Data protection

This data protection information applies to data processing by
Otto (GmbH & Co KG)
Werner-Otto-Straße 1-7
22179 Hamburg
Germany

represented by the Managing Director(s):
Alexander Birken (Chairman)
Dr. Marcus Ackermann
Sebastian Klauke
Petra Scharner-Wolff
Kay Schiebur

Tel.: 040/64618724
E-Mail: krrrttd

for the following website: otto.de/jobs.

The company data protection officer(s) of the data controller can be contacted at
Otto (GmbH & Co KG)
- Datenschutzbeauftragter -
Werner-Otto-Straße 1-7
22179 Hamburg Germany
e-mail address: dtnschtzbftrgtrttgrpcm

3.1 Cookies - General information

3.1.1 Mandatory technically necessary cookies

Cookies are used on this website. Cookies are small text files that are automatically created by your browser and stored on your end device (laptop, tablet, smartphone or similar). Information is stored in the cookie that is related to the specific end device used. However, this does not mean that we gain direct knowledge of your identity. Some of the cookies we use are deleted at the end of the browser session (so-called session cookies).

According to legal requirements, the storage of information on end devices (desktops, mobile phones, tablets, etc.) - e.g. by setting cookies - and the retrieval of information from end devices (tracking) is only permitted if you have given your prior consent. However, consent does not have to be given if such storage/retrieval is necessary for the website to function. A necessity is given, for example, with regard to ensuring the following functionalities / achieving the following purposes:

• Ensuring system security
• Enabling settlement of partners.

With regard to data processing that is necessary for the operation of the website, you do not have the right to object.

3.2 Intervention options / browser settings
Of course, you can set up your browser so that it does not place our cookies on your end device. The help function in the menu bar of most web browsers explains how to prevent your browser from accepting new cookies, how to have your browser notify you when you receive a new cookie or how to delete all cookies you have already received and block them for all further ones.
To do this, please proceed as follows:

In Internet Explorer/Microsoft Edge:

1. In the "Extras" menu, select the item "Internet Options".
2. Click on the "Privacy" tab.
3. Now you can set the security settings for the Internet zone. Here, you can determine whether or not to accept or reject cookies and which ones.
4. Confirm your setting with "OK".

In Firefox:

1. In the "Extras" menu, select the item “Settings”.
2. Click on "Privacy".
3. Select the entry "Create according to user-defined settings" in the drop-down menu.
4. Now you can set whether cookies should be accepted, how long you want to keep these cookies, and add exceptions, which websites you always or never want to allow to use cookies.
5. Confirm your setting with "OK".

In Google Chrome:

1. Click on the Chrome menu in the browser toolbar.
2. Now select "Settings".
3. Click on "Show advanced settings".
4. Click on "Content settings" under "Privacy".
5. Under "Cookies" you can make the following settings for cookies:

• Delete cookies
• Block cookies by default
• Delete cookies and website data by default after having closed the browser
• Allow exceptions for cookies from specific websites or domains

If you would like to delete individual cookies set in your browser or find out which service providers / suppliers have set cookies in your browser, you can also do this via a "preference manager". Such a preference manager is available, for example, at www.youronlinechoices.com.

3.4 Further processing of tracking data for legitimate interests
3.4.1 Legitimate interests of OTTO / balancing of interests
We are entitled to further process Tracking Data that has been collected after consent has been granted based on legitimate interests. This further processing is based on the legal basis in Article 6(1)(f) GDPR (balancing of interests). To the extent that we process tracking data based on the legal basis in Article 6(1)(f) of the GDPR, we do so exclusively for purposes in the pursuit of which we have a legitimate interest. These legitimate interests include, among others, the processing of tracking data for the purpose of playing out individualized advertising on third-party sites and making product suggestions on this website. In connection with the further processing of tracking data, we do not process any data that is classified as particularly sensitive by the law in Article 9 GDPR (e.g. health data). Furthermore, we do not use the tracking data to create evaluation results that could be assigned to the areas particularly protected by Article 9 of the GDPR. We also do not make any automated decisions based on the tracking data that have legal effects on you as a user of the otto.de/jobs website or that significantly affect you in a similar way (e.g. individualized price adjustments based on your usage behaviour). In addition, the tracking data is subjected to pseudonymization by us - depending on its scope and the risks emanating from the processing of the tracking data for your rights to be protected - by which an allocation of the data to your person is prevented.

3.4.2 Consent for further advertising partners/ third party cookies
OTTO works with service providers who enable OTTO to display individualized advertising (e.g. retargeting) on third party sites. These service providers may - after you have given your consent - set cookies in your browser, for example, which enable your browser to be recognized on a website other than otto.de/jobs. Insofar as the service providers collect data about your usage behaviour on otto.de/jobs, we have agreed with these service providers that the data will be processed by the service providers exclusively for OTTO's purposes and / or to the extent that this is necessary for the provision of the service to OTTO.

4.1 Processors
We use processors in the course of processing your data. A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the data controller.

4.2 Other third party partners
In addition, we use other third party partners who are necessary for the provision of services and the achievement of various purposes. We transfer personal data to these third party partners if this is necessary within the scope of the service provision.
The legal basis for this data transfer is Article 6(1)(b), (f) GDPR.

We use social plugins from the social networks Facebook, YouTube, Pinterest, Twitter, Instagram and WhatsApp on our website on the basis of Article 6 (1) (f) of the General Data Protection Regulation (GDPR) in order to raise awareness of our company. The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for data protection-compliant operation is to be ensured by their respective providers.
The purpose and scope of the data collection and the further processing and use of the data by the respective provider as well as your rights in this regard and setting options for protecting your privacy can be found in the respective data protection information of the provider, which we link to below.
By logging out of the pages of social networks beforehand and deleting cookies that have been set, you can prevent social networks from assigning the information collected about you to your user account with the respective social network during your visit to this website. If you do not want social networks to directly assign the data collected via our website to your profile, you must log out of the corresponding social networks before visiting our website.

5.1. Facebook und YouTube
Social plugins from Facebook and YouTube (Google) are used on this website. These are offers from the US companies Facebook and Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google")).
When you visit a page that contains such a plugin, your browser establishes a connection to Facebook or YouTube and the content is loaded from these pages. Your visit to this website may thus be tracked by Facebook and YouTube, even if you do not actively use the social plugin function. If you have an account with Facebook or YouTube, you can use such a social plugin and thus share information with your friends. We have no influence on the content of the plugins and the transmission of information.
On their websites, Facebook and Google provide detailed information on the scope, type, purpose and further processing of your data. Here you will also find further information on your rights and setting options to protect your privacy.
You can find Facebook's data protection information here and Google's data protection information here.

5.2 X (Twitter)
Functions of the X (Twitter)service are also integrated on this website. These functions are offered by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ("Twitter"). By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transferred to Twitter in the process. For this purpose, your internet browser establishes a direct connection to Twitter's servers and transmits data to Twitter.
We would like to point out that we have no knowledge of the content of the transmitted data or its use by Twitter. You can find more information on this here in Twitter's privacy policy.
You can change your Twitter privacy settings here in the account settings.

5.3 WhatsApp
This website also uses a WhatsApp button (WhatsApp share button). This button allows you to share content from this page via the WhatsApp application on your mobile phone. The button is a hyperlink. When the button appears on this website, no personal data is yet transmitted to the operator of WhatsApp or other third parties. As soon as you use the WhatsApp button, the operator of WhatsApp learns what content is being shared and that the button has been used on this website. More information on the handling of personal data by the operator of WhatsApp can be found here in the operator's privacy policy.

For individual job advertisements, you have the opportunity to register for an exchange appointment with the specific department and / or OTTO HR if you are interested in a specific position or to book an interview slot to find out more about the position and clarify open questions in a personal interview. We process your personal data (name, email address and availability) exclusively for the purpose of making an appointment and carrying out the interview.

The legal basis for this data processing is Article 6(1)(f) GDPR.

You have the possibility to contact us in several ways. By e-mail, by WhatsApp, by telephone, by form or by post. When you contact us, we use the personal data that you voluntarily provide in this context solely for the purpose of contacting you and processing your enquiry.

The legal basis for this data processing is Article 6(1)(a), Article 6(1)(b), Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

At various points you have the opportunity to publish your own content on otto.de/jobs (e.g. comments etc.). When you post a comment or feedback, we process the personal data that you voluntarily enter as part of the comment. In principle, you can publish content on otto.de/jobs under a pseudonym and / or your first name and shortened surname.

The legal basis for this data processing is Article 6(1)(a) GDPR.

On this page you have the opportunity to apply for open positions. Below we would like to provide you with information on the processing of your personal data in connection with an application.

10.1 Data processing to carry out the application process
If you apply to us via our career portal for a vacant position, we process the following data from you to carry out the application process and a possible employment with us: Gender, first name, last name, e-mail address, date of birth, application documents (CV, cover letter) and any other optional information.
We process the data that you have sent us in connection with your application in order to check your suitability for the position (or, if applicable, other open positions in our companies - if your consent is required here in accordance with the legal basis, we will obtain this beforehand) and to carry out the application process. If further data is processed as part of the current application process, we will inform you of this separately.
The legal basis for the processing of your personal data in this application procedure is primarily Section 26 BDSG and Article 6(1)(a) GDPR. According to this, the processing of data required in connection with the decision on the establishment of an employment relationship is permissible.
Should the data be required for legal prosecution after the application procedure has been completed, data processing may be carried out on the basis of the requirements of Article 6 GDPR, in particular to safeguard legitimate interests pursuant to Article 6(1)(f) GDPR. Our interest then consists in the assertion or defence of claims. Furthermore, in individual cases we are obliged to match your data with personal sanctions lists / embargoes (Article 6(1)(c) GDPR). In the application process for filling particularly risk-sensitive positions, we carry out a validation of your details and obtain further additional relevant security information. The legal basis for this is Article 6(1)(a) GDPR.
If you use the options of automatic transfer of personal data from portals such as XING or via an upload of your CV, your data will be transferred to OTTO once per update. There is no permanent connection to the portals and upload options. Security procedures, such as data encryption and access controls, are of course used to protect the confidentiality of your data.

10.2 Duration of storage of applicant
data: In principle, your application data will be stored for a period of 6 months. In the event of a rejection, this data will then be anonymized. If you have consented to us continuing to store your personal information, we will transfer your personal information to our Talent Management System. There, the data will be deleted after two years. You can find more information on the Talent Management System under point 9 of this data protection information. Employee
data: If you have been accepted for a position as part of the application process, the data will be transferred from the application data system to our HR master data system. In principle, the data is then stored for the duration of the employment relationship, unless longer retention periods are provided for by law.

10.3 Recipients of applicant data
Your applicant data will be viewed by the HR department after receipt of your application. Suitable applications will then be forwarded internally to the persons responsible for the respective open position. If consent is required by law and we have it, the application documents may also be forwarded to other responsible persons from other departments. In principle, only those persons in the company have access to your data who need it for the proper conduct of our application procedure. This also includes the members of the employee representation. In the course of system maintenance and servicing, your data may come to the attention of the persons entrusted with it. The relevant persons or, if applicable, the service providers used are obliged to maintain data secrecy.

In some cases we offer you the opportunity to be admitted to the Otto Group's internal Talent Pool System. The Otto Group Talent Pool System serves to identify, retain and promote talented individuals and to ensure succession by actively promoting internal mobility within the Otto Group. If you have consented to the transfer of your data to other Otto Group companies and have therefore decided to store your data in the Otto Group Talent Pool System, we will transfer the data that you provided when creating your profile to Otto (GmbH & Co KG) (hereinafter OTTO), which will store it in the Otto Group Talent Pool System. With regard to the inclusion of your person in the internal Otto Group Talent Pool System and the provision of the Otto Group Talent Pool System, we are jointly responsible with Otto (GmbH & Co KG) and the other Otto Group companies that participate in the internal Otto Group Talent Pool System. We are primarily responsible for the collection, transmission and registration of your data and OTTO for the storage of your data and provision of the Otto Group Talent Pool System. After Otto (GmbH & Co KG) has transmitted your data to the companies participating in the Otto Group Talent Pool System, the Group companies process this data as data controllers under data protection law, e.g. for the purpose of establishing contact to you. A potential application process then normally takes place directly via the company's processes in this area.

Data processing is based on your consent (Article 6(1)(a) GDPR). You can revoke your consent at any time by sending an email to yournextmove@ottogroup.com.

We and OTTO are available to you with regard to the processing under joint responsibility as central contact persons each in their own area of activity. If you have any questions regarding data protection and to assert your rights as a data subject, please contact yournextmove@ottogroup.com. You can also assert your data subject rights against us. If you contact us, we will coordinate with you in accordance with the joint controllership agreement in order to respond to your request and ensure the execution of your data subject rights.

With the exception of the processing operations for which we provide information about the possibility of transferring data to recipients based outside the EU in this information on data protection, we do not transfer your data to recipients based outside the European Union or the European Economic Area. The data transfers take place on the basis of so-called standard contractual clauses of the EU Commission.

The duration of the storage of the data collected about you depends on the purpose for which we process the data. The data is stored for as long as is necessary to achieve the purpose for which it was collected. Insofar as we have to store certain categories of data for a certain period of time due to legal obligations (e.g. obligations under tax law), the continued storage of the data after its storage is no longer necessary for the achievement of the respective purpose is exclusively for the purpose of fulfilling the legal obligation. In this case, the data will be blocked for access.
Exemplary naming of storage periods:

• Consents: Permanent storage as long as the consents are used continuously (e.g. permanent sending of email newsletters).
• Tracking data: 2 years.
• Data for the purpose of implementing (advertising) objections: Unlimited storage.