1. The categories and purpose behind the processing of your personal data
1.1 Establishing contact in the context of a business relationship
In particular, we shall process your contact details (e.g. name, address, phone number and e-mail address) as well as the communication data (e.g. audio- / video transmission, records of answering machine, emails) in order to initiate or conduct a business relationship.
The legal basis for the processing of your personal data is thus Art. 6 (1) a and b of the EU General Data Protection Regulation (your consent or pre-contractual measures respectively, the performance of contract) – if we receive the data directly from you or if we enter into a contractual obligation with you.
If you yourself are not an existing (or potential) business partner, we typically receive your contact details from our business partner, who named you as a contact person. In such a case, your data shall be processed on the basis of Art. 6 (1) f of the EU General Data Protection Regulation (the consideration of pertinent interests, based on our legitimate interest in establishing contact with existing or potential business partners).
1.2 Establishing contact in the context of our public relations work
We also maintain databases containing certain contact information, including those of political, media and press representatives, in order to be able to get in touch with these individuals with regard to relevant issues, events, etc. as part of our public relations work.
The processing of your personal data shall take place on the basis of your consent (Art. 6 [1] a GDPR), which you may provide us with by establishing contact in person (e.g. the presentation of your business card). With regard to your right to withdraw your consent, please see point 5.
We shall also collect contact data from public sources and maintain this information in our databases. The legal basis for data processing operations described here is Art. 6 (1) f of the General Data Protection Regulation (the consideration of pertinent interests, based on our legitimate interest in establishing contact with political, media and press representatives as part of our public relations work).
2. Recipients of your personal data
Your data as collected by us shall not be disclosed to third parties.
However, in certain cases, we shall task service providers with the processing of personal data, including the sending of emails, the storage of your data in a secure data centre, and the maintenance and analysis of databases.
Each and every data processor has: a) been carefully selected, b) been tasked with providing support to REWE as per strict instructions and c) only been granted access to your data to the necessary extent (and for the necessary amount of time), in order to render those services required, or to the extent that you have consented to the processing and use of your data.
We also use service providers located in third countries outside the European Union for the processing of your data. Countries outside the European Union manage the protection of personal data differently to those countries within the European Union. There is currently no decision in place by the EU Commission stipulating that these third countries should, in general, provide an adequate level of protection. We have therefore taken specific measures to ensure that your data is processed in third countries as securely as it would be within the European Union. With regard to those service providers situated in third countries, we conclude a data protection contract (containing standard data protection clauses) as provided by the EU Commission for the processing of personal data in third countries. This ensures the appropriate guarantees for the protection of your data with those service providers located in a third country. You may request a copy of this data protection contract by availing yourself of the contact details above.
3. Retention periods, deletion time limits
In principle, we only store your processed data to the extent that a legal basis for said storage exists. When said legal basis no longer applies, your data will be deleted within 60 days. Your data shall also be stored / deleted for as long as a contractual or statutory retention period applies.
4. Automated decision-making; profiling
We shall not use your personal information for the purposes of automated decision-making or profiling.
5. Your rights as a data subject
To the extent that REWE processes your personal data, you shall – as the data subject – be entitled in particular to the following rights, in consideration of any and all pertinent data protection requirements.
Disclosure
You may request the disclosure of information concerning your personal data being processed by us.
Correction
Should your information not (or no longer) be accurate, you may request its correction. If your data is incomplete, you may request its supplementation.
Deletion
You shall have the right to request the deletion of your personal data. Please note that any claim to said deletion shall depend on the existence of a legitimate reason. Furthermore, there may be no overriding regulation stipulating that we retain your personal data.
Restriction of processing
You shall have the right to request the restriction of the processing of your personal data. Please note that any claim to said restriction of processing shall depend on the existence of a legitimate reason.
Objection
If data is recorded on the basis of Art. 6 (1) f GDPR (data processing for the protection of legitimate interests), you shall have the right to register your objection to the processing of your personal data for reasons that arise from your particular situation. In the event of your objection hereto, we shall no longer process your personal data unless we can demonstrate compelling legitimate reasons for its processing that outweigh your interests, rights and freedoms, or if said processing is for the purpose of enforcing, pursuing or defending legal claims.
Right of appeal
You may lodge an appeal with the relevant data protection supervisory authority if you disagree with the processing of your data.
Data portability
You shall have the right to receive the personal data you have provided to us in an electronic format.
Revocation of your consent
You shall have the right to revoke your consent (Art. 6 [1] a GDPR) at any time to the processing of any personal data you have provided to us. This shall also apply to the revocation of any declaration of consent, which you have submitted to us prior to the legal validity of the General Data Protection Regulation, i.e. before 25.05.2018. The easiest way to revoke your consent is to contact us by email using the contact details above. The revocation of your consent shall not affect the legality of any and all processing of your personal data executed up until the point in time of said revocation.
6. The responsible companies of the REWE Group and their points of contact regarding data protection issues
The following contains an alphabetical listing of those processing companies and their points of contact pertaining to data protection. The responsible authority for data processing refers to the legal entity where said processing takes place.
datenschutz süd GmbH
Datenschutzbeauftragter
Oskar-Jäger-Straße 50
50825 Köln
[emailprotected]
Contact partner for the following companies within the REWE Group:
Dienstleistungszentrum Südmarkt GmbH & Co. OHG
Rewestraße 1
01683 Ketzerbachtal-Starbach
Gebrüder Mayer Produktions- und Vertriebs GmbH
Mayflorstraße 1 – 3
29399 Wahrenholz
Glockenbrot Bäckerei GmbH & Co. oHG
Domstraße 20
50668 Köln
HLS Handel und Lager Service GmbH
Stolberger Str. 92
50933 Köln
OC Fulfillment GmbH
Domstraße 20
50668 Köln
OC Payment GmbH
Domstr. 20
50668 Köln
Penny Dienstleistung GmbH
Domstraße 20
50668 Köln
Penny Markt GmbH
Domstraße 20
50668 Köln
Penny Spedition GmbH
Domstraße 20
50668 Köln
Perwenitz Fleisch- & Wurstwaren GmbH
Alte Nauener Chaussee 2
14621 Schönwalde Glien / OT Perwenitz
REWE Berlin Logistik GmbH
Altes Gaswerk Mariendorf 31
12105 Berlin
REWE Deutscher Supermarkt AG & Co. KGaA
Domstraße 20
50668 Köln
REWE Digital GmbH
Domstraße 20
50668 Köln
REWE Digital Fulfilment GmbH
Domstraße 20
50668 Köln
REWE Group Buying GmbH
Domstr. 20
50668 Köln
REWE Group Fruchtlogistik GmbH
Domstraße 20
50668 Köln
REWE Markt GmbH
Domstraße 20
50668 Köln
REWE Partner GmbH
Domstraße 20
50668 Köln
REWE Regiemarkt GmbH
Domstraße 20
50668 Köln
REWE Spedition und Logistik GmbH
August-Horch-Straße 11
56070 Koblenz
REWE Südmarkt GmbH
Domstraße 20
50668 Köln
REWE Systems GmbH
Domstraße 20
50668 Köln
REWE-Versicherungsdienst GmbH
Domstraße 20
50668 Köln
REWE Wein online GmbH
Domstraße 20
50668 Köln
REWE-Zentral-Aktiengesellschaft
Domstraße 20
50668 Köln
REWE Zentrale – Business Organisation GmbH
Domstraße 20
50668 Köln
REWE-Zentrale-Dienstleistungsgesellschaft mbH
Domstraße 20
50668 Köln
REWE-Zentralfinanz eG
Domstraße 20
50668 Köln
toom Baumarkt GmbH
Humboldtstraße 140-144
51149 Köln
Wilhelm Brandenburg GmbH & Co. oHG
Domstraße 20
50668 Köln
ZooRoyal Petcare GmbH
Schanzenstraße 6-20
51063 Köln
_________________________
Responsible authority for data processing:
Campina Verde Deutschland GmbH
Domstraße 20
50668 Köln
Eurogroup Deutschland GmbH
Katzbergstraße 3
40764 Langenfeld
Point of contact for any questions relating to data protection
Steinberg Rechtsanwälte
Kaiser Wilhelm Ring 3 – 5
50672 Köln
[emailprotected]
_________________________
Responsible authority for data processing and point of contact for any questions relating to data protection:
Campiña Verde ecosol S.L.
c/ Lucano 13
14003 Córdoba
España
CAMPINA VERDE ITALIA S.R.L.
Via Tolomeo 11
37135 Verona
Italia
Eurogroup España F&V SAU
Ronda Narciso Monturiol 6, 208B
46980, Paterna, Valencia
España
EUROGROUP ITALIA S.R.L.
Via Tolomeo 11
37137 Verona
Italia
REWE Group Buying Italy S.r.l.
Via Dolomiti, s.n.c.
37050 Oppeano (VR)
Italia
_________________________
Responsible authority for data processing:
REWE-Beteiligungs-Holding International GmbH
Domstraße 20
50668 Köln
Point of contact for any questions relating to data protection:
KINAST Rechtsanwaltsgesellschaft mbH
Hohenzollernring 54
50672 Köln
[emailprotected]
I am an expert in data protection and privacy laws, specializing in the European Union General Data Protection Regulation (GDPR). My extensive knowledge and experience in this field allow me to dissect and analyze the information provided in the article about the processing of personal data by an organization. Let's delve into the key concepts presented in the text:
1. Categories and Purpose of Personal Data Processing
1.1 Establishing Contact in a Business Relationship
The organization processes personal data for the purpose of initiating or conducting a business relationship. This includes contact details such as name, address, phone number, and email address, as well as communication data like audio/video transmissions, answering machine records, and emails. The legal basis for this processing is outlined in Article 6(1)(a) and (b) of the GDPR, which refers to the data subject's consent or pre-contractual measures and the performance of a contract.
If the data is obtained from a business partner, the legal basis becomes Article 6(1)(f), involving the consideration of pertinent interests based on the organization's legitimate interest in establishing contact with existing or potential business partners.
1.2 Establishing Contact in Public Relations Work
The organization also maintains databases with contact information, including political, media, and press representatives. The processing of personal data in this context is based on consent (Article 6(1)(a) of the GDPR) obtained during in-person contact or the presentation of a business card. Additionally, data may be collected from public sources, and the legal basis for this is Article 6(1)(f), involving legitimate interests in establishing contact for public relations work.
2. Recipients of Personal Data
The article states that personal data collected will not be disclosed to third parties. However, in specific cases, service providers may be engaged for processing, and they are carefully selected, operate under strict instructions, and are granted access only to the necessary extent.
Service providers located in third countries undergo additional measures to ensure data security, such as the conclusion of data protection contracts containing standard clauses provided by the EU Commission.
3. Retention Periods and Deletion Time Limits
Data is stored only as long as a legal basis exists, and when it no longer applies, the data is deleted within 60 days. Data is also retained or deleted based on contractual or statutory retention periods.
4. Automated Decision-Making and Profiling
The organization declares that it will not use personal information for automated decision-making or profiling.
5. Rights of Data Subjects
Data subjects have various rights, including the right to disclosure, correction, deletion, restriction of processing, objection, the right to lodge an appeal with the relevant data protection supervisory authority, data portability, and the right to revoke consent.
6. Responsible Companies and Data Protection Contacts
The article provides an alphabetical listing of companies within the REWE Group, their responsible authorities for data processing, and points of contact for data protection issues.
This comprehensive overview demonstrates a strong commitment to GDPR compliance and transparency in personal data processing within the organization.
