protection can be assumed due to processing in the USA. There is the risk that state authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. Please bear this in mind.

Storage duration:

If you have registered and logged in, or entered your Breuninger Card number, your queries and our responses will be saved in your customer account or card account and deleted after a maximum of 36 months. Contact requests and our answers are stored exclusively for processing and documentation and are deleted after a maximum of 48 months.

With the WhatsApp service, you can also end the WhatsApp service by sending the phrase 'Delete all data' from your stored mobile number. Your contact and chat history will then be deleted within one business day.

When using our chat function in the online shop, your data in the chatbot will be deleted after 30 days.

4.4. Contact for advertising purposes/direct marketing

Purposes of processing and legal basis:

Within the framework of the legal requirements and independently of registration to our newsletter, as our customer you will receive regular postal advertising and/or e-mails with products and services that are of interest to you, in the case of e-mails based on your purchases, unless you have already objected to this in the past.

For this purpose, we use your postal address or, when contacting you by e-mail, the e-mail address you provided when purchasing from the Breuninger online shop or applying for a card. For the purpose of a more interest-oriented advertising approach, we can assign your data collected from business transactions such as purchases or returns to different customer or interest groups (profiling).

The legal basis with regard to the sending of advertising by post and the statistical evaluations is Art. 6 (1) lit. f of the GDPR, the legal basis for the sending of advertising e-mails is Art. 6 (1) lit. a of the GDPR, except for existing customers as defined in Section 7 Para. 3 of the German Act on Unfair Competition (Art. 6 (1) lit. f. of the GDPR).

Contact will only be made by telephone for advertising purposes if you as a customer have expressly agreed to this in accordance with Art. 6 (1) lit. a of the GDPR.

You can object to profiling in connection with advertising use at any time with future effect. Please send an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH)for this purpose.

Recipients of the data:

If external contract processors are used to carry out direct marketing, they are contractually bound in accordance with Article 28 of the GDPR.

Storage duration:

In principle, you will only receive product recommendations by e-mail up to 1 year after your last purchase or the last use of our services. If you no longer wish to receive e-mails with product recommendations and/or services, telephone or postal advertising from us, you can object to their use with future effect. Your contact details will then be blocked for this use. With regard to your e-mail address, this is possible at any time, either overall or for individual measures. You can either use the unsubscribe link at the end of each e-mail or send an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH). The stored response times are then deleted 30 days after cancellation. You can only object to telephone or postal advertising for all advertising measures collectively. The objection can also be sent by e-mail to the above addresses or by post to the contact details in Section 2: Controller, contact person and contact details.

4.5. Customer account in the online shop and in our mobile applications/applications

Purposes of processing and legal basis:

To make your shopping experience as convenient as possible, we offer you the option of permanently storing your personal data in a password-protected Breuninger customer account. This opens up various possibilities for you, e.g. tracking the dispatch of the goods you have ordered, viewing the personal Breuninger Card and My Breuninger information you have provided, viewing your Breuninger Card transactions and purchases made with the Breuninger Card.

When you register, we ask you for a variety of information that is important for the customer relationship.

The legal basis for this is Art. 6 (1) lit. b of the GDPR, i.e. you provide us with the data on the basis of the contractual relationship or for the purpose of carrying out pre-contractual measures between you and us.

Recipients of the data:

The data will not be passed on.

Storage duration:

If you initiate the deletion of your customer account, your data will be deleted accordingly.

4.6. Order processing

Purposes of processing and legal basis:

The aim of our online shop and mobile applications is to offer you, as a customer of E. Breuninger GmbH & Co., goods and services as distance sales. In this context, we process the data required for the conclusion, execution or termination of a contract. These include in particular:

First name, last name
Invoice and delivery address
E-mail address
Billing and payment data
Date of birth
IP address

The legal basis for this is Art. 6 (1) lit. b of the GDPR. This means that you provide us with the data on the basis of the contractual relationship or to carry out pre-contractual measures between you and us.

Recipients of the data:

Within the scope of the above-mentioned data processing, your data will be processed on our behalf by contract processors from the logistics and transport sector in particular. They are each carefully selected and, if legally required, are contractually bound in accordance with Art. 28 of the GDPR.

In order to provide our customers with a better delivery service, we also work with a third-party service provider that processes the parcel tracking numbers and provides each customer with more accurate information about the parcel status. Information about the third-party provider

parcelLab GmbH
Schillerstrasse 23a
80336 Munich
Germany
The controller responsible for data protection can be reached at info(at)parcellab.com

If you place an order in our online shop with a Breuninger partner, which can be recognised by the marking 'Shipping by Breuninger Partner', we pass on the personal data (name and address) required for the shipping process to the respective Breuninger partner via an interface.

Contracts have been concluded with the service providers who act as an interface in accordance with Art. 28 of the GDPR (order processing) or Art. 26 of the GDPR (joint controllers).

To process the payment for you, we use the services of payment service providers. These are listed below:

Elavon Financial Services DAC, Lyoner Str. 36, 60528 Frankfurt/Main, Germany
American Express International Inc, Theodor-Heuss-Allee 112, 60486 Frankfurt/Main, Germany
TeleCash GmbH & Co. KG, Konrad-Adenauer-Allee 1, 61118 Bad Vilbel, Germany
Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands
BS PAYONE GmbH, Lyoner Strasse 9, 60528 Frankfurt/Main, Germany
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
Adyen N.V. German Branch, Friedrichstrasse 63, Mohrenstrasse 17, 10117 Berlin, Germany

We send these companies the data required to process the contractual payment obligations.

If you use the payment method 'purchase on account', your first and last name, date of birth and address will be sent to CRIF Bürgel GmbH, Dessauerstr. 9, 80992 Munich, Germany, and, where appropriate, to Creditreform Boniversum GmbH (Boniversum), Hellersbergstrasse 11, 41460 Neuss, Germany.

The legal basis for this is our overriding legitimate interests in an identity check and avoidance of bad debts in accordance with Art. 6 (1) lit. f of the GDPR.

Detailed data protection information of CRIF Bürgel GmbH as set out in Art.14 of the GDPR, particularly information about the business purpose, the purposes of data storage, the data recipients as well as your data protection rights with respect to CRIF Bürgel GmbH is available here https://www.crifbuergel.de/sites/default/files/information_nach_art._14_ds-gvo.pdf.

We obtain information from CRIF Bürgel and Boniversum about your previous payment history and creditworthiness determined as numerical values using address data on the basis of mathematical and statistical procedures, also based on the above-mentioned weighing of interests.

If contractual payment obligations on your part are not met, Breuninger may, after weighing up the interests of both parties, also transfer data about this to the aforementioned companies.

In addition, we use the services of Risk.Ident GmbH, Am Sandtorkai 50, 20457 Hamburg, Germany, to transmit data to terminal devices that have been used to commit (attempted) fraud. The legal basis for this is again our legitimate interest in avoiding further bad debts in accordance with Art. 6 (1) lit. f of the GDPR.

For the purposes of safeguarding the legitimate interests of Breuninger or third parties in avoiding bad debts in accordance with Art. 6 (1) lit. f of the GDPR, Breuninger is also entitled to transfer data on your due and outstanding debts to CRIF Bürgel and Boniversum, particularly where

the claim is enforceable or you have recognised the claim
you have been reminded by Breuninger at least twice in writing after the due date of the claim, there are at least four weeks between the first reminder and the transmission, Breuninger has informed you of the impending transmission in good time prior to the transmission of the information, but at the earliest at the first reminder, and you have not contested the claim

The same also applies to data on other non-contractual behaviour (e.g. credit card abuse, fraudulent behaviour) that Breuninger will transmit to CRIF Bürgel and Boniversum, insofar as this is necessary to safeguard the legitimate interests of Breuninger or third parties in preventing future misuse and bad debts and there is no reason to assume that your interests and rights outweigh these.

Following a multi-stage dunning procedure, we also reserve the right to transfer any unbalanced receivables to the collection company Liquida Inkasso, Lise-Meitner-Strasse 23, 74074 Heilbronn, Germany, for collection.

Breuninger also grants the statutory right of revocation for online purchases. Breuninger will collect and store data on the returned goods in this context. In order to avoid excessive returns (legitimate interest), Breuninger evaluates these data backwards for up to twelve months and speaks to customers with high return rates with the aim of finding a mutually satisfactory solution.

Storage duration:

If we do not use your contact data for advertising purposes, we will store the data collected for contract processing until the statutory or possible contractual warranty and guarantee rights expire. After the expiry of this period, we shall retain the information on the contractual relationship required under commercial and tax law for the legally specified periods. For this period (normally ten years from the conclusion of the contract), the data will be reprocessed solely in the event of a review by the tax authorities and for customer enquiries. All non-tax-relevant information is deleted after the purpose has ceased to exist and, in the case of communication histories, after 36 months at the latest.

4.7. Applicant management

Purposes of processing and legal basis:

Once you have submitted your application, we will review your documents. You will then receive feedback from us. We shall use the contact data provided by you for feedback purposes. This can be, for example, an invitation to a group or telephone interview or the sending of an offer or letter of refusal. We manage all digitally submitted documents via the SmartRecruiters applicant management tool we use. We will digitalise applications that we receive by post. We will inform you of this in a separate e-mail, which will also contain the data protection information relevant for you.

We use the tool 10to8 for group interviews. We will send you an invitation link via SmartRecruiters. You can use this link to make an appointment. Upon invitation to our Breuninger applicant community, you can also provide your personal data to our personnel department and have these stored in the applicant pool. This enables us to inform you about future job offers and to transfer your personal data to these jobs. In addition, there is the option of directly contacting the personnel manager, sending personnel marketing measures and extending invitations to events.

We process the following data, among others, within the framework of applicant management:

Your contact details such as name, address, e-mail address and telephone number
Other personal data such as date of birth, nationality, marital status and salary data
Information about your career and qualifications
Internal assessments such as notes taken, for example, during telephone interviews or job interviews

If you register with SmartRecruiters using a social media profile, including LinkedIn or Indeed, the data you provide will be transferred to SmartRecruiters. For further information, please refer to the SmartRecruiters Privacy Policy at www.smartrecruiters.com/privacypolicy/ and https://www.smartrecruiters.com/terms-and-conditions/FOSS/

Recipients of the data:

The following persons have access to the personal data required to execute the respective task:

To the extent necessary, external partners such as SmartRecruiters (applicant management software) and 10to8 (organisation of group interviews)
Employees of the Breuninger partner company, if the job is with a Breuninger partner (indicated in the job advertisement) and there is forwarding

Where legally required, all third parties have been contractually obliged to process data in accordance with data protection regulations pursuant to Art. 28 of the GDPR.

The legal basis for data processing is Section 26 (1) Clause 1 of the Federal Data Protection Act and Art. 6 (1) (1) lit. b of the GDPR and, if you have given your consent, for example by sending information not required for the application procedure, as well as for inclusion in the applicant community in accordance with Art. 6 (1) (1) lit. a of the GDPR.

Storage duration:

Your records will be automatically deleted three months after a cancellation has been sent. If you have applied for more than one position, your documents will be automatically deleted three months after the rejection for the last remaining application has been sent. We will inform you about the deletion by e-mail. In the event of recruitment, we will store, in addition to your application documents, the data required to execute the employment relationship until it is terminated. In the case of voluntary membership of a Breuninger applicant community, we will store your documents for a maximum of three years. You can also delete your profile in the Breuninger applicant community at any time.

4.8. Special services and customer orders

Purposes of processing and legal basis:

Within the scope of our customer relationship, we also offer special services for which we collect, process and store personal data. Such services include, for example, the alteration studio, the bespoke tailors, the wedding service and special customer orders.

The following data and data types are processed:

Name and first name
Contact and address details
Communication data
Information on payment method and purchase history
Customer correspondence
Possibly the fit
Data from the Breuninger Card relationship, if available

The legal basis is the contractual relationship or the implementation of pre-contractual measures in accordance with

Art. 6 (1) lit. b of the GDPR.

Recipients of the data:

Depending on the customer order and/or service initiated or used by you, the employees entrusted with the implementation of the order and/or service

as well as responsible department heads and deputies will receive the data required for fulfilment and technical support.

If external contract processors are used, e.g. Timify (TerminApp GmbH) for appointment coordination, they have been carefully selected and, if legally required, contractually bound in accordance with Article 28 of the GDPR.

Storage duration:

The storage period differs in accordance with the service used and/or the order placed as follows:

Wedding service: six months after wedding date
Special service: 30 months after the last visit
Special customer order: Rendered anonymous 14 days after completion or cancellation
Tailor's alterations/ bespoke tailors: 24 months to secure warranty claims

In addition, we retain tax and commercial law-relevant data from business transactions for ten years in accordance with legal regulations.

4.9. Availability notification

Purposes of processing and legal basis:

We use your personal data to inform you about the availability of the item you have requested. To do this, we use the e-mail address you entered in the corresponding dialogue box in the online shop. After entering your e-mail address, you will receive a message from us that the re-availability notification has been activated, as well as an e-mail as soon as the item you requested is available in our shop again. The legal basis is your consent in accordance with Art. 6 (1) lit. a of the DSVO. If the item is not available again after a considerable period of time, we will also inform you of this. The service e-mails regarding re-availability may contain product suggestions similar to the item you wish to be informed about. Please also refer to the information provided in section 4.4. If you also use the Breuninger app and have signed up for push notifications there, you will also be informed when the item is available again by push notification. You can disable these notifications at any time in your app settings under 'Notifications < Product information'.

Recipients of the data:

If external processors are used to issue the re-availability notification, they are contractually obliged to do so in accordance with Article 28 of the GDPR.

Storage duration:

Your data will be deleted as soon as you have been informed about re-availability. Regardless of re-availability, your data will be deleted after 30 days at the latest.

4.10. Breuninger Card

Purposes of processing and legal basis:

As a Breuninger Card customer, you enjoy numerous advantages and benefit from selected specials such as tailor-made offers, services and exclusive events. For this purpose, we process the personal data (name, address, date of birth, e-mail address, telephone number, IBAN and BIC¹, results of credit checks¹, income data) provided when an application for a Breuninger Friends Card is submitted and later on when the Breuninger Friends Card is used. These data concern the primary or secondary Breuninger Friends cardholder (hereinafter cardholders). Breuninger will only use these data to process the Friends Card application, manage the customer relationship, process and effect payments, and prevent payment defaults.

Breuninger uses the cardholders' e-mail address – if provided when the application is made – to send information about the Breuninger Friends Card and its other offers that supplement the card relationship or are related to it.

In addition, personal data of cardholders will be used for Breuninger's own advertising and marketing purposes, in particular for sending advertising information², as well as for Breuninger's own market research, in compliance with the statutory provisions. For further information on this use of your personal data, please refer to sections 4.2 Newsletter and 4.4 Contact for advertising purposes/direct marketing.

The legal basis for this is Art. 6 (1) lit. b of the GDPR, i.e. data processing for the fulfilment of the contract, as well as Art. 6 (1) lit. f of the GDPR (legitimate interest) with regard to checks in the event of bad debts as well as statistical evaluations and advertising and marketing purposes (see section 4.4. Contact for advertising purposes/direct marketing).

Recipients of the data:

In the event of payment default, data will also be passed on to lawyers, collection agencies and credit agencies, see also 4.6. Order processing ¹.

Storage duration:

Breuninger will normally delete your personal data when the card relationship is no longer required (usually within 15 months of the end of the contract) and any other legally required retention periods expire (e.g up to ten years in accordance with the German Commercial Code and the German Tax Code). If the card is not used for an extended period of time, Breuninger will delete your personal data 48 months after the last time the card was used and after the expiry of other legal retention periods.

¹ does not apply to the Breuninger Friends Card without payment function
² does not apply to the Breuninger Friends Card Corporate

4.11. Online reservation

Purpose of processing and legal basis:

We use your personal data in order to be able to inform you about your reservation request in a Breuninger establishment made in our online shop. For this purpose, we use the data you provide, such as title, e-mail address, first name and surname, which you entered in the corresponding dialogue box in the online shop in our system for customer enquiries.

After sending the reservation request, you will first receive a confirmation e-mail and, once it has been processed by our staff, you will then receive another e-mail informing you whether we were able to successfully complete your reservation request at Breuninger Haus or not.

The legal basis for data processing in the context of online reservations is Art. 6 (1) lit. b of the GDPR.

Recipients of the data:

Employees authorised by the system have access to your personal data in order to administer the data to the extent necessary to fulfil their tasks. If your reservation request is successful, a member of staff at Breuninger Haus will also receive your personal data in order to reserve the desired item(s) for you. We also transfer the data to our e-mail dispatch service provider artegic AG (Elaine) for the purpose of sending e-mail notifications. In addition, please note the data protection information of artegic AG: www.artegic.com/privacy/. This service provider is contractually bound in accordance with Art. 28 of the GDPR.

Storage duration:

We store your data for the duration of the processing of your request for the desired item(s) in order to inform you about the status of your reservation request at any time. Your data will be automatically deleted after ten days. In our recording system for customer orders, your data are rendered anonymous immediately after your reservation has been processed (due to purchase or expiration).

4.12. Customer surveys and market and opinion research

Purposes of processing and legal basis:

At various points in the customer relationship, we invite you to provide feedback on your experience with Breuninger and your shopping experience.

The legal basis for participation in customer surveys and market and opinion research is your consent in accordance with Art. 6 (1) lit. a of the GDPR and, in the case of an invitation to provide purchase-related customer feedback, Section 7 (3) of the German Act on Unfair Competition (Art. 6 (1) lit. f. of the GDPR, legitimate interest).

Recipients of the data:

The data that we collect in the course of customer surveys and market and opinion research are intended for internal use only in order to make your future shopping experience even more enjoyable. However, we use external service providers to carry out customer surveys and market and opinion research. They are carefully selected as processors and are contractually obliged in accordance with Art. 28 of the GDPR. They are as follows:

Questback GmbH, with registered offices in Cologne, Germany. The data protection guidelines can be found at https://www.questback.com/data-privacy/
Medallia, Inc., with registered offices in San Mateo, California, USA. The Privacy Policy can be found at https://de.medallia.com/privacy-policy/. Data processing may also take place outside the EU/EEA. With regard to Medallia, no adequate level of data protection can be assumed due to processing in the USA. There is the risk that state authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. Please bear this in mind.

Qualitize GmbH, with registered offices in Hamburg, Germany. The data protection guidelines can be found at https://www.qualitize.de/privacy
SurveyMonkey, with registered offices in Dublin, Ireland. The data protection guidelines can be found at https://www.surveymonkey.com/mp/legal/privacy/?ut_source=footer

Storage duration:

The survey results are evaluated and documented anonymously.

If you provide your personal data (e.g. telephone number for a callback) in the course of a survey, these data will be deleted after one year at the latest. All other personal data (e.g. e-mail address for invitations to take part in the survey) will be deleted after three years at the latest.

You can revoke your consent to this data processing at any time with future effect. To do this, it is sufficient to send an e-mail to kundenservice(at)breuninger.de (DE/AT) or onlineshop-ch(at)breuninger.com (CH).

4.13. Purchase evaluations (Trustpilot)

Purposes of processing and legal basis:

At various points in the customer relationship, we invite you to provide feedback on your experience with Breuninger and your shopping experience.

Recipients of the data:

To allow for the submission of purchase evaluations, we use the external processorTrustpilot A/S, with registered offices in Copenhagen, Denmark. It is contractually bound in accordance with Art. 28 of the GDPR. Trustpilot's data protection guidelines can be found at https://www.surveymonkey.de/mp/legal/privacy-policy/?ut_source=footer.

Storage duration:

4.14. Notify and MessengerPeople (communications services)

Purposes of processing and legal basis:

Breuninger gives Breuninger Outlet customers the option of communicating by means of Notify. After you have registered for Notify, you will receive a regular newsletter with the latest information about the Breuninger Outlet.

You must install the Notify app before you can receive the newsletter via Notify. By subscribing to our channel, you agree to adhere to Breuninger's internal data protection regulations. In particular, in accordance with Art. 6 (1) lit. a of the GDPR, you give consent for your personal data (name and first name, telephone number, messenger ID, profile picture and messaging history) to be saved, processed and used by the messaging service (Notify) in order to send messages to you.

Recipients of the data:

In accordance with Art. 28 of the GDPR, Breuninger uses the company MessengerPeople GmbH, Herzog-Heinrich-Str. 9, 80336 Munich, Germany as the technical service provider and processor.

Storage duration:

You can unsubscribe from our Outlet newsletter at any time. If you no longer wish to receive messages, you can simply send 'Stop' to us via the Notify chat.

If you no longer wish to use our Notify service and want to ensure that all the data relating to you are deleted, simply write the message 'Delete all data' in the Notify chat. All the data held by our service provider, MessengerPeople, will then be deleted.

You will find additional information in the relevant data protection guidelines implemented by Notify (www.messengerpeople.com/de/notify-datenschutzerklaerung) and MessengerPeople GmbH (www.messengerpeople.com/de/datenschutzerklaerung).

Section 5: Cookies and tracking technologies

We use cookies on a number of web pages to make your visit to our website as pleasant and enjoyable as possible. Cookies also enable us to run particular functions. Cookies are small text files that are stored on your terminal device and save specific settings and data which can then be exchanged with our system via your browser.

In the following, the individual categories of cookies that we use are described in more detail.

Analysis and statistics: As part of our on-going efforts to improve the user-friendliness of our website, we use cookies that anonymously measure and evaluate which functions and web page contents are used most often, and how much they are used. This helps us identify the contents and products in our web pages that are of particular interest to users. Your data are requested on the legal basis set out in Art. 6 (1) lit. a of the GDPR (consent).
Advertising: These cookies are used to show you advertisements on pages on the Internet with content that is specially tailored to you, which we assume may be particularly relevant to you. These cookies use advertising networks of companies that process your data as an independent controller. Your data are requested on the legal basis set out in Art. 6 (1) lit. a of the GDPR (consent).
Functional cookies: Functional cookies improve the user experience when you visit our website and control how our website is presented to you. We also use these cookies to display our products and content to make shopping on our website as easy and convenient as possible for you. Your data are requested on the legal basis set out in Art. 6 (1) lit. a of the GDPR (consent).
Required cookies: Required cookies help us to make our website technically accessible and usable for you. This facilitates essential basic functions, such as navigating the website, displaying information correctly in your Internet browser and managing your consent via the Consent Layer. Our website cannot function without these cookies. Furthermore, the cookies help us to offer you certain services on our website that you can expect under normal circumstances when visiting a fashion shop and to provide you with a tailored user experience on our website.

Your data are requested on the legal basis set out in Art. 6 (1) lit. f of the GDPR (legitimate interest) because we assume that it is in your interest that our website is usable for you and that you consider certain services to be required on our website.

You have the options of agreeing to the use of all cookies, or rejecting them, or you can make your own selection. Excluded from this are the cookies required for the display of the website.

You can, of course, adjust the settings in your Internet browser to ensure it never accepts the use of cookies. Information about how to do this can usually be found via the Help function of your Internet browser. However, if you decide not to accept the use of cookies, this may limit the functions you are able to access in the Breuninger online shop.

5.1. Analysis and statistics from data providers

5.1.1 Medallia

See section 4.12. Customer surveys and market and opinion research

5.1.2 Econda

We use the web analysis tool of econda GmbH, Zimmerstrasse 6, 76137 Karlsruhe, Germany (Econda), to design and optimise our website in accordance with your needs. Econda collects and stores data that are rendered anonymous and creates user profiles from these data using pseudonyms.

Cookies can be used for this purpose. Among other things, cookies facilitate the recognition of the Internet browser. The data collected with Econda technology will not be used to identify you personally on our website and will not be combined with the personal data pertaining to the bearer of the pseudonym without your consent. In particular, IP addresses are rendered unrecognisable immediately after receipt, which makes it impossible to assign user profiles to IP addresses.

When our website is used, Econda processes the IP address, device information, browser information, usage data, user behaviour, customer ID and order ID.

Your data will be stored by Econda for two years on servers within the EU and will not be passed on to third parties.

You can object to the collection and storage of data at any time with future effect. In order to object to the collection and storage of your data in the future, you can obtain an opt-out cookie from Econda under the following link. This will ensure that no data from your browser will be collected and stored by Econda in the future:

https://www.econda.de/en/data-storage-opt-out/

For further details on data processing, please refer to Econda's data protection regulations: [email protected]

5.1.3 Content Square

We use technology from Content Square Israel Ltd. (Content Square), Atrium Tower, 2 Jabotinski St. 29th Fl. Ramat-Gan, 5250501, Israel, for analysis and statistics concerning website usage as well as to optimise user behaviour on our website.

For this purpose, we use cookies that save your user behaviour on our website.

When our website is used, Content Square processes the IP address, device information, browser information, usage data, user behaviour, cookie ID and order ID.

Your data will be stored by Content Square for 60 days on servers within the EU and will not be passed on to third parties. After 60 days your data will be rendered anonymous and deleted after 13 months.

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your data in the future, go to the data protection settings on our website and uncheck the box under Analysis and Statistics at Content Square.

For further details on data processing, please refer to Content Square's data protection regulations: https://contentsquare.com/privacy-center/

5.2. Advertising by data providers

5.2.1 Awin and Tracdelight (affiliate networks)

We use so-called affiliate networks to promote our products and services. For this purpose, cookies can be used to trace the origin of the conclusion of the contract. Among other things, the affiliate networks can recognise that you clicked on the partner link on the external website and then concluded a contract (order) with us in the online shop using affiliate link of the corresponding affiliate network. The purpose of storing these data is to process commission payments between us as advertisers and the partner (affiliate) who has integrated our advertising material on his/her website, which is processed via the affiliate network.

We participate in the affiliate networks AWIN, Eichhornstrasse 3, 10785 Berlin, Germany, and tracdelight GmbH, c/o Burda Studios Publishing GmbH, Arabellastrasse 23, 81925 Munich, Germany.

Awin and Tracdelight each process the IP address, browser information, device information, usage data, cookie ID, clicks on advertising material, interaction with advertising material and order ID.

At Awin, your data will be stored for 30 days after you click on the advertising material or for 50 days after you place an order, and at Tracdelight for four weeks after you click on the advertising material.

Both affiliate networks store the data on servers within the EU and transfer personal data to third parties who are used and contracted as processors by Awin or Tracdelight.

For further details on data processing, please refer to the data protection regulations of:

AWIN: https://www.awin.com/gb/privacy

Tracdelight: https://www.tracdelight.io/datenschutz/

5.2.2 Microsoft (Bing Ads)

On our website, we use Bing Ads technologies, which are operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Conversion Tracking is used, whereby Microsoft places a cookie on your terminal device if you have accessed our website via a Microsoft Bing Ad or in another way. This enables us and Microsoft to recognise that you have clicked on an advertisement, been redirected to the website and reached a predetermined target page ('conversion site') that was linked with the advertisement. Furthermore, we and Microsoft can see that you have accessed the website in another way and made a purchase or initiated service, which is defined as conversion.

We also use Microsoft's retargeting technology, which collects and stores information about your user behaviour on our website.

Cookies can be used for this purpose. The cookies enable Microsoft to collect, process and use information from the cookies in order to create user profiles from the data using pseudonyms. These usage profiles are used to analyse visitor behaviour, which enables us to display relevant advertising and offers via Bing Ads to those of you who have already shown an interest in our website and our content/offers. No personal information regarding the identity of the user is processed.

Due to the marketing tool used, your browser automatically establishes a direct connection with the Microsoft server. We have no influence on the scope and further use of the data besides the above-mentioned purposes, which are collected by Microsoft based on the use of this tool, and therefore inform you in accordance with our state of knowledge: Based on the integration of Microsoft, Microsoft receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Microsoft service, Microsoft may link the visit with your account. Even if you are not registered with Microsoft or have not logged in, it is possible that the provider will identify and save your IP address.

When our website is used, Microsoft processes the UET tag ID, Microsoft cookie, browser information, device information, user behaviour and interaction with advertising material.

Your data will be stored on servers within the EU or the United States of America and may be transferred to service providers and their subsidiaries that provide technology or support services to support, operate and maintain certain Microsoft online services. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

Microsoft keeps your data from the UET day for 180 days. The duration of the Microsoft cookie is 13 months.

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your data in the future, you can click on the following link:

https://account.microsoft.com/privacy/ad-settings/signedout?ru=https:%2F%2Faccount.microsoft.com%2Fprivacy%2Fad-settings

For further details on data processing, please refer to the data protection regulations of the Microsoft Corporation: https://privacy.microsoft.com/en-us/PrivacyStatement

5.2.3 Criteo

We use retargeting technology from Criteo SA, 32 Rue Blanche, 75009 Paris, France (Criteo) on our website. Cookies may be used that allow Criteo to collect and store aggregated and pseudonymous information about your use of our website. Criteo uses an algorithm to analyse the recorded user behaviour and can thus display targeted product recommendations as personalised advertising banners on other websites (known as publishers).

Your data will be stored on servers located in the EU and may be shared with service providers and their subsidiaries that provide technology or support services to support, operate and maintain Criteo services.

Criteo stores your technical data for 13 months and cookies for 13 months after your last update (visit to our website).

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your data in the future, you can click on the following link: https://www.criteo.com/privacy/#user-choices

For further details on data processing, please refer to Criteo SA's data protection regulations: https://www.criteo.com/privacy/

5.2.4 Exactag

We use the analysis service of Exactag GmbH, Philosophenweg 17, 47051 Duisburg, Germany (Exactag) on our website. Exactag collects and stores data on our website for marketing and optimisation purposes. Pseudonymous user profiles can be created from these data. Cookies are used for this purpose and a technique called fingerprinting can be used, which stores environment variables of your Internet browser in a database without unique user-related data, such as an IP address.

We use the cookie for tracking across devices and websites to track user behaviour beyond our website and on different devices. We thus evaluate the interaction with our advertising media on other websites and devices (customer journey) in order to optimise them. We do this by assigning values that have been rendered anonymous, which are composed of the IDs of the devices you use and those of the cookies of the pages you visit. These values are not assigned to an individual person.

When our website is used, Exactag processes the IP address, browser information, device information, location information, usage data, user behaviour, interactions with advertising materials and order ID.

Your data will be stored on servers within the EU and not passed on to third parties.

Exactag stores your data for six months. Customer journey data are stored for 36 months and then rendered anonymous.

You can object to the collection and storage of data at any time with future effect. If you wish to object to the collection and storage of your information in the future, click on the following link to place the Exactag opt-out cookie in your browser: www.exactag.com/datenschutz/optout

For further details on data processing, please refer to Exactag's data protection regulations: https://www.exactag.com/en/data-privacy/

5.2.5 Pinterest

We use retargeting technology from the social network Pinterest (Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland) on our website, which enables us to display advertisements and offers relevant to you on Pinterest to those of you who have taken an interest in our website and our content/offers and are Pinterest members. For this purpose, a so-called conversion tracking pixel or retargeting pixel from Pinterest is integrated into our pages, which informs Pinterest that you have visited our website and which parts of our offering you are interested in when you visit our website.

Due to the marketing tool used, your browser automatically establishes a direct connection with the Pinterest server. We have no influence on the scope and further use of the data besides the above-mentioned purposes, which are collected by Pinterest based on the use of this tool, and therefore inform you in accordance with our state of knowledge: Based on the integration of Pinterest, Pinterest receives the information that you have called up the relevant part of our website or clicked on an advertisement from us. If you are registered with Pinterest, Pinterest can link the visit to your account. Even if you are not registered with Pinterest or have not logged in, it is possible that the provider will identify and save your IP address.

When our website is used, Pinterest processes the IP address, device information, browser information, location information, usage data, user behaviour, pixel ID, interaction with advertising media, interaction with products, interaction with website services, viewed advertisements and online shop content.

Your data are stored on servers in the United States of America until it is no longer required for processing purposes. Your data will not be passed on to third parties outside the Pinterest network. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

For further details on data processing, please refer to Pinterest's data protection regulations: https://policy.pinterest.com/en/privacy-policy

5.2.6 Facebook

We use retargeting technology from the social network Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on our website, which enables us to display advertisements and offers relevant to you on Facebook to those of you who have taken an interest in our website and our content/offers and are Facebook members. For this purpose, a so-called conversion-tracking pixel or retargeting pixel from Facebook is integrated into our pages, which informs Facebook that you have called up our website and which parts of our offer you are interested in when you visit our website.

Due to the marketing tool used, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and further use of the data besides the above-mentioned purposes, which are collected by Facebook based on the use of this tool, and therefore inform you in accordance with our state of knowledge: Based on the integration of Facebook, Facebook receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with Facebook, Facebook can link the visit to your account. Even if you are not registered with Facebook or have not logged in, it is possible that the provider will identify and save your IP address.

When our website is used, Facebook processes the IP address, Facebook user ID, device information, browser information, location information, usage data, user behaviour, marketing information, interaction with advertising materials, interaction with products, interaction with website services, viewed advertisements and online shop content.

Your data are stored on servers within the EU until they are no longer required for processing purposes and are not passed on to third parties outside the Facebook network. They may be transmitted to a third country in accordance with the GDPR, such as the USA, within the Facebook network. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

For further details on data processing, please refer to Facebook's data protection regulations: https://www.facebook.com/privacy/explanation

5.2.7 GroupM

We use technologies of the agency group GroupM (GroupM Germany GmbH, Derendorfer Allee 10, 40476 Düsseldorf, Germany), particularly MediaCom DE (MediaCom Agentur für Media-Beratung GmbH, Derendorfer Allee 10, 40476 Düsseldorf, Germany), MediaCom AT (MediaCom Austria, Vordere Zollamtsstrasse 13/5. OG, 1030 Vienna, Austria) and MediaCom CH (MediaCom Switzerland, Manessestrasse 85, 8045 Zurich, Switzerland) for marketing and optimisation purposes of advertising campaigns on our website. Cookies can be used for this purpose. Cookies support the tracking and segmented control of online advertising measures, especially in the display area, by the agency group on other websites. The processed data are used to create pseudonymous user profiles, which do not contain any reference to persons.

Conversion tracking is also used, whereby GroupM stores a cookie on your terminal device if you have reached our website via the content of an advertisement placed by GroupM, or in another way and have made a purchase or undertaken a defined action. In this way, GroupM and Breuninger can recognise that someone has clicked on an ad, been redirected to the website and made a purchase (conversion). Furthermore, we and GroupM can see that you have accessed the website in another way and made a purchase or initiated a service, which is defined as conversion.

When our website is used, GroupM processes the IP address, device information, browser information and usage data.

Your data will be stored for 13 months on servers within the EU or at MediaCom Ch in Switzerland and may be passed on to other companies or group companies within the WPP group in order to provide the service. Your data may be transferred to the United States of America due to US technology service providers that support GroupM with their services. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

For further details on data processing, please refer to GroupM's data protection regulations: https://www.groupm.com/privacy-notice

5.2.8 Google Ads

We use Google technologies (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland) on our website. These are Google Conversion Tracking on the one hand and Google Retargeting on the other.

With Google Conversion Tracking, Google places a cookie on your terminal device if you have accessed our website via a Google advertisement or in another way. This enables Google and Breuninger to recognise that someone has clicked on an advertisement, been redirected to the website and reached a previously determined target page (conversion site). Furthermore, we and Google can see that you have accessed the website in another way and made a purchase or initiated service, which is defined as conversion. In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures were by measuring the success of certain parameters, such as the display of the advertisements or clicks by you, and optimise them accordingly. We do not collect and process any personal data in the specified advertising measures. We only receive statistical evaluations from Google. These evaluations enable us to identify which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material, and we cannot identify the users on the basis of this information.

We also use Google's retargeting technology, which collects and stores information about your user behaviour on our website. These data are stored in cookies on your computer and read by Google. The cookies enable Google to collect, process and use information from the cookies, from which user profiles are created using pseudonyms. These usage profiles are used to analyse your visitor behaviour on our website and to display advertisements in order to show you relevant and personalised content on external websites that appears to be of interest to you based on your user behaviour on our website.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google based on the use of this tool and therefore inform you in accordance with our state of knowledge: Based on the integration of Ads Conversion, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with one of Google's services, Google can link the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will identify and save your IP address.

When our website is used, Google processes the IP address, cookie ID, pixel ID, device information, browser information, location information, usage data, user behaviour and user agent.

Your data will be stored on servers within the EU and will not be passed on to third parties outside the Google network. They may be transmitted to a third country in accordance with the GDPR, such as the USA, within the Google network. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

Log data are rendered anonymous after nine months and cookie information after 18 months.

For further details on data processing, please refer to Google's data protection regulations: https://policies.google.com/privacy?hl=en

5.2.9 Elaine

We use the e-mail dispatch tool Elaine from Artegic AG, Zanderstrasse 7, 53177 Bonn, Germany (Artegic) to send our newsletter to you. We also use Elaine conversion tracking technology on our website by using cookies that record whether you accessed our website via a link or advertising material in the newsletter and whether you made a purchase. This allows us to adapt and optimise the content of our newsletter to show you the right products.

When our website is used, Artegic processes the IP address, device information, browser information, usage data and user behaviour.

Your data will be stored on servers within the EU and not passed on to third parties.

Artegic will delete your data after 30 days after you have visited our website via a link in the newsletter.

For further details on data processing, please refer to Artegic AG's data protection regulations: https://www.artegic.com/privacy/

5.2.10 Outbrain

We use retargeting technology from Outbrain UK Limited, 5th Floor, The Place,175 High Holborn, London, WC1V 7AA, UK (Outbrain) on our website. Cookies can be used for this purpose. The cookies enable Outbrain to collect, process and use information from the cookies in order to display relevant and personalised content to you on external websites which may be of interest to you based on your user behaviour on our website. For example, Outbrain's additional reading recommendations or advertisements integrated below an item are determined based on the content you have viewed so far. The content displayed in the Outbrain widget is automatically controlled and delivered by Outbrain in terms of content and technology.

When our website is used, Outbrain processes the IP address, user ID, UUID, browser information, device information, usage data, user agent, user behaviour, clicks on advertising material, interaction with advertising material and viewed online shop content.

Your data will be stored on servers within the EU and will not be passed to third parties outside the Outbrain network. They may be transmitted to a third country in accordance with the GDPR, such as the USA, within the Outbrain network.

Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

Outbrain stores your data for 13 months.

For further details on data processing, please refer to Outbrain's data protection regulations: https://www.outbrain.com/legal/privacy#privacy-policy

5.2.11 TV Squared

We use the TV tracker technology from TV Squared Limited Fifth Floor, 1 Exchange Crescent, Conference Square, Edinburgh, EH3 8UL, Scotland (TV Squared) on our website. Cookies can be used for this purpose. The cookies enable TV Squared to collect, process and use information from the cookies in order to measure the effectiveness and impact of TV campaigns on your user behaviour on our website.

When our website is used, TV Squared processes the IP address, cookie ID, browser information, device information, location information, usage data and user behaviour.

Your data will be stored for two years after your last visit to our website on servers within the EU and may be transferred to third parties who are used and contracted as processors by TV Squared, and to service providers and their subsidiaries who provide technology or auxiliary services to support, operate and maintain TV Squared services. They may also be transmitted to a third country in accordance with the GDPR, such as the USA, within the TV Squared network. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

For further details on data processing, please refer to TV Squared's data protection regulations: https://tvsquared.com/privacy-policy/

5.2.12 Factor Eleven (Factor 11)

We use the negative retargeting technology from Factor Eleven GmbH, Siemensstrasse 3, Fernwald, 35463 Fernwald - Annerod, Germany (Factor Eleven) on our website. Cookies can be used for this purpose. The cookies enable Factor Eleven to collect, process and use information from the cookies in order to control and optimise the display of advertising material for you. The purpose of negative targeting is to ensure that you do not receive a new advertisement from us within a certain period of time if you have accessed our website via an advertisement, other websites or direct search.

When our website is used, Factor Eleven processes the abbreviated IP address and cookie ID.

Your data are stored on servers with a cookie duration of 30 days within the EU and is not passed on to third parties.

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your information in the future, go to the privacy settings on our website and uncheck the box under Advertising at Factor Eleven.

For further details on data processing, please refer to Factor Eleven's data protection regulations: https://www.factor-eleven.de/datenschutz/

5.2.13 Google Analytics (corporate website)

We use the Google Analytics web analysis service from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google) on our corporate website www.e-breuninger.de to analyse how it is used and to optimise it. We use Google cookies for this purpose.

When our website is used, Google processes the abbreviated IP address, browser information, device information, location information, usage data and user behaviour. We have activated the IP anonymisation function "anonymised IP" offered by Google on this website, which means that your IP address is abbreviated by the last byte or the last 80 bits (type IPv6) within the member states of the EU and the European Economic Area. This abbreviation eliminates references to your person in your IP address.

Your data will be transferred by Google to a Google server in the United States of America or another third country in accordance with the GDPR, stored there, analysed and the result made available to us in anonymised form. The data are transferred to servers in the USA or a third country according to the GDPR on the basis of concluded EU standard contractual clauses. The data are not passed on to any third parties outside the Google network.

Google stores your data for one year.

You can object to the collection and storage of data at any time with future effect. You can object to the collection and storage of your data by Google Analytics in the future by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

You can also prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be placed preventing the collection of your data when you visit this website in future: Disable Google Analytics (opt-out only works in the browser and only for this domain).

For further details on data processing by Google Analytics, please refer to the Google Analytics Terms of Usein the Security and Privacy Policy of Google Analytics and the Google Privacy Policy.

5.3. Functional cookies of data providers

5.3.1 FitAnalytics

We use the online size advisor from Fit Analytics GmbH, Voigtstrasse 3, 10247 Berlin, Germany (Fit Analytics) on our website to help you choose the right size during the ordering process. When using the Sizing Advisor, you may choose to provide Fit Analytics with the following data in order to receive a size recommendation:

Height
Weight
Body type (chest/waist)
Fit preferences (e.g. tighter or looser)
Age (optional)
Reference brand and item (optional)
Bra size (optional)

Your usage data are collected by Fit Analytics exclusively in anonymous form and are processed only for the purpose of calculating the clothing size that is suitable for you and continuously optimising the procedures underlying the recommendations. A so-called 'session cookie' is used for this purpose in order to display the size advisor correctly on your device.

When our website is used, Fit Analytics processes the anonymous IP address, browser information and operating system.

Your data will be stored on servers within the EU for the duration of your visit to our website and will not be passed on to third parties.

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your data in the future, you can click on the following link:

https://widget.fitanalytics.com/widget/optout/

For further details on data processing, please refer to Fit Analytics' data protection regulations: https://www.fitanalytics.com/files/Fit_Analytics_Privacy_Policy_Website.pdf

5.3.2 RichRelevance

We use the technology from RichRelevance Inc, 49 Stevenson Street, Suite 950, San Francisco, CA 94105, USA (RichRelevance), to present relevant product recommendations on our website. We use this technology to evaluate your usage and purchasing behaviour. RichRelevance is used to store cookies in your browser. The pseudonymous and hashed data collected by RichRelevance are used to create pseudonymous user profiles about your user and purchasing behaviour. The data are anonymous for RichRelevance because we do not keep any matching tables and the hash algorithm is known only to us.

The data collected using RichRelevance technology are not used to personally identify you on our website and are not merged with personal data pertaining to the bearer of the pseudonym.

RichRelevance uses an algorithm to analyse your user behaviour and can then provide customer product and service recommendations.

When our website is used, RichRelevance processes the clicks on product suggestions, user behaviour, purchasing behaviour, e-mail address (hashed) used to log in to Breuninger account and order ID (hashed).

Your data, which are anonymous for RichRelevance, are stored on servers in the USA and can be transferred to companies/service providers that support RichRelevance with their services. Your data are transmitted to servers in the USA on the basis of concluded EU standard contract clauses.

You can object to the collection and storage of data at any time with future effect. To object to the collection and storage of your data in the future, go to the privacy settings on our website and uncheck the box under Functional Cookies at RichRelevance.

For further details on data processing, please refer to RichRelevance's data protection regulations: https://richrelevance.com/privacy/

5.4. Mandatory cookies of data providers

5.4.1 SiteSpect

We use the A/B testing tool from STSP Europe B.V., De Corridor 27, 3621 ZA Breukelen, The Netherlands (SiteSpect) on our website. When this tool is used, you will be directed to different versions of our website to determine which of these versions best meets your needs. Cookies can be placed in your browser, which are required to track your user behaviour on the respective version.

When our website is used, SiteSpect processes the abbreviated IP address, browser information, usage data, user behaviour, user agent, SiteSpect ID and device information.

Your data will be stored for 13 months on servers within the EU and will not be passed on to third parties.

For further details on data processing, please refer to SiteSpect's data protection regulations: https://www.sitespect.com/website-privacy-policy/

5.4.2 Google Tag Manager

We use Google Tag Manager on our website. Google Tag Manager is a service from Google Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, which we use to manage our website tags via an interface. Google Tag Manager is a cookie-less domain that does not collect personal data. Google Tag Manager triggers other tags (cookies and pixels) that may in turn collect data. We draw your attention to this separately. Google Tag Manager does not access these data. If deactivation is effected by the user at the domain or cookie level, it will remain in place for all tracking tags implemented with Google Tag Manager

On the basis of technical protocols such as HTTPS, your browser sends personal data to Google Tag Manager, such as your IP address, device information and browser information, when you visit our website. However, Google Tag Manager does not collect or process these data.

5.4.3. Usercentrics

We use Usercentrics' Consent Management Platform to fulfil our legal obligation in accordance with Art. 7 (1) of the GDPR. It is operated by Usercentrics GmbH, Rosental 4, 80331 Munich, Germany. Usercentrics' Consent Management platform collects log file data, user agent (device, browser type, browser language, browser version, resolution) and consent data (consent yes/no, time stamp, data volume, data attributes, controller ID, processor ID, consent ID) via a JavaScript. This JavaScript enables Usercentrics to inform you about certain tags and web technologies on our website and to obtain, manage and document your consent. Thelegal basis for the processing of data is Art. 6 (1) c of the GDPR, as we are legally required to provide proof of consent (in accordance with Art. 7 (1) of the GDPR).

For further details on data processing, please refer to Usercentrics' data protection regulations: https://usercentrics.com/privacy-policy/

Section 6: Integration of YouTube videos

YouTube content is embedded on this website. YouTube is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ('Google'). The legal basis is Art. 6 (1) lit. f of the GDPR. Our legitimate interest is to provide you with video content about our company.

Enhanced data protection settings are enabled for YouTube videos that are embedded on our website. This means that YouTube does not gather information from visitors to our website unless they play the video.

Please note that when you start playback, your personal data (e.g. IP address) can also be accessed in non-EU/non-EEA countries ('third countries'), where the level of data protection is lower than in Germany.

When playing a YouTube video, you can also prevent tracking cookies from being stored by adjusting the appropriate settings in your browser software (as described above). However, if you do so, we cannot guarantee you will be able to use all the functions on this website to their full extent.

Further information on the purpose and scope of data collection and processing by YouTube can be found in the provider's data protection declarations. There you will also receive further information about your rights and setting options to protect your privacy. Address and data protection information from YouTube: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA https://policies.google.com/privacy?hl=en&gl=en

Section 7: Competitions

Purposes of processing and legal basis:

You have the opportunity to enter a range of different competitions on our website, in our newsletter, at our events, as part of our surveys and via the Breuninger app. Unless stated otherwise in a particular competition, or if you have not expressly granted us consent, we will use the personal data you provide us as a participant in the competition exclusively for the purposes of running the competition (for example, deciding the winner, informing the winner and sending out the prize).

The legal basis for processing data as part of a competition is Art. 6 (1) lit. b of the GDPR. If a declaration of consent is provided in the context of a competition, the legal basis for processing data on the basis of this declaration will be Article 6 (1) lit. a of the GDPR.

The provision of personal data is not a legal or contractual prerequisite. However, it is a requirement for participating in the competition. Failure to provide personal data may prevent you from participating in the competition. The competitions do not involve any automated decision-making processes, including profiling.

Recipients of the data:

As a matter of principle, your personal data will only be passed on internally in the event that the prize is sent or handed over by third parties such as lottery partners.

In addition, your personal data will be forwarded to Google LLC, USA, for data processing in competitions that span several channels as an exception so that the winner can be drawn automatically.

With regard to Google LLC, USA, no adequate level of data protection can be assumed due to processing in the USA. There is the risk that state authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. Please bear this in mind.

Storage duration:

The personal data of participants who do not win will be deleted at the end of the competition, after the winner has been announced. The winner's data will be saved for the duration of the competition as well as for the duration of the legal retention periods specified in the German Commercial Code (HGB) and German Tax Code (AO). If the prize is merchandise, the winner's data will be saved for the period that legal claims against warranty can be made, so that the prize can be repaired or replaced if defects are identified.

If you have given your consent within the framework of a competition, you can withdraw this consent at any time with future effect.

Section 8: Social media profiles/pages

Purpose of our processing and legal basis:

Breuninger operates social media profiles/pages on Facebook (https://de-de.facebook.com/breuninger.de) and Instagram (https://www.instagram.com/breuninger/). The purpose of our processing on our social media profiles/pages is to inform our customers about goods, offers, events, services, promotions, competitions, news about the company and the interaction with visitors to the social media profiles and our customers. The legal basis is Art. 6 (1) lit. f of the GDPR. Data are processed in the interest of our company to represent itself in social media, to respond to the enquiries and comments of our customers and site visitors and thus to ensure the satisfaction of our customers and site visitors.

The platform operator has no influence on our processing of your data within the scope of customer communication or competitions via our social media pages.

Recipients of the data:

We do not forward your personal data, e.g. the data you enter on our social media pages, such as comments, videos, pictures, likes and public messages, which are published via the social media platform, to third parties. We only reserve the right to delete content which is illegal, unlawful or has implications under criminal law, provided that this is necessary.

If, for example, you contact us by private message via our social media channels regarding your customer relationship, purchases or similar, these data are only passed on internally to our customer service department. In exceptional cases, data are processed by processors on our behalf. They are each carefully selected, audited by us and are contractually bound in accordance with Art. 28 of the GDPR. If it is necessary to pass on your enquiry to contractual partners (e.g. manufacturers in case of complaints) for processing, we will render your enquiry anonymous. If, in individual cases, the transfer of your personal data should appear expedient, we will inform you of this in advance and ask you for your consent. We will not pass on your data to third parties for these purposes without your consent.

Storage duration:

All personal information that you send us confidentially (e.g. as a private message) via our social media profiles/pages will be deleted after the final response to your request has been sent. All public posts by you on our social media profiles/pages remain in the timeline indefinitely, unless we delete them due to a legal violation or you delete the post yourself.

We have no influence on deletion by the platform operator itself. Please note the data protection information of the respective platform operator, Facebook: https://www.facebook.com/policy.php, Instagram: https://www.facebook.com/help/instagram/519522125107875)

Joint controllers pursuant to Art. 26 (1) of the GDPR:

We are joint controllers to some extent with the platform operator of our social media profiles in accordance with Art. 26 (1) of the GDPR. This means that Breuninger and the platform operators are joint controllers for the web tracking methods used on the social media profiles/pages. The web tracking can be carried out regardless of whether you are logged in or registered with the social media platform. As described above, we have no influence on this (e.g. to prevent advertising tracking by the platform providers). With regard to Facebook and Instagram, no adequate level of data protection can be assumed due to processing in the USA. There is the risk that state authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. Please bear this in mind.

Section 9: Branch store

9.1. Click&Collect

When you pick up a package you ordered online at one of our branches from customer service, we ask you to provide data to identify the package and to authenticate you as its recipient.

The legal basis for this is Art. 6 (1) lit. b of the GDPR. By contract, we are obliged to hand over Click&Collect orders only to authorised persons. Data are only processed in order to inform customer service employees in the branch and to handle the package delivery or subsequent return, should this be requested. The data will not be stored.

9.2. Cameras in the branches

In the sales rooms of our stores, we occasionally use security cameras (recognisable by the posted pictograms). These data are processed in order to protect our customers and employees and to prevent and detect any criminal offences. The legal basis for this is Art. 6 (1) lit. f of the GDPR. We store the images obtained in this way for 48 hours. Maintenance companies commissioned by us may have access to the data in individual cases for installation and maintenance purposes. If necessary, corresponding recordings are passed on to law enforcement authorities in the case of criminal offences.

9.3. Perfumery and hairdressers

Purposes of processing and legal basis:

Provided that your consent has been obtained (legal basis in accordance with Art. 6 (1) lit. a of the GDPR), we use personal data to provide consultations and appointments tailored to your needs in our perfumeries and hairdressing salons (Art. 6 (1) lit. b of the GDPR). This essentially involves the following data types:

Perfumery:

Skin condition/type (legal basis: Art. 9 (2) lit. a of the GDPR)
Skin requirements as well as allergies and tolerance (legal basis: Art. 9 (2) lit. a of the GDPR)

Preferred products
Recommended test patterns
Date of birth
Contact details

Hairdressing salons:

Communication data, e.g. for arranging appointments
Address data such as name and address
Product-specific data on purchases, such as items you have purchased from us in the salon, so that we can recommend the right products to you on your subsequent visits
Contact history
Formulations and compatibility (legal basis: Art. 9 (2) lit. a of the GDPR)
Bonus points
Data from the Breuninger Card relationship, if available

Recipients of the data:

Access to your personal data is only granted to authorised employees who are entrusted with the performance of the above-mentioned services in the beauty sector. Your data will not be passed on to third parties.

Storage duration:

We only store your data for the duration of an active customer relationship. In our experience, this is 24 months after your last visit to the perfumeries and 18 months after your last visit to the hairdressing salons. In accordance with legal regulations, we retain data from business transactions that are relevant under tax and commercial law for ten years.

If you have given your consent, you can withdraw this consent at any time with future effect.

Section 10: Gastronomy

Purposes of processing and legal basis:

We use the personal data you provide us with for table reservations in order to reserve tables for you at Breuninger restaurants (legal basis: Art. 6 (1) lit. b) of the GDPR).

This specifically includes:

Identification data such as surname and first name
Communication data such as e-mail address or telephone number
In individual cases, intolerances and allergies that you inform us of voluntarily when making your reservation (legal basis: Art. 9 (2) lit. a of the GDPR)

If we accept your reservation by telephone, we will enter it in our reservation book. We use bookatable.com for online table reservations. If you make your reservation using bookatable.com, you will receive a confirmation e-mail from bookatable.com. We will contact you in case of changes or cancellations at short notice. If you grant us your consent for a reservation or a visit (legal basis: Art. 6 (1) lit. a of the GDPR, we will also use your e-mail address to contact you for advertising purposes via newsletter, e.g. to inform you about events.

Recipients of the data:

In principle, persons will only have access to your personal data if this is required for the services to be provided, such as Breuninger employees in your chosen restaurant so that they can carry out telephone and online table reservations. If you book your table using bookatable.com, bookatable.com, a carefully selected and contractually obliged partner, will also gain access to your personal data to the extent necessary.

Storage duration:

Data that you provide us with when you make a table reservation by telephone will be deleted within one calendar year. If you make an online reservation, your personal data will be deleted by bookatable.com after expiration of the deletion period indicated there (https://www.bookatable.com/de/privacy-policy).

Section 11: Data security

We take technical and organisational measures to ensure data security in order to protect your personal data from the risks associated with data transmission and to prevent them from falling into the hands of third parties.

Our data security policy is constantly updated to reflect the latest technological developments. If you provide personal data on our website, these are encrypted using an encryption protocol during transmission.

Section 12: Country-specific features

Our data processing may vary from country to country. Here you can inform yourself about the country-specific differences and additions to the above-mentioned data processing.

12.1. Austria

12.1.1 Payment control, creditworthiness and payment defaults

The service provider for payment control and credit checks in Austria isCRIF Bürgel GmbH, Diefenbachgasse 35-39, 1150 Vienna.

Detailed data protection information of CRIF Bürgel GmbH as set out in Art. 14 of the GDPR, particularly information about the business purpose, the purposes of data storage, the data recipients as well as your data protection rights with respect to CRIF Bürgel GmbH is available here www.crifbuergel.de/sites/default/files/information_nach_art._14_ds-gvo.pdf.

During our three-stage reminder procedure in the event of payment defaults, we continue to transfer unbalanced receivables to the collection company Liquida Inkasso, Lise-Meitner-Strasse 23, 74074 Heilbronn, Germany, for collection.

12.2. Switzerland

12.2.1 Payment control, creditworthiness and payment defaults

The service providers for payment control and credit checks in Switzerland are

CRIF Bürgel GmbH, Radlkoferstrasse 2, 81373 Munich, Germany, and CRIF AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland.

12.2.2 Delivery service

In order to provide better delivery services to our customers, we work with a third-party service provider who, in addition to handling customs clearance, also processes the parcel tracking numbers so that we can provide information on the parcel status to the respective customer.

Information about the third-party provider:
MeinEinkauf GmbH
Max-Stromeyer-Strasse 160
78467 Konstanz
Germany
The data controller can be contacted at [email protected]

12.2.3 Customs clearance

In order to handle customs clearance for you and to ensure smooth processing, we work with MeinEinkauf GmbH, Max-Stromeyer-Strasse 160, 78467 Konstanz, Germany.

Section 13: Updates to this Data Protection Declaration

Breuninger regularly reviews the Data Protection Declaration and will update it if necessary. We will inform you (e.g. on our website) of any changes to this Data Protection Declaration that are relevant for you.