Privacy

Data Protection Notices

 

 

1. General Information

 

a) Introduction

Thank you for your interest in our website and our online services. Data is the basis for us to provide an excellent service. However, our most important asset is the trust of our customers. Protecting customer data and using it only in the way our customers expect from us is our highest priority. Therefore the following data protection notices are designed to inform you about the processing of your personal data and your rights regarding this processing according to the General Data Protection Regulation (“GDPR”) and additional data protection laws.

 

b) Controller

We, the METRO AG, Metro-Straße 1, 40235 Düsseldorf, Germany are the controller according to the GDPR and therefore responsible for the data processing explained herein.

 

c) Data Protection Officer

You can contact our data protection officer at any time by using the following contact details:

·       METRO AG, Data Protection Officer, Metro-Straße 1, 40235 Germany, email: datenschutz@metro.de

 

 

2. Processing of Personal Data During Your Use of Our Website

 

Your visit to our website and use of our online services will be logged. The IP address currently used by your terminal device (for example your computer or your mobile phone), date and time, the browser type and operating system of your terminal device and the pages accessed are recorded. This data is collected for the purposes of data security and to optimize and to improve our online services. The processing is legally based on Art. 6 paragraph 1 sentence 1 letter f) GDPR. It is in our legitimate interest to protect our website and to improve our services. Any other processing of the data, with the exception of for statistical purposes in anonymous form, is only carried out within the scope of this data protection notices.

 

a) Language Selection

 

We use your browser language and IP address for the preselection of the relevant website language. The processing is legally based on Art. 6 paragraph 1 sentence 1 letter b) GDPR in order to enable you to use our website services.

 

b) Cookies and Tracking

 

In order to make your visit to our website more appealing and to enable the use of certain functions, we use so-called “cookies” on various pages. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your terminal and enable us or our partner companies to recognize your browser on your next visit (persistent cookies). You can set your browser in such a way that you are informed about the setting of cookies separately and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally. For more information, see the help function of your Internet browser. If cookies are not accepted, the functionality of our website may be limited. In the following we will deal with specific cookies.

 

We distinguish between necessary cookies and not necessary cookies. Necessary cookies are required for proper operation of our website. Rejecting these cookies will change your user experience while browsing our website and certain services on our website will therefore not be usable.

 

Not necessary cookies are described hereinafter. We have split these cookies into two different categories: “Statistics” and “Marketing”. In the following, we will assign each feature using such cookies to the respective category. By clicking the “Accept” button on our “cookie-banner”, you consent to the processing of data through these cookies, in the respective cookie categories you have chosen. The processing is legally based on Art. 6 paragraph 1 sentence 1 letter a) GDPR, unless otherwise stated below.

 

1) Google Analytics (Statistics)

 

We use Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, in order to analyse the use of our website and to improve the website. For this purpose, we use cookies which will be stored in your terminal device and which collect anonymous information about your use of our website, such as the frequency of your visit to our website, the time you spent on it and how you interacted with the website (e.g. if you have purchased or searched on the website). The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. However, your IP address will be shortened by Google within the European Union or the European Economic Area before any further transfer. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The appropriate level of data protection for this data transfer is ensured by standard contractual clauses.

Google will use this information on our behalf, to evaluate your use of the website, to provide reports on website activities (such as loading times, etc.) and to provide us with further services related to website and internet use. We will use this information and reports to improve our website.

The IP address transmitted by your browser within the context of Google Analytics is not merged with other Google data. We receive anonymised data and will at no time combine this with other data available to us.

The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.

You can also prevent Google from collecting the data generated by the cookies and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en

 

_gid

Cookie is placed by: Google Analytics

The functionality is: to store and count pageviews.

Expiration period: 1 day

Stored personal data: Unknown

All infos: https://cookiedatabase.org/cookie/google-analytics/_gid

 

_ga

Cookie is used by: Google Analytics

The functionality is: to store and count pageviews.

Expiration period: 2 years

Stored personal data: Unknown

All infos: https://cookiedatabase.org/cookie/google-analytics/_ga/

 

2) Doubleclick by Google (Marketing)

 

With Doubleclick by Google we use a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (“Google”) to show relevant ads to you. Cookies that do not contain any personal information are used for this purpose. In these cookies it is noted which websites the user visits, which contents he is interested in and which offers the user has clicked, furthermore technical information about the browser and operating system, referring websites, visiting time as well as further information about the use of the online offer. The IP address of the user is also collected, whereby this is shortened within member states of the European Union or the European Economic Area and only in exceptional cases is it transmitted in full to a Google server in the USA and shortened there. Google may also link the above information to such information from other sources. Doubleclick cookies use a pseudonymous identification number assigned to your browser to check whether ads are displayed and clicked on. This enables Google and its partner sites to serve ads based on previous visits to METRO pages or other websites. The information generated by Doubleclick cookies is transmitted to and stored by Google on servers in the United States of America. The data will only be transferred to third parties within the framework of legal regulations or order data processing. If you agree to the storage of cookies, but do not wish to use Doubleclick cookies, you can do so under the following link: https://www.google.com/settings/ads/onweb/ to download and install a browser plug-in that disables Doubleclick by Google service.

 

IDE

The functionality is: to provide ad delivery or retargeting.

Expiration period: 2 years

Stored personal data: Unknown

All infos: https://cookiedatabase.org/cookie/google-doubleclick/ide/

 

NID

The functionality is: to provide ad delivery or retargeting, store user preferences.

Expiration period: 6 months

Stored data: user ID

All infos: https://cookiedatabase.org/cookie/google-ads-optimization/nid/

 

3) Facebook Pixel (Marketing)

 

We use Facebook Pixel, a tool operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based in the EU, by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"), on our website for the analysis, optimization and economic operation of the website. With the help of Facebook Pixel, Facebook is able to determine the visitors of our website as a target group for the presentation of Facebook ads. Accordingly, we use Facebook Pixel to display the Facebook ads we post only to Facebook users who have shown an interest in our website. This means that with the help of Facebook Pixel we want to make sure that our Facebook ads correspond to the potential interest of the users and are not annoying. We can also use Facebook Pixel to track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users have been redirected to our website after clicking on a Facebook ad (so-called "conversion" or "visitor interaction"). Facebook Pixel is deployed by Facebook directly when you visit our website and can store a cookie on your device. If you then log in to Facebook or visit Facebook while being logged in, the visit to our website will be recorded in your profile. The data collected about you is anonymous to us, so it does not provide us with any information about the identity of the users. However, Facebook stores and processes the data so that a connection to the respective user profile is possible. This means that user profiles can be created from the processed data. Facebook processes the data in accordance with Facebook's Privacy Policy. You can find more information on how Facebook Pixel works and in general on how Facebook ads are displayed in Facebook's Privacy Policy: https://www.facebook.com/policy.

You may opt out of Facebook pixel collection and use of your information to display Facebook ads. To configure what types of ads you see within Facebook, you can go to the page set up by Facebook and follow the instructions on the settings for usage-based ads: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

You may also object to the use of cookies for tracking and advertising purposes via the Network Advertising Initiative's opt-out page http://optout.networkadvertising.org/ and additionally via the U.S. website http://www.aboutads.info/choices or the European website http://www.youronlinechoices.com/uk/your-ad-choices/.

 

_fbp

The functionality is: to store and track visitors across websites.

Expiration period: 3 months

Stored personal data: Unknown

All infos: https://cookiedatabase.org/cookie/facebook/_fbp/

 

c) Flockler

 

We use Flockler, a social media aggregator tool, to curate social media feeds and present social media content that we believe is relevant and inspiring to you. Flockler does not store any information about your visit. However, depending on the platform, social media services may store information about you if you choose to interact with the content (e.g., play a video or visit our social media profile page).

 

d) Social Media Plugins

 

We currently use the following social media plugins on our website: Facebook, Instagram, Twitter, LinkedIn. We use the so-called two-click solution for this: When you visit our site, no personal data is initially passed on to the providers of the plugins. You can recognize the provider of the plugin via the respective marking on the box via its initial letter or logo. We open up the possibility for you to communicate directly with the provider of the plugin via the button. Only if you click on the marked box and thereby activate it, the plugin provider receives the information that you have called up the corresponding website of our online offer. In addition, the data which is usually transmitted by your browser is transferred. By activating the plugin, personal data of yours is therefore transmitted to the respective plugin provider and stored there (in the case of US providers in the USA).

 

We are jointly responsible with the respective plugin provider for the collection of data by the plugin on our website and the data transmission to the plugin provider. The further processing of the transmitted data is the sole responsibility of the plugin provider.

 

The plugin provider stores the data collected about you as usage profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) for the display of needs-based advertising and to inform other users of the social media platform about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact the respective plugin provider to exercise this right. Via the plugins, we offer you the opportunity to interact with the social media platform and other users so that we can improve our offer and make it more interesting for you as a user. If we ask for your consent to use the plugins, the legal basis for processing data is consent (Art. 6 (1) sentence 1 lit. a) DSGVO). Otherwise, user data is processed on the basis of our legitimate Interests, the interest in efficient, economical and recipient-friendly services. The legal basis for the use of the plugins in this case is Art. 6 (1) sentence 1 lit. f) DSGVO.

 

The data transfer takes place regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in to the plugin provider, your data collected from us will be directly assigned to your account with the plugin provider. If you click the activated button and, for example, link to the page, the plugin provider also saves this information in your user account and shares it publicly with your contacts.

 

For more information on the purpose and scope of data collection and its processing by the plugin provider, please refer to the privacy statements of the respective providers communicated below. There you will also receive further information about your rights in this regard and setting options for protecting your privacy:

 

e) YouTube Videos

 

This website uses the YouTube embedding function to display and play videos from YouTube. We use the extended data protection mode, which, according to the provider, initiates a storage of user information only when the video is played. At the moment when the playback of the embedded video is started, the YouTube sets cookies to collect information about user behavior. According to information from YouTube, these are used, among other things, to collect video statistics, improve the user experience and prevent abusive behavior. Independently of a playback of the embedded videos, a connection to the Google network "DoubleClick" is established each time this website is called up, which may trigger further data processing operations without our influence.

 

Further information on data protection at YouTube can be found in the provider's privacy policy at: https://www.google.de/intl/de/policies/privacy/

 

VISITOR_INFO1_LIVE

The functionality is: to provide bandwidth estimations.

Expiration period: 6 months

Stored data: none

All infos: https://cookiedatabase.org/cookie/youtube/visitor_info1_live/

 

YSC

The functionality is: to store a unique user ID.

Expiration period: session

Stored personal data: Unknown

All infos: https://cookiedatabase.org/cookie/youtube/ysc/

 

f) Data Recipients

 

We are part of the METRO company group, which is internationally active. To achieve the purposes mentioned above, we use service providers, i.e. as data processors according to Art. 28 GDPR, for example our service providers for cloud hosting, platform and maintenance services. These are external service providers and also service providers within the METRO company group, like METRO shared service centers, which are located in countries within and outside the European Union (EU) and the European Economic Area (EEA) (i.e. the international data center of METRO, which is operated by the Metro Digital GmbH). We ensure i.e. by contractual regulations, that these service providers process personal data in accordance with European data protection law to guarantee a high data protection level, even if personal data are transferred into a country, in which another data protection level is common and for which no adequacy decision of the Commission of the EU exists. Another transfer of personal data to other recipients is not performed, except where we are obliged to do so by law. For more information about appropriate safeguards for the international data transfer or a copy of them, please contact our data protection officer via email (see contact details above).

 

g) Mandatory/Voluntary Data Provision and Retention Period

 

The provision of your personal data is voluntary. You are neither obliged to provide your personal data to us, nor is this provision necessary to fulfill a statutory or contractual requirement. If you do not provide your personal data to us, this will not result in any consequences for you, except that you will not be able to use our services. Personal data provided to us via our website will only be stored until the purpose for which they were processed has been fulfilled. Insofar as retention periods under commercial and tax law have to be observed, the storage period for certain data can be up to 10 years. Deviating storage periods may also arise due to a legitimate interest of METRO (e.g. to guarantee data security, to prevent misuse or to prosecute criminal offenders). Data that we have to store due to legal, statutory or contractual storage obligations will be blocked.

 

h) Transfer of Data into Third Countries

 

We may transfer your data to parties based in states outside the European Union (EU) or the European Economic Area (EEA) (“third countries”) who are acting as processors on our behalf (e.g. IT service providers or data centers). If there is no decision of the EU Commission regarding an adequate level of data protection in the country concerned, we conclude contracts in accordance with EU data protection rules, which ensure that your rights and freedoms are adequately protected and safeguarded. We will be happy to provide you with the relevant, detailed information upon request. We do not otherwise transfer your personal data to countries outside the EU or the EEA or to international organizations.

 

i) Automated Decision Making/Profiling

 

We do not use automated decision making or profiling (an automated analysis of your personal circumstances).

 

 

3. Your Rights

 

As a data subject, you can contact our data protection officer at any time with a formless notification under the contact dates mentioned above to exercise your rights according to the GDPR. These rights are the following:

 

·       The right to receive information about the data processing and a copy of the processed data (right to access, Art. 15 GDPR),

·       The right to demand the rectification of inaccurate data or the completion of incomplete data (right to rectification, Art. 16 GDPR),

·       The right to demand the erasure of personal data and, in case the personal data have been made public, the information towards other controllers about the request of erasure (right to erasure, Art. 17 GDPR),

·       The right to demand the restriction of the data processing (right to restriction of processing, Art. 18 GDPR),

·       The right to receive the personal data concerning the data subject in a structured, commonly used and machine-readable format and to request the transmittance of these data to another controller (right to data portability, Art. 20 GDPR),

·       The right to object the data processing in order to stop it (right to object, Art. 21 GDPR),

·       The right to withdraw a given consent at any time to stop a data processing that is based on your consent. The withdrawal will not affect the lawfulness of the processing based on the consent before the withdrawal (right to withdraw consent, Art. 7 GDPR).

·       The right to lodge a complaint with a supervisory authority if you consider the data processing to be an infringement of the GDPR (right to lodge a complaint with a supervisory authority, Art. 77 GDPR).

 

Information about your right to Object pursuant to art. 21 GDPR

 

You have the right to object at any time to the processing of your data on the basis of art. 6 para. 1 f GDPR (data processing on the basis of a balance of interests) or art. 6 para. 1 e GDPR (data processing in the public interest), if there are reasons to object arising from your particular situation. This also applies to profiling based on this provision within the meaning of art. 4 No. 4 GDPR. If you object, we will no longer process your personal data, unless we can prove compelling and applicable reasons for the processing, which out-weigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. The objection can be made without formality and should be addressed to the contact details at the beginning of these Data Protection Notices.