Privacy Policy

We (Woolworth GmbH) would like to inform you about our company’s approach to data protection. Our data protection information has a modular structure. It is made up of the general section with general data protection information about the processing of your data (Part A: general section) and a special section which relates exclusively to the processing situations outlined therein (Part B: special section).

Part A: general section

1. Name and contact details of the data controller
2. Name and contact details of the data protection officer
3. Data subject rights and right to complain
4. Voluntary nature of data provision
5. Transfer of personal data to third countries

Part B: special section

1. Website
2. Cookies
3. Contact form
4. Newsletter
5. Application
6. Video surveillance
7. Competitions
8. Customers

The data controller is:

Woolworth GmbH
Mönninghoffs Feld 5
59425 Unna, Germany
Tel. +49 2303 5938 100

Email: datenschutz@woolworth.de

The data protection officer of the data controller is:

RuhrDatenschutz Consulting
Rechtsanwältin Inken Schlewing
Kaiserstr. 21-23
44135 Dortmund, Germany
Tel.: +49 231 22819010

Email: datenschutz@ruhr-dsc.eu

According to Art. 15 GPDR, you have the right to receive information regarding the data stored about you. If incorrect personal data is processed, you have a right to correction in line with Art. 16 GDPR. If the legal requirements are met, you can request deletion or restriction of processing, as well as object to the processing of your data (Art. 17, 18 and 21 GDPR). According to Art. 20 GDPR, you can assert your right to data portability for data processed automatically based on your consent or a contract you have signed. You can assert these rights vis-à-vis Woolworth GmbH via the address specified under “Name and contact details of the data controller”. If you believe that an instance of data processing violates data protection law, you may submit a complaint to a data protection supervisory authority of your choice (Art. 77 GDPR in conjunction with § 19 BDSG). This also includes the data protection supervisory authority competent for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, https://www.ldi.nrw.de/kontakt/ihre-beschwerde.

We do not require you to provide us with personal data before you can conclude a contract with us. You as a customer are also under no legal or contractual obligation to provide us with your personal data; however, we may be limited in our ability, or even unable, to offer certain online services if you fail to provide the requisite data for this.

As a general rule, your data is not transmitted to third countries. In the exceptional event that such a transfer is necessary, we will make express reference to this at the relevant point.

1.1. Categories of personal data

When you visit our website for information, we collect, store and process your personal data. When you visit our website, server log files are stored on our web server temporarily and in anonymized form. These include:

• the page from which this page was requested (referrer URL)
• the name and URL of the requested page
• the date and time of the request
• the description of the type, language and version of the browser used
• the IP address of the requesting computer, which is truncated to prevent the possibility of personal identification
• the amount of data transmitted
• the operating system
• an update about whether the request was successful (access status / Http status code)
• the time zone relative to GMT

1.2. Purposes and legal bases for the processing of personal data

 We process the data described in greater detail above only to the extent necessary. The log files are processed exclusively for statistical purposes and to improve the quality of our website, in particular with regard to the stability and security of the connection (legal basis is Art. 6 (1) (1) (f) GDPR). The specified purposes are the same as our legitimate interests.

1.3. Data recipients or categories of recipients

Within our company, the only offices that receive access to your data are those that require the data to fulfil the company’s duties. The website is hosted by crossconcept GmbH, Königswall 44,D-44137 Dortmund, Germany, datenschutz@crossconcept.de, gehostet. The host receives the above-mentioned data in its role as a data processor.

1.4. Storage period and criteria for determining the storage period

The data is deleted as soon as it ceases to be required for the purpose for which it was collected. In the provision of the website, this takes place when the respective session is ended. For a maximum of 24 hours, the log files are stored so as to be directly and exclusively accessible by administrators. After this, it can only be accessed indirectly through reconstruction of back-up tapes and is permanently deleted after a maximum of four weeks.

1.5. Right to object in line with Art. 21 (1) GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1) (f) GDPR. The objection does not need to follow a particular form. It should ideally be submitted to: Woolworth GmbH, Mönninghoffs Feld 5, 59425 Unna, Germany, Tel. +49 2303 5938 100, datenschutz@woolworth.de. The data controller will then cease to process the personal data unless it can prove compelling, legitimate grounds for processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise, or defense of legal claims. The collection of data for the provision of the website and the storage of log files are essential for the operation of the website.

2.1. General information

In addition to the above-mentioned data, we use technical aids on our website to provide various features, in particular cookies, which may be saved on your device. When you visit our website and at any time after that, you can decide whether to allow cookies generally and select individual additional features. You can change this in your browser settings or via our consent manager. In the following, we describe cookies from a technical perspective (2.) before outlining your options in greater detail by describing strictly necessary cookies (3.) and optional cookies (4.).

2.2. Cookies from a technical perspective

Cookies are text files or information in a database which are saved on your hard disk and allocated to your browser so that the organization placing the cookie receives certain information. Cookies cannot run programs or infect your computer with viruses; they mainly serve to make our Internet services faster and more user-friendly. This website uses the following types of cookie, the function and legal basis of which we will explain below:

• Transient cookies: This type of cookie, especially session cookies, is deleted automatically when you log out or close the browser. They contain a session ID. This allows various queries from your browser to be allocated to the joint session and your computer to be identified when you return to our website.
• Persistent cookies: These are deleted automatically after a specified period of time, which is determined differently depending on the cookie. You can view the placed cookies and their durations, and delete the cookies manually, in your browser’s settings at any time.

2.3. Essential functions which are technically necessary to present the website

The technical structure of the website requires us to use certain technologies, in particular cookies. Without these technologies, our website cannot (fully and accurately) be displayed and support functions cannot be offered. These are generally transient cookies which are deleted at the end of your visit to the website, or at the latest when you close your browser. You cannot deactivate these cookies if you wish to use our website. You can view the individual cookies in the consent manager. The legal basis of this processing is Art. 6 (1) (1) (f) GDPR.

2.4. Optional cookies with your consent

There are various cookies which we only place with your consent, which you can manage on your first visit to our website using the cookie consent tool. These functions are only activated with your consent and can help us in particular to analyze and improve visits to our website, make the website easier for you to use with various browsers and devices, recognize you upon later visits or advertize to you (also, if applicable, to orient our ads to your interests, measure the impact of ads and display targeted ads). The legal basis of this processing is Art. 6 (1) (1) (a) GDPR. You can revoke your consent at any time; this does not affect the lawfulness of processing prior to the revocation.

2.5. Selection and withdrawal

Below we will describe the functions we use, which you can select and subsequently revoke individually via the consent manager.

3.1. Categories of personal data

If you contact us via email or our contact form for customer service or expansion, the data you disclose in this context will be processed (e.g. first name, last name, address, email address, time of contact, your issue and your message).

3.2. Purposes and legal bases for processing

Data entered in the contact form is processed in the interest of handling your query or property recommendation. The legal basis is Art. 6 (1) (1) (b) or (f) GDPR.

3.3. Data recipients or categories of recipients

Within our company, the only offices that receive access to your data are those that require the data to process your query. The website is hosted by crossconcept GmbH, Königswall 44,D-44137 Dortmund, Germany (datenschutz@crossconcept.de). The host receives the above-mentioned data in its role as a data processor.

3.4. Storage period and criteria for determining the storage period

If the query relates to a contract, we delete the data disclosed therein according to the deadlines for the contractual term, otherwise we delete data once storage ceases to be necessary or limit processing should there be a statutory storage obligation.

4.1. Categories of personal data

Along with the purely informative use of our website, we also offer a subscription to our newsletter which informs you of our latest promos and events. Your name, email address and zip code are mandatory, as these allow us to address you personally and send you a newsletter which is tailored to your local area. We also save the IP addresses you use as well as the times of your registration and confirmation.

4.2. Purpose and legal basis of data processing

Newsletter data is processed for the purpose of sending the newsletter. In the process of signing up for our newsletter, you consent to the processing of your personal data (legal basis is Art. 6 (1) (a) GDPR). We use the double opt-in procedure for signup to our newsletter. This means that we write to you via the email address you provide to us in order to request confirmation that you want to receive the newsletter. This procedure is designed to create proof of your registration and, if necessary, elucidate any misuse of your personal data.

4.3. Duration of data processing

If you fail to confirm your registration within 24 hours, your information will be blocked and automatically deleted. You may revoke your consent to receiving the newsletter and unsubscribe from the newsletter at any time. You can revoke your consent by opening the link provided in every newsletter email and by writing to the contact details provided in the legal notice.

4.4. Transmitting personal data to third parties

Within our company, the only offices that receive access to your data are those that require the data to process your query. We have commissioned GetResponse S.A., Grunwaldzka 413 80-309, Gdansk, Poland (privacy@getresponse.com) with the delivery of the newsletter. As the data processor, the service provider receives the above-mentioned data. The website is hosted by crossconcept GmbH, Königswall 44,D-44137 Dortmund, Germany (datenschutz@crossconcept.de). The host receives the above-mentioned data in its role as a data processor.

5.1. General information

We are pleased that you are interested in Woolworth GmbH and wish to apply for a position at our company. In the following, we will provide you with information on the processing of your personal data in the context of your application for employment at Woolworth GmbH.

5.2. Personal data processed

We collect and use the following personal data in the context of the application process

• Name
• Date of birth
• Address
• Email address
• Phone number
• Details of school education
• Details of professional qualifications/training
• If applicable, other data you provide to us in the context of your application

5.3. Purpose and legal basis of data processing

The main legal basis for the processing of your personal data is § 26 BDSG in conjunction with Art. 6 (1) (1) (b) GDPR, according to which data processing is permitted if it is necessary for the initiation of an employment relationship. If the data is required after the application process, e.g. for prosecution, data processing may take place based on the requirements of Art. 6 GDPR, in particular for safeguarding of legitimate interests according to Art. 6 (1) (f) GDPR. In this case, our interest lies in the assertion or defense of claims.

If you send us your application via WhatsApp, your use of this app is based on express consent according to Art. 6 (1) (1) (a) GDPR in conjunction with Art. 49 GDPR, which is requested before you send the application.

5.4. Duration of data processing

In principle, your personal data is only stored for as long as it is required to conduct the application process. If we do not have any vacancies that fit your profile, we will delete all of your data no later than 6 months after informing you of your unsuccessful application. If you have consented to being included in our applicant pool, we will delete your data after 12 months at the latest if we fail to find a suitable vacancy during this period. If we take you on as an employee, we will only store the data required for the execution of the employment contract. We will delete any other data immediately upon your employment.

If you send your application via WhatsApp, you may revoke your consent and/or object to further processing at any time. This will not result in any disadvantages for you. In this case, the application process can be continued on our online portal.

5.5. Transmitting personal data to third parties

Within our company, the only offices that receive access to your data are those that require the data to process your application.

We use specialist software provider d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, Germany (+ 49 (0) 40 37 47 99 0; kontakt@dvinci.de) for the online application process.

This company will act as a service provider for us and may also gain knowledge of your personal data in its maintenance and upkeep of our systems. We have concluded a data processing agreement with this provider which ensures that any data processing is carried out in a lawful manner.

In principle, you can also send us your application via WhatsApp. For this we use PitchYou GmbH, Campusallee 9, D-51379 Leverkusen, Germany (info@pitchyou.de), which receives your data as a data processor. If you use this app, your personal data may be transmitted to the US-based servers of the app’s operator. We would like to point out that the USA is not a secure third country according to EU data protection law. US-based companies are obliged to surrender personal data to security agencies without any legal recourse for you. Therefore, we cannot rule out the possibility of US agencies (e.g. secret services) processing, analyzing and permanently storing your data located on US-based servers for surveillance purposes. We have no influence over these processing activities.

If you apply for a vacancy with us via a recruiter, we will pass onto this recruiter any data required to process our contract with the recruiter. Of course, the recruiters are sworn to secrecy by us.

6.1. Recording of images

We record images in the publicly accessible sales areas and in the checkout area of our stores. We also record images on our administrative premises and in the publicly accessible area of the administration building.

6.2. Purpose and legal basis of data processing

Images are recorded in order to prevent and investigate burglaries, thefts, vandalism and other breaches of the law. The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f) GDPR. According to this, the processing of data is permitted if this is necessary for the protection of property and the protection of persons. Our legitimate interests in this case are the preservation of evidence for the enforcement of legal claims, the prevention and prosecution of criminal offenses and the enforcement of domiciliary rights.

6.3. Duration of data processing

In principle, your personal data will only be stored for as long as is necessary to pursue the purposes stated above. The standard storage period is 72 hours. In the event of a specific suspected case, data may be stored for a longer period of time for the purpose of clarification. This may not be the case if specific events (e.g. damage to property, theft or burglary) require longer storage for the purposes stated above (e.g. preservation of evidence or assertion of civil law claims). In this case, the data will be stored for the duration of the assertion and clarification of legal claims

6.4. Transfer of personal data to third parties

Internally, only the employees responsible for processing the data have access to the recordings and your data. In the event of a suspected criminal offense, the recordings may be passed on to the law enforcement authorities. For legal and criminal prosecution, the recordings may also be passed on to other bodies such as experts, lawyers and other legal representatives and courts as evidence. The data will only be transmitted confidentially and will only be accessible to the persons required for the intended purpose.

6.5. Place of data processing

The image recordings are stored decentrally on hard disks and on our own servers in Germany.

7.1. Categories of personal data

We collect and use the following personal data to conduct competitions

• First name, surname
• Date of birth
• Email address
• Address
• IP addresses
• Gender
• Place of birth
• Zip code
• Country
• Profile question
• Time of registration
• Main branch/traffic source

7.2. Purpose and legal basis of data processing

In the context of competitions, we process your data for marketing purposes with the ultimate goal of advertising our products. Your data is processed for the following purposes specifically:

• Managing competition entrants
• Important information via email (notification of winners) and direct advertising.

In the context of competitions, the legal basis for the processing of your personal data by the responsible authority is Art. 6 (1) (b) GDPR, according to which your personal data may be processed if and to the extent to which this is necessary for the fulfilment of our contractual obligations towards you. This also applies to any processing which is essential in allowing us to carry out any precontractual measures in response to your query. You can find more detailed information about this in our entry conditions, which you were informed of in the context of your participation. Before participating, you were expressly informed of your transfer of the rights to this data to us. This means that your personal data may be processed if and to the extent to which this is necessary for the fulfilment of our contractual obligations towards one another. Furthermore, this marketing measure constitutes permissible direct advertising which is in our legitimate interest and thus serves as a legal basis for the processing of your data. Any transmission of your data for advertising purposes or creation and publication of photos which goes beyond the agreement in the entry conditions will only take place with your express consent, which you can revoke at any time with future effect by informal notification to the responsible authority specified above.

7.3. Duration of data processing

We delete the data immediately once it is no longer required for the above-mentioned purposes. The data is generally deleted 3 months after the end of the competition. Legal requirements dictate that we must store this data for longer under some circumstances. In this case, the data may only be accessed for the purposes prescribed by law.

7.4. Transmitting personal data to third parties

Within our company, the only offices that receive access to your data are those that require the data to process your entry in the competition.

Within our company, the only offices that receive access to your data are those that require the data to process your entry in the competition. We have tasked Basebuilder B.V., Parijsboulevard 143B, 3541 CS Utrecht, Netherlands (b.kampstra@daisycon.com) with conducting the competitions. As the data processor, the service provider receives the above-mentioned data.

7.5. Right to object in line with Art. 21 (1) GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1) (f) GDPR. The objection does not need to follow a particular form. It should ideally be submitted to: Woolworth GmbH, Mönninghoffs Feld 5, 59425 Unna, Germany, Tel. +49 2303 5938 100, datenschutz@woolworth.de. The data controller will then cease to process the personal data unless it can prove compelling, legitimate grounds for processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise, or defense of legal claims.

8.1. Categories of personal data

We would like to offer you as a customer the best possible service when shopping in our stores. This also includes the return, exchange and return of goods. In order to be able to offer you this service, we need to process your personal data. We process the personal data that you provide to us by telephone, email or in person. If you have goods returned to our store, we will use your name for the return. If you make use of the option to exchange or return items purchased from Woolworth's in our stores, we work with corresponding exchange or complaint receipts for internal documentation. You must enter your name, address and signature on these.

8.2. Purpose and legal basis of processing

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b) GDPR in the event of a complaint. Accordingly, the processing of data is permitted if this is necessary for the establishment, execution or termination of a contractual relationship. In the case of an exchange made possible as a gesture of goodwill, the legal basis is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. We collect the data in order to prevent and detect possible exchange manipulation. These purposes also constitute our legitimate interest.

8.3. Duration of data processing

In principle, your personal data will only be stored for as long as is necessary to achieve the above purposes. When goods are returned, your data will therefore be deleted immediately upon collection of the goods, but at the latest upon expiry of the retention period. For exchange and complaint documents, Woolworth is subject to proof and retention obligations under the German Commercial Code and the German Fiscal Code. The retention and documentation periods stipulated there are six years in accordance with commercial law requirements under Section 257 HGB and up to ten years due to tax requirements under Section 147 AO. Once the mandatory retention period has expired, the data is deleted immediately.

8.4. Transfer of personal data to third parties

The exchange or complaint documents may be transmitted to tax consultants, tax authorities and auditors.

8.5. Right to object pursuant to Art. 21 para. 1 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (f) of Article 6(1) GDPR. The objection can be made informally and should preferably be addressed to Woolworth GmbH, Mönninghoffs Feld 5, 59425 Unna, Tel. +49 2303 5938 100, datenschutz@woolworth.de . The controller will then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.