(Status: May 2024)
This information gives you an overview of the processing of your personal data when you visit the website one.rewe-group.com. We inform you about what data we collect from you and how we use it. We also inform you about your legal rights under applicable data protection law and tell you who you can contact if you have any questions.
1. Who is responsible for data processing?
REWE Zentralfinanz eG (REWE Group) is responsible for processing your personal data when you visit the website one.rewe-group.com.
The contact details are as follows:
REWE-ZENTRALFINANZ eG
Domstrasse 20
50668 Cologne
Telephone: 0221 149-0
E-mail: one@rewe-group.com
Furthermore, we would like to show you which legal rights you are entitled to in this context. This privacy policy applies exclusively to the website www.one.rewe-group.com, including any subpages (such as www.one.rewe-group.com/[xy]) and subdomains (such as [xy].one.rewe-group.com).
2. Who can you contact if you have questions about data processing?
The data protection officer of REWE-ZENTRALFINANZ eG can be reached at the following contact details:
REWE-ZENTRALFINANZ eG
Data Protection Officer
Domstraße 20
50668 Cologne
E-mail: datenschutz@rewe-group.com
If you have any questions about your data subject rights (such as data disclosure, data deletion or objection to advertising) or other data protection issues, please contact: one@rewe-group.com.
3. What data do we process about you?
We process your personal data when you visit the one.rewe-group.com website, when you take part in our competitions or when you contact us in any other way. This may include the following data:
We only process the aforementioned data to the extent that we actually receive it. We do not use your data for other advertising purposes. With your consent, we may send information that you provide to us in the context of competitions to the cooperation partners selected by us. If you have won, we may publish your name on our websites in individual cases with your consent.
4. Is there an obligation to provide the data?
The provision of your data is not mandatory. However, some of the data mentioned is required in order to be able to offer our services securely and reliably. The provision of other data is voluntary, but may be necessary for the use of certain services. This applies, for example, to data for participation in a competition. We will inform you when you enter data if it is required for the respective service or function. These data are marked as mandatory fields. In the case of required data, failure to provide it will mean that the additional service or function in question cannot be provided. In the case of optional data, failure to provide it may mean that we are unable to provide our services in the same form and to the same extent as usual.
5. For what purposes do we process your data and what is the legal basis for this?
5.1 Newsletter
On our website, you have the option of registering for the "one_Newsletter" with your email address. We use this to inform you about the latest news from REWE Group companies. By subscribing to the two newsletters, you consent to your click and opening behaviour being included in our general, non-personalised statistics in order to enable us to provide you with the best possible newsletter service.
After submitting the registration form, you will receive a confirmation email. The registration only becomes effective once you have clicked on the link in the confirmation email (so-called double opt-in procedure/ DOI). The legal basis for the data processing described is Article 6(1)(a) of the General Data Protection Regulation (consent).
You can unsubscribe from the newsletter at any time in the future. Simply use the unsubscribe link at the end of each email.
5.2 Competitions
From time to time, you have the opportunity to take part in competitions on our website. We differentiate between competitions organised by Redaktion one and competitions organised by a third-party provider.
Competitions organised by Redaktion one: We process your data (name, personal number, email address, address and any other data required for the competition) in order to run a competition. We process your data to check eligibility to participate, determine and notify the winner, send the prize and, if applicable, publish the winner. The legal basis for the data processing described is Article 6(1)(b) of the General Data Protection Regulation (organisation of the competition). Click here for the conditions of participation.
Competitions organised by third-party providers: The competitions organised by third-party providers are described in detail in the cookie banner under the services. You can view this at any time in the privacy settings in the footer of the website or you can click directly here.
5.3 Contact(form)
You can contact us via our web form, by email, by post or by telephone. We process your data in order to answer your enquiry and, if necessary, to send you the requested information material. Your data may be transferred to the department responsible for your enquiry. The legal basis for the data processing described is Article 6(1)(b) and (f) of the General Data Protection Regulation (pre-contractual measures, contract fulfilment or balancing of interests, based on REWE Group's interest in responding to enquiries from employees, customers and other persons). You have the Legal right to object to the processing of your data based on legitimate interests for reasons arising from your particular situation.
5.4 Cookies and other technologies (website analysis / tracking)
We use cookies in some areas of our website, e.g. to recognise visitor preferences and optimise the design of the website accordingly. This facilitates navigation and a high degree of user-friendliness. Cookies also help us to identify particularly popular areas of our website.
Cookies are small text files that are stored on the hard drive of your end device. They make it possible to store information for a certain period of time and to identify your end device. We use permanent cookies for better user guidance and customised performance. We also use so-called session cookies, which are automatically deleted when you close your browser. You can set your browser so that it informs you about the placement of cookies. This makes the use of cookies transparent for you. Important: If you completely exclude the use of cookies, you may not be able to use certain functions of our website.
The following cookies are set by our website and our partners:
5.4.1 Necessary technologies / (cannot be influenced)
These services, technologies and cookies are necessary to ensure central functions of the portal and the fulfilment of contracts with customers and cooperation partners. They are used on the legal basis of Section 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 sentence 1 TDDDG. Art. 6 para. 1 sentence 1 lit. b) (contract initiation or fulfilment), lit. c) (if legal obligations exist) and/or lit. f) GDPR (overriding legitimate interests). The latter interests are in particular the monitoring of the technical performance of the website, the guarantee of IT security and our interest in the economic use of partner sales channels. You can therefore not deactivate them via our consent management system.
All cookies and other technologies are described in detail in the cookie banner under the services. You can view this at any time in the privacy settings in the footer of the website or you can click directly here.
5.4.1.1 User surveys
So-called surveys are used by us to ask questions to visitors to the site and to obtain feedback from users. The ID of the respective survey module is stored as a cookie to indicate that the user has taken part in this survey. The content of the response is not saved.
5.4.2 Marketing technologies
These services, technologies and cookies are used to understand your interests and to provide you with personalised content that is relevant to you. They are used on the legal basis of Section 25 (1) TDDDG (consent to the setting or reading of cookies) in conjunction with Art. 6 (1) sentence 1 GDPR. Art. 6 para. 1 sentence 1 lit. a) GDPR (consent for the data processing based on this). Data processing only begins when you have given the corresponding opt-in. You have the legal right to revoke your consent(s) at any time with effect for the future (see No. 9.8. of this privacy policy and in the privacy settings at the bottom of the footer). The revocation does not affect the legality of the data processing carried out until the revocation. All cookies and other technologies are described in detail in the cookie banner under the services. You can view these at any time in the "Privacy settings" in the footer of the website or you can click directly here.
You can also revoke your consent at any time in the privacy settings.
5.5 Integration of third-party media
Audio/video services are integrated into our website as iFrames (an HTML object). iFrames make it possible to integrate web content from an external website into the website you are accessing.
e.g. Vimeo video embedding
Our website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.
When you visit one of our pages equipped with a Vimeo plugin, a connection to the Vimeo servers is established. The Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA.
The embedding of Vimeo videos is based on Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in an appealing design of the site, in public relations and communication) If you are logged into your Vimeo account, you enable Vimeo to assign your surfing behaviour directly to your personal profile. REWE is not involved in this data processing.
You can prevent this by logging out of your Vimeo account. You have the right to object to Vimeo at any time for reasons arising from your particular situation.
Further information on the handling of user data can be found in Vimeo's privacy policy at: https: //vimeo.com/privacy. There is a data protection agreement between the REWE Group and Vimeo.
e.g. Soundcloud audio embedding
Our website uses plugins from the audio portal Soundcloud. The provider is Soundcloud Limited c/oThird Floor, 20 Old Bailey, London, EC4M 7AN.
When you visit one of our pages equipped with a Soundcloud plugin, a connection to the Soundcloud servers is established. This tells the Soundcloud server which of our pages you have visited. Soundcloud also obtains your IP address. This also applies if you are not logged in to Soundcloud or do not have a Soundcloud account. The information collected by Soundcloud is transmitted to the Soundcloud servers in Europe.
The embedding of Soundcloud files is based on Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in an appealing design of the site, in public relations and communication).if you are logged into your Soundcloud account, you enable Soundcloud to assign your surfing behaviour directly to your personal profile.
You can prevent this by logging out of your Soundcloud account. You have the right to object to Soundcloud at any time for reasons arising from your particular situation.
Further information on the handling of user data can be found in Soundcloud's privacy policy at: https: //soundcloud.com/pages/privacy
5.6 Web server logs
When you visit our websites, we process the connection data of the requesting computer including the IP address - the websites you visit on our site the date and time the duration of the visit the identification data of the browser and operating system type used the website from which you visit us as standard to ensure the security of our IT systems. The legal basis for the data processing described is Article 6(1)(f) of the General Data Protection Regulation (balancing of interests, based on the interest of REWE-ZENTRALFINANZ eG in ensuring the security of IT systems).
We store this data for 7 days.
6. Who has access to your data and for what reason?
Within the REWE Group, only persons who need your data to fulfil the tasks assigned to them will have access to it. In addition, service providers who support us in the fulfilment of our tasks may have access to your data. These are service providers in the following categories
Service providers used by us must fulfil special confidentiality requirements. They are only granted access to your data to the extent and for the period of time required to fulfil their tasks.
If a criminal offence is suspected, we may pass on your data to law enforcement authorities (e.g. police, public prosecutor's office).
7. Is data processed outside the European Union?
We also use service providers located in third countries outside the European Union to process your data. Countries outside the European Union handle the protection of personal data differently than countries within the European Union. There is currently no decision by the EU Commission that these third countries generally offer an adequate level of protection. We have therefore taken special measures to ensure that your data is processed just as securely in third countries as it is within the European Union. We conclude the data protection contract (standard data protection clauses) provided by the Commission of the European Union for the processing of personal data in third countries with service providers in third countries. This provides suitable guarantees for the protection of your data with service providers in third countries.
8. How long is the data stored?
We generally only store your data for as long as we need it for the respective processing purposes. If the data is no longer required for the fulfilment of the processing purposes stated in this data protection notice, it will be deleted, unless its retention is still necessary to fulfil retention obligations under commercial or tax law, for example. As a rule, we delete your data after these periods or determine the deletion period according to these criteria. We usually delete data in connection with point 5.4.2 between 7 days and 6 years. Further deletion periods can be found in the sections above and below.
8.1 Data about participation in a competition:
All data will be deleted 6 months after the end of the competition Winners' data will be deleted after 10 years for tax reasons
Please also note the conditions of participation.
8.2 Data for the newsletter mailing:
Data collected when subscribing to the "one_Newsletter" will be deleted as follows:
Name will be deleted within 1 week after cancellation. Data on openings and clicks will be deleted after 6 months. Unconfirmed email addresses will be deleted after 1 month.
9. What are your legal rights?
9.1 Information
You can request information about your personal data processed by us.
9.2 Correction
If your details are not (or are no longer) correct, you can request that your data be corrected. If your data is incomplete, you can request that it be completed.
9.3 Erasure
You have the Legal right to request the deletion of your data. Please note that a right to erasure depends on the existence of a legitimate reason. In addition, there must be no regulations that oblige us to retain your data.
9.4 Restriction of processing
You have the Legal right to request the restriction of the processing of your data. Please note that a right to restriction of processing depends on the existence of a legitimate reason.
9.5 Objection
You have the legal right to object to the processing of your data on grounds relating to your particular situation. In the event of a justified objection, we will no longer process your data.
9.6 Right to lodge a complaint
You are entitled to lodge a complaint with a data protection supervisory authority if you do not agree with the processing of your data.
9.7 Data portability
You have the legal right to receive personal data that you have provided to us in an electronic format.
9.8 Withdrawal of your consent
You have the legal right to withdraw your consent to the processing of your data that you have given us at any time. This also applies to the revocation of declarations of consent that you gave us before the General Data Protection Regulation came into force, i.e. before 25 May 2018. The easiest way to withdraw your consent is to send an email to the contact details above. Withdrawing your consent does not affect the lawfulness of the processing of your data carried out prior to the withdrawal.
