Data Protection Information
Privacy Policy
–––––––––––––––––––––––––––––
1) Information about the collection of personal data and contact details of the controller
1.1 We are pleased that you are visiting our Kaufland.de website (hereinafter "website") and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.
1.2 The controller for data processing in the sense of the General Data Protection Regulation (GDPR) is DETR Handels UG (haftungsbeschränkt), Schriesheimer Straße 101, 68526 Ladenburg, Germany, Tel.: 017620030490, E-Mail: detr_kaufland@aliyun.com. The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Contacting us
When you contact us (e.g. via contact form or e-mail), personal data is collected; you can see which data this is from the contact form. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in answering your request in accordance with Art. 6 (1) lit. f GDPR. If your contact aims at concluding a contract, an additional legal basis for processing is Art. 6 (1) lit. b GDPR. Your data will be deleted after your request has been fully processed; this is the case if it can be inferred from the circumstances that the matter in question has been finally clarified and provided that no statutory retention obligations conflict with this.
3) Data processing for order fulfillment
3.1 Insofar as necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) lit. b GDPR.
If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data (name, address, e-mail address) provided by you during the order process in order to inform you personally about upcoming updates in a suitable communication channel (e.g. by post or e-mail) within the legally prescribed period, in accordance with our legal obligations to provide information under Art. 6 (1) lit. c GDPR. Your contact data will be used strictly for the purpose of communicating updates owed by us and will only be processed by us to the extent necessary for the respective information.
To process your order, we also work with the following service provider(s) who assist us in whole or in part with the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.
3.2 Payment processing is carried out by cflox GmbH, Habsburgerring 2, 50674 Cologne, to whom we pass on your information provided during the ordering process, together with the information about your order, in accordance with Art. 6 (1) lit. b GDPR. For payment processing, cflox GmbH may use other payment service providers, which will be communicated to you in the payment information on Kaufland.de. Your data will only be passed on for the purpose of payment processing via Kaufland.de and only to the extent necessary for this. Further information on Kaufland.de's privacy policy can be found at the following internet address: https://www.kaufland.de/rechtliches/datenschutz/
4) Rights of the data subject
4.1 The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:
- Right of access pursuant to Art. 15 GDPR: In particular, you have the right to obtain information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected by us from you, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you, as well as your right to be informed about what safeguards pursuant to Art. 46 GDPR exist when your data is transferred to third countries;
- Right to rectification pursuant to Art. 16 GDPR: You have the right to demand the immediate rectification of inaccurate data concerning you and/or the completion of incomplete data stored by us;
- Right to erasure pursuant to Art. 17 GDPR: You have the right to demand the erasure of your personal data if the conditions of Art. 17 (1) GDPR are met. However, this right does not exist, in particular, if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
- Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to demand the restriction of the processing of your personal data as long as the accuracy of your data contested by you is being verified, if you refuse the erasure of your data due to unlawful data processing and instead demand the restriction of the processing of your data, if you need your data for the establishment, exercise or defence of legal claims after we no longer need this data for the purpose for which it was collected or if you have objected to the processing for reasons relating to your particular situation, as long as it has not yet been determined whether our legitimate grounds outweigh yours;
- Right to information pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
- Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to request the transmission to another controller, insofar as this is technically feasible;
- Right to withdraw consent pursuant to Art. 7 (3) GDPR: You have the right to withdraw consent once given to the processing of data at any time with effect for the future. In the event of withdrawal, we will immediately delete the data concerned, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
- Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy.
4.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
5) Duration of storage of personal data
The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).
When personal data is processed on the basis of explicit consent pursuant to Art. 6 (1) lit. a GDPR, this data is stored until the data subject withdraws their consent.
If there are statutory retention periods for data that is processed within the framework of legal or quasi-legal obligations on the basis of Art. 6 (1) lit. b GDPR, this data will be routinely deleted after the retention periods have expired, unless it is no longer required for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in its continued storage.
When personal data is processed on the basis of Art. 6 (1) lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.
When personal data is processed for the purpose of direct marketing on the basis of Art. 6 (1) lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 (2) GDPR.
Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.