Data protection

This data protection information applies to data processing by
Otto (GmbH & Co KG)
Werner-Otto-Straße 1-7
22179 Hamburg
Germany

represented by the Managing Director(s):
Alexander Birken (Chairman)
Dr. Marcus Ackermann
Sebastian Klauke
Petra Scharner-Wolff
Kay Schiebur

Tel.: 040/64618724
E-Mail: krrrttd

for the following website: otto.de/jobs.

The company data protection officer(s) of the data controller can be contacted at
Otto (GmbH & Co KG)
- Datenschutzbeauftragter -
Werner-Otto-Straße 1-7
22179 Hamburg Germany
e-mail address: dtnschtzbftrgtrttgrpcm

3.1 Cookies - General information

3.1.1 Mandatory technically necessary cookies

Cookies are used on this website. Cookies are small text files that are automatically created by your browser and stored on your end device (laptop, tablet, smartphone or similar). Information is stored in the cookie that is related to the specific end device used. However, this does not mean that we gain direct knowledge of your identity. Some of the cookies we use are deleted at the end of the browser session (so-called session cookies).

According to legal requirements, the storage of information on end devices (desktops, mobile phones, tablets, etc.) - e.g. by setting cookies - and the retrieval of information from end devices (tracking) is only permitted if you have given your prior consent. However, consent does not have to be given if such storage/retrieval is necessary for the website to function. A necessity is given, for example, with regard to ensuring the following functionalities / achieving the following purposes:

• Ensuring system security
• Enabling settlement of partners.

With regard to data processing that is necessary for the operation of the website, you do not have the right to object.

3.2 Intervention options / browser settings
Of course, you can set up your browser so that it does not place our cookies on your end device. The help function in the menu bar of most web browsers explains how to prevent your browser from accepting new cookies, how to have your browser notify you when you receive a new cookie or how to delete all cookies you have already received and block them for all further ones.
To do this, please proceed as follows:

In Internet Explorer/Microsoft Edge:

1. In the "Extras" menu, select the item "Internet Options".
2. Click on the "Privacy" tab.
3. Now you can set the security settings for the Internet zone. Here, you can determine whether or not to accept or reject cookies and which ones.
4. Confirm your setting with "OK".

In Firefox:

1. In the "Extras" menu, select the item “Settings”.
2. Click on "Privacy".
3. Select the entry "Create according to user-defined settings" in the drop-down menu.
4. Now you can set whether cookies should be accepted, how long you want to keep these cookies, and add exceptions, which websites you always or never want to allow to use cookies.
5. Confirm your setting with "OK".

In Google Chrome:

1. Click on the Chrome menu in the browser toolbar.
2. Now select "Settings".
3. Click on "Show advanced settings".
4. Click on "Content settings" under "Privacy".
5. Under "Cookies" you can make the following settings for cookies:

• Delete cookies
• Block cookies by default
• Delete cookies and website data by default after having closed the browser
• Allow exceptions for cookies from specific websites or domains

If you would like to delete individual cookies set in your browser or find out which service providers / suppliers have set cookies in your browser, you can also do this via a "preference manager". Such a preference manager is available, for example, at www.youronlinechoices.com.

3.4 Further processing of tracking data for legitimate interests
3.4.1 Legitimate interests of OTTO / balancing of interests
We are entitled to further process Tracking Data that has been collected after consent has been granted based on legitimate interests. This further processing is based on the legal basis in Article 6(1)(f) GDPR (balancing of interests). To the extent that we process tracking data based on the legal basis in Article 6(1)(f) of the GDPR, we do so exclusively for purposes in the pursuit of which we have a legitimate interest. These legitimate interests include, among others, the processing of tracking data for the purpose of playing out individualized advertising on third-party sites and making product suggestions on this website. In connection with the further processing of tracking data, we do not process any data that is classified as particularly sensitive by the law in Article 9 GDPR (e.g. health data). Furthermore, we do not use the tracking data to create evaluation results that could be assigned to the areas particularly protected by Article 9 of the GDPR. We also do not make any automated decisions based on the tracking data that have legal effects on you as a user of the otto.de/jobs website or that significantly affect you in a similar way (e.g. individualized price adjustments based on your usage behaviour). In addition, the tracking data is subjected to pseudonymization by us - depending on its scope and the risks emanating from the processing of the tracking data for your rights to be protected - by which an allocation of the data to your person is prevented.

3.4.2 Consent for further advertising partners/ third party cookies
OTTO works with service providers who enable OTTO to display individualized advertising (e.g. retargeting) on third party sites. These service providers may - after you have given your consent - set cookies in your browser, for example, which enable your browser to be recognized on a website other than otto.de/jobs. Insofar as the service providers collect data about your usage behaviour on otto.de/jobs, we have agreed with these service providers that the data will be processed by the service providers exclusively for OTTO's purposes and / or to the extent that this is necessary for the provision of the service to OTTO.

4.1 Processors
We use processors in the course of processing your data. A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the data controller.

4.2 Other third party partners
In addition, we use other third party partners who are necessary for the provision of services and the achievement of various purposes. We transfer personal data to these third party partners if this is necessary within the scope of the service provision.
The legal basis for this data transfer is Article 6(1)(b), (f) GDPR.

We use social plugins from the social networks Facebook, YouTube, Pinterest, Twitter, Instagram and WhatsApp on our website on the basis of Article 6 (1) (f) of the General Data Protection Regulation (GDPR) in order to raise awareness of our company. The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for data protection-compliant operation is to be ensured by their respective providers.
The purpose and scope of the data collection and the further processing and use of the data by the respective provider as well as your rights in this regard and setting options for protecting your privacy can be found in the respective data protection information of the provider, which we link to below.
By logging out of the pages of social networks beforehand and deleting cookies that have been set, you can prevent social networks from assigning the information collected about you to your user account with the respective social network during your visit to this website. If you do not want social networks to directly assign the data collected via our website to your profile, you must log out of the corresponding social networks before visiting our website.

5.1. Facebook und YouTube
Social plugins from Facebook and YouTube (Google) are used on this website. These are offers from the US companies Facebook and Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google")).
When you visit a page that contains such a plugin, your browser establishes a connection to Facebook or YouTube and the content is loaded from these pages. Your visit to this website may thus be tracked by Facebook and YouTube, even if you do not actively use the social plugin function. If you have an account with Facebook or YouTube, you can use such a social plugin and thus share information with your friends. We have no influence on the content of the plugins and the transmission of information.
On their websites, Facebook and Google provide detailed information on the scope, type, purpose and further processing of your data. Here you will also find further information on your rights and setting options to protect your privacy.
You can find Facebook's data protection information here and Google's data protection information here.

5.2 X (Twitter)
Functions of the X (Twitter)service are also integrated on this website. These functions are offered by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ("Twitter"). By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transferred to Twitter in the process. For this purpose, your internet browser establishes a direct connection to Twitter's servers and transmits data to Twitter.
We would like to point out that we have no knowledge of the content of the transmitted data or its use by Twitter. You can find more information on this here in Twitter's privacy policy.
You can change your Twitter privacy settings here in the account settings.

5.3 WhatsApp
This website also uses a WhatsApp button (WhatsApp share button). This button allows you to share content from this page via the WhatsApp application on your mobile phone. The button is a hyperlink. When the button appears on this website, no personal data is yet transmitted to the operator of WhatsApp or other third parties. As soon as you use the WhatsApp button, the operator of WhatsApp learns what content is being shared and that the button has been used on this website. More information on the handling of personal data by the operator of WhatsApp can be found here in the operator's privacy policy.

For individual job advertisements, you have the opportunity to register for an exchange appointment with the specific department and / or OTTO HR if you are interested in a specific position or to book an interview slot to find out more about the position and clarify open questions in a personal interview. We process your personal data (name, email address and availability) exclusively for the purpose of making an appointment and carrying out the interview.

The legal basis for this data processing is Article 6(1)(f) GDPR.

You have the possibility to contact us in several ways. By e-mail, by WhatsApp, by telephone, by form or by post. When you contact us, we use the personal data that you voluntarily provide in this context solely for the purpose of contacting you and processing your enquiry.

The legal basis for this data processing is Article 6(1)(a), Article 6(1)(b), Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

At various points you have the opportunity to publish your own content on otto.de/jobs (e.g. comments etc.). When you post a comment or feedback, we process the personal data that you voluntarily enter as part of the comment. In principle, you can publish content on otto.de/jobs under a pseudonym and / or your first name and shortened surname.

The legal basis for this data processing is Article 6(1)(a) GDPR.

On this page you have the opportunity to apply for open positions. Below we would like to provide you with information on the processing of your personal data in connection with an application.

10.1 Data processing to carry out the application process
If you apply to us via our career portal for a vacant position, we process the following data from you to carry out the application process and a possible employment with us: Gender, first name, last name, e-mail address, date of birth, application documents (CV, cover letter) and any other optional information.
We process the data that you have sent us in connection with your application in order to check your suitability for the position (or, if applicable, other open positions in our companies - if your consent is required here in accordance with the legal basis, we will obtain this beforehand) and to carry out the application process. If further data is processed as part of the current application process, we will inform you of this separately.
The legal basis for the processing of your personal data in this application procedure is primarily Section 26 BDSG and Article 6(1)(a) GDPR. According to this, the processing of data required in connection with the decision on the establishment of an employment relationship is permissible.
Should the data be required for legal prosecution after the application procedure has been completed, data processing may be carried out on the basis of the requirements of Article 6 GDPR, in particular to safeguard legitimate interests pursuant to Article 6(1)(f) GDPR. Our interest then consists in the assertion or defence of claims. Furthermore, in individual cases we are obliged to match your data with personal sanctions lists / embargoes (Article 6(1)(c) GDPR). In the application process for filling particularly risk-sensitive positions, we carry out a validation of your details and obtain further additional relevant security information. The legal basis for this is Article 6(1)(a) GDPR.
If you use the options of automatic transfer of personal data from portals such as XING or via an upload of your CV, your data will be transferred to OTTO once per update. There is no permanent connection to the portals and upload options. Security procedures, such as data encryption and access controls, are of course used to protect the confidentiality of your data.

10.2 Duration of storage of applicant
data: In principle, your application data will be stored for a period of 6 months. In the event of a rejection, this data will then be anonymized. If you have consented to us continuing to store your personal information, we will transfer your personal information to our Talent Management System. There, the data will be deleted after two years. You can find more information on the Talent Management System under point 9 of this data protection information. Employee
data: If you have been accepted for a position as part of the application process, the data will be transferred from the application data system to our HR master data system. In principle, the data is then stored for the duration of the employment relationship, unless longer retention periods are provided for by law.

10.3 Recipients of applicant data
Your applicant data will be viewed by the HR department after receipt of your application. Suitable applications will then be forwarded internally to the persons responsible for the respective open position. If consent is required by law and we have it, the application documents may also be forwarded to other responsible persons from other departments. In principle, only those persons in the company have access to your data who need it for the proper conduct of our application procedure. This also includes the members of the employee representation. In the course of system maintenance and servicing, your data may come to the attention of the persons entrusted with it. The relevant persons or, if applicable, the service providers used are obliged to maintain data secrecy.

In manchen Fällen bieten wir Ihnen die Möglichkeit in das konzerninterne Otto Group Talent Pool System aufgenommen zu werden. Das Otto Group Talent Pool System dient der Identifikation, Bindung und Förderung von Talenten sowie der Nachfolgesicherung durch die aktive Förderung von interner Mobilität innerhalb der Otto Group. Sollten Sie in die Weitergabe Ihrer Daten an die anderen Konzernunternehmen der Otto Group eingewilligt und somit für die Speicherung Ihrer Daten im Otto Group Talent Pool System entschieden haben, werden wir Daten, die Sie im Rahmen der Profilerstellung angegeben haben an die Otto (GmbH & Co KG) (nachfolgend OTTO) übermitteln, welche diese im Otto Group Talent Pool System speichert. In Bezug auf die Aufnahme Ihrer Person in den konzerninternen Otto Group Talent Pool System sowie der Zurverfügungstellung des Otto Group Talent Pool System sind wir gemeinsam Verantwortliche mit der Otto (GmbH & Co KG) und den weiteren Konzerngesellschaften der Otto Group, die am konzerninternen Otto Group Talent Pool System teilnehmen. Schwerpunktmäßig sind wir für die Erhebung, Übermittlung und Einmeldung Ihrer Daten und OTTO für die Speicherung Ihrer Daten und Zurverfügungstellung des Otto Group Talent Pool System verantwortlich. Nach der Übermittlung Ihrer Daten an die an dem Otto Group Talent Pool System teilnehmende Gesellschaften durch die Otto (GmbH & Co KG), verarbeiten die Konzerngesellschaften diese Daten als datenschutzrechtlich Verantwortliche zum Zweck der z. B. Kontaktaufnahme. Ein potenzieller Bewerbungsprozess findet dann normal direkt über die Prozesse der Gesellschaft statt.

Die Datenverarbeitung erfolgt auf Basis Ihrer Einwilligung (Artikel 6 Absatz 1 Buchstabe a) DSGVO). Ihre Einwilligung können Sie jederzeit durch Mail an yournextmove@ottogroup.com widerrufen.

Wir und OTTO stehen Ihnen in Bezug auf die Verarbeitungen in gemeinsamer Verantwortlichkeit als zentrale Ansprechpartner jeweils in ihrem eigenen Wirkbereich zur Verfügung. Wenden Sie sich gerne bei jeglichen Anfragen hinsichtlich des Datenschutzes und zur Geltendmachung Ihrer Betroffenenrechte an yournextmove@ottogroup.com. Sie können Ihre Rechte auch gegenüber uns geltend machen. Soweit Sie sich an uns wenden, werden wir uns im Sinne der Vereinbarung über gemeinsame Verantwortlichkeit abstimmen, um Ihre Anfrage zu beantworten und die Umsetzung Ihrer Betroffenenrechte zu gewährleisten.

With the exception of the processing operations for which we provide information about the possibility of transferring data to recipients based outside the EU in this information on data protection, we do not transfer your data to recipients based outside the European Union or the European Economic Area. The data transfers take place on the basis of so-called standard contractual clauses of the EU Commission.

The duration of the storage of the data collected about you depends on the purpose for which we process the data. The data is stored for as long as is necessary to achieve the purpose for which it was collected. Insofar as we have to store certain categories of data for a certain period of time due to legal obligations (e.g. obligations under tax law), the continued storage of the data after its storage is no longer necessary for the achievement of the respective purpose is exclusively for the purpose of fulfilling the legal obligation. In this case, the data will be blocked for access.
Exemplary naming of storage periods:

• Consents: Permanent storage as long as the consents are used continuously (e.g. permanent sending of email newsletters).
• Tracking data: 2 years.
• Data for the purpose of implementing (advertising) objections: Unlimited storage.