Kaufland Giftcards

Data protection

It is of utmost importance for us, Kaufland Dienstleistung GmbH & Co. KG, Rötelstraße 35, 74172 Neckarsulm, Germany, to protect your personal data. Below, we explain how we collect personal data when you use our website. Personal data means any information relating to you personally, such as your name, address, e-mail addresses and user behavior. The statutory basis for data protection is, in particular, the EU General Data Protection Regulation (GDPR).

1. Controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR)

Kaufland Dienstleistung GmbH & Co. KG

Rötelstraße 35

74172 Neckarsulm

Germany

Telephone: 08 00 / 1 52 83 52

E-mail: kundenmanagement@kaufland.de

2. Registering/signing in to your Kaufland customer account

Purpose of processing/legal basis

You can only place an order in the online shop if you already have a Kaufland customer account. Registering/signing in to your customer account at giftcard.kaufland.com is arranged via a common, centralized login function of Kaufland Dienstleistung GmbH. The common login function allows you to access all services on the basis of a single login. During the registration/sign-in process, the following data will be processed:

• E-mail address
• Name
• Title
• Telephone number (where applicable)
• Information on consents (consents otherwise remain unaffected)
• Password
• Date of birth (where applicable)

Legal basis for processing your data is Article 6(1)(f) GDPR. The Kaufland companies' legitimate interest in this respect results from the interest in being able to provide customers with the extended functions of the overarching customer accounts.

Your customer account data may also be used within the Schwarz Group by the responsible departments for technical administration of the Kaufland customer accounts and for purposes of anonymous statistical analyses.

For further information on the storage time and your rights to object, see the further information on using the kaufland.de online marketplace at www.kaufland.de/rechtliches/datenschutz and on using filiale.kaufland.de at filiale.kaufland.de/datenschutz.

3. Contact form/inquiries by e-mail/phone

a. Purpose of processing/legal basis

We treat all personal data which you provide us with when you complete our contact form, by phone or e-mail confidentially. We use your data solely for the limited purpose of processing your inquiry. The legal basis for the processing is Article 6(1)(f) GDPR. Kaufland's legitimate interest arises from the interest in responding to inquiries from our customers and visitors to this website so that customer satisfaction is ensured and promoted.

b. Recipients/categories of recipient

As a rule, we do not transfer the data to third parties outside of the Kaufland Group. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. Furthermore, it may be necessary for us to pass on excerpts of your inquiry to contractual partners (e.g., suppliers in the case of product-specific inquiries) for the purpose of processing your inquiry. Where possible, your inquiry will be anonymized in advance, meaning that third parties will not be able to identify you. In some cases, it may be necessary to disclose your personal data (to suppliers or service providers, for example) in order to process your inquiry further.

c. Storage time/criteria for determining storage time

We delete or securely anonymize all personal data we receive from you when you make inquiries (positive/negative comments or suggestions) via our website or by e-mail no later than 90 days after the final response is sent to you. The information is retained for 90 days in case you contact us again as a customer after receiving a response from us on the same matter and we need to refer to our previous correspondence. Based on experience, we generally do not receive any questions concerning our responses after 90 days.

If you assert your rights as a data subject, your personal data will be stored for three years after the final response in order to document the fact that we provided you with comprehensive information and that the legal requirements have been met. If you receive a gift voucher from us (e.g., as a gesture of goodwill), we retain your data only as long as necessary and as long as deletion is not precluded by compliance with a legal obligation to which the controller is subject (documentation and retention obligations under tax law).

4. Accessing our website

Purposes of the processing/legal bases

When accessing our website, the browser used on your end device will – automatically and without any action on your part – send

• the IP address of the accessing Internet-enabled device;
• the date and time of access;
• the name and URL of the requested file;
• the website/application from which the access occurred (referrer URL);
• the browser and, where relevant, the operating system of your Internet-enabled computer; and
• the name of your Internet service provider

to our website server and be stored temporarily in what is known as a log-file for the following purposes:

• to ensure a fault-free connection;
• to ensure the comfortable use of our website/application; and
• to analyze system security and stability.

The legal basis for the processing of the IP address is Article 6(1)(f) GDPR. The purposes of data processing listed above constitute our legitimate interest. If data is used for purposes of preparing a contract, the legal basis for the data processing is Article 6(1)(b) GDPR.

Storage time/criteria for determining storage time

The log files are stored in the active systems for 30 days and thereafter erased.

We use Google reCaptcha, a Google LLC ("Google") service, for the purposes of safeguarding your customer profile, protecting your data, safeguarding the transmission of forms and protecting our systems, in particular in the context of registration and/or sign-in. The legal basis for this is Article 6(1)(f) GDPR. Our legitimate interest in doing so lies in protecting your data and our systems, and follows from the aforementioned purposes. This service performs an analysis of various information to determine whether the data was entered by a person or by an automated program (bot). Google reCaptcha analyses various information (e.g., IP address, how long you spent on the site or your mouse movements). The information generated is transmitted to a Google server in the USA and processed there. The collection and analysis of that information does not enable us or Google to identify you. In particular, Google does not merge the information with your personal data.

For further information on Google reCaptcha, please see https://policies.google.com/privacy?hl=de or https://policies.google.com/terms?hl=de.

5. Processing your order

The following data are processed in the context of your order:

a. Shipping address and billing address

• Title (Mr./Ms./Family/none)
• First and last name
• Address
• E-mail address

You can also provide the following data voluntarily. These details are not mandatory for provision of the service:

• Telephone number
• Title

Business customers must provide additional information:

• Company, name, designation and legal form
• Customer type (private or business customer)

b. Payment and order processing

When you place an order, we also collect and process the following order details:

• Items in your shopping cart
• Order date
• Order number
• Customer number
• Receipt of payment
• Pricing information
• Shipping information
• Activation date
• Card details

Purpose of the processing/legal basis

The data is processed for purposes of order processing and thus required for the performance of a contract with the user or to take steps prior to entering into a contract. In performing the contract, we process your data in accordance with Article 6(1)(b) GDPR.

Recipients/categories of recipient

Your personal data are only transferred to third parties if you have given us your explicit consent to do so or this is lawful based on the legislative criteria (e.g., transferring your first and last names and address to our logistics service provider to deliver cards you have ordered).

Storage time/criteria for determining storage time

The data is deleted as soon as it is no longer required for the purpose for which it was collected. Insofar as the data collected does not serve the purpose of entering into a contract with the user, the data collected during the registration process will be deleted if the Kaufland customer account required to use the gift card shop is deleted.

With respect to data collected when orders are placed, in order to perform a contract or to take steps prior to entering into a contract, the data will be deleted once it is no longer required for the performance of the contract. Even after entering into a contract, it may be necessary to store the counterparty's personal data in order to comply with contractual or statutory obligations, such as those arising from the limitation periods for warranty claims or record-keeping obligations under tax law.

6. Kaufland newsletter

You can subscribe to the Kaufland newsletter from Kaufland Dienstleistung GmbH & Co. KG via our website. Further details about our newsletter can be found in the privacy policy at filiale.kaufland.de.

7. Gift card newsletter – offers/discounts by e-mail

Purpose of processing/legal basis

You can subscribe to the Kaufland gift card newsletter online at giftcard.kaufland.com. The legal basis for the data processing is Article 6(1)(a) GDPR, i.e., the consent you have given us to send you the Kaufland gift card newsletter. The purpose of data processing in the context of subscriptions to the Kaufland gift card newsletter is to inform newsletter subscribers about discount offers and services relating to gift cards (giftcard.kaufland.com).

By subscribing to the Kaufland gift card newsletter, you consent to us processing your data for the purposes described in the consent form.

When you subscribe to the free-of-charge Kaufland gift card newsletter, you consent to Kaufland Dienstleistung processing your title, first name, last name, e-mail address, zip code and the country where you live as mandatory information for the purpose of e-mailing you the Kaufland newsletter relevant to you and notifying you of Kaufland gift card discount offers and services in that newsletter.

If you voluntarily provide optional information on your order (company name, name, designation and legal form), you consent to us using these data to personalize your newsletter.

If you withdraw your consent to receive the Kaufland gift card newsletter, you will no longer receive the newsletter and your newsletter data will be erased. You can also modify or delete your optional data at any time.

You may withdraw your consent and unsubscribe from the Kaufland gift card newsletter at any time with effect for the future by sending an e-mail to kundenmanagement@kaufland.de.

Recipients/categories of recipient

Data collected for the purpose of the Kaufland gift card newsletter subscription can only be accessed by the department at Kaufland Dienstleistung that is responsible for processing and managing the distribution of the newsletter, and our Account Management. Insofar as external processors are used to distribute the newsletter, such processors are bound by contract in accordance with Article 28 GDPR and care has been taken to ensure that they have appropriate technical and organizational security measures in place.

Storage time/criteria for determining storage time

If you withdraw your consent and unsubscribe from the Kaufland gift card newsletter, your account data will be immediately locked and subsequently deleted. You will then no longer receive the newsletter.

8. Cookies/tracking technologies

Controller and purposes of the processing/legal bases

We, Kaufland Dienstleistung GmbH & Co. KG, are the controller with respect to data processing in connection with the use of "cookies" and other similar technologies to process usage data on all (sub-)domains below giftcard.kaufland.com.

Cookies are small text files that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our websites. Cookies do not cause any harm to your end device, nor do they contain any viruses, trojans or other malware. The cookie stores certain information that results in connection with the specific end device deployed. This does not, however, mean that we will immediately become aware of your identity.

Cookies and the other technologies used to process usage data are deployed for the following purposes, depending on the categories of cookie/other technologies:

Technically necessary: These are cookies and similar technologies without which you cannot use our services (e.g., for the correct display of our website/functions requested by you, to record you signing in, etc.). A list of all technically necessary technologies/cookies in use can be found here.

Technically necessary cookies and other technologies categorized as "technically necessary" are used on the basis of section 25 (2) no. 2 of the German Telecommunications and Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz – TTDSG). Data is subsequently processed based on our legitimate interests pursuant to Article 6(1) sentence 1(f) GDPR.

Preferences: using these methods, we can take into account your actual or perceived preferences to enhance the user experience. For example, we can use your settings to display our website in a language relevant to you. They also mean we can avoid displaying products that may not be available in your region. A list of all preference technologies/cookies in use can be found here.

Cookies and other technologies for the purposes of preferences are used on the basis of section 25 (1) TTDSG. Data is subsequently processed based on your consent pursuant to Article 6(1) sentence 1(a) GDPR.

Statistics: These methods enable us to tailor the design of our services by producing pseudonymized statistics about how they are used. For example, we can use them to determine how better to adapt our websites to user habits. A list of all statistics technologies/cookies in use can be found here.

Cookies and other technologies for the purposes of statistics are used on the basis of section 25 (1) TTDSG. Data is subsequently processed based on your consent pursuant to Article 6(1) sentence 1(a) GDPR.

Marketing: these enable us to display relevant advertising content based on an analysis of your pseudonymized usage behavior. Your usage behavior can also be tracked over various websites, browsers or devices via a user ID (unique identifier).

Your consent to the collection of the pseudonymized user profile and its disclosure for marketing purposes together with the pseudonymized user ID enables relevant advertising content to be displayed to you on other Kaufland websites and services and, where applicable, other third-party channels, that corresponds to your presumed interests based on your user profile.

We also analyze your use of our Kaufland websites (e.g., advertising banners viewed or clicked), firstly to optimize our advertising and offers for you and other customers, and secondly to provide our advertising partners pseudonymized data for billing purposes and to optimize their marketing campaigns. Our advertising partners cannot use this information to identify you. If you do not give your consent or if you withdraw your consent with effect for the future, you will only be displayed random content on the respective web banners on our services and websites and those of third parties. A list of all "marketing technologies/cookies" in use can be found here.

Cookies and other technologies for the purposes of marketing are used on the basis of section 25 (1) TTDSG. Data is subsequently processed based on your consent pursuant to Article 6(1) sentence 1(a) GDPR.

Please click here for an overview of the cookies and other technologies we use, including their function, expiration, and any third party providers involved.

Depending on the purpose, the use of cookies and similar technologies to process usage data involves processing the following types of personal data in particular:

Technically necessary

• language settings
• items in a shopping cart
• login details

However, please be advised that in such a case you may not be able to use all the functions of this website in their entirety.

Statistics

• Pseudonymized usage profiles containing information on the use of our websites.
• These contain in particular:
  • browser type/browser version;
  • operating system used;
  • referrer URL (i.e., the previously visited page);
  • host name of the accessing computer (IP address);
  • time of the server request;
  • individual user ID; and
  • events triggered on the website (web browsing behavior).
• The IP address is routinely anonymized, which in principle means it is no longer possible to identify you.
• We only store the user ID together with other data you provide (e.g., name, e-mail address) if you give us separate express permission to do so. In itself, we cannot use the user ID to identify you.

Marketing

• Pseudonymized usage profiles containing information on the use of our websites.
• These contain in particular:
  • IP address;
  • individual user ID;
  • products potentially of interest;
  • events triggered on the website (web browsing behavior).
• IP addresses are routinely anonymized, which in principle means it is no longer possible to identify you.
• We only store the user ID together with other data you provide (e.g., name, e-mail address) if you give us separate express permission to do so. In itself, we cannot use the user ID to identify you.

The legal basis for using preference, statistical and marketing cookies and similar technologies is your consent given pursuant to Article 6(1)(a) GDPR and section 25 (1) TTDSG. The legal basis for using technical cookies and similar technologies is Article 6(1)(b) GDPR, i.e., we process your data in order to prepare our services as part of initiating and performing the contract.

You may, of course, configure your browser so that it does not store our cookies on your terminal device (see the section on "Use of cookies in general").

8.1 Web tracking using Adobe Analytics

Purpose of processing/legal basis: This website uses the Adobe Analytics web analytics service to analyze user access to the website. The data is processed on the basis of your consent (Article 6(1)(a) GDPR and section 25 (1) TTDSG). We use information generated during your use of our web pages (namely, the page from which the file was requested, the name of the file, the date and time of the request, the volume of data transferred, the access status such as "file transferred", "file not found", etc., a description of the type of web browser used and an anonymized IP address – truncated by the last three digits) for purposes of user navigation, statistical analyses, adapting our web pages to your needs, displaying ads on the website (displaying product information on the relevant buttons on this website that reflect your click behavior on filiale.kaufland.de) and to identify and protect against abnormal website traffic. For this purpose, we use cookies that control your connection to our web pages during the session. A permanent cookie is set in your web browser by our provider Adobe Systems GmbH to create a pseudonymized user profile. This permanent cookie makes it possible to recognize your browser the next time you visit our website. It is used for advertising, market research and tailoring our website to users.

The information stored on the Adobe servers cannot be used to directly identify you because Adobe Analytics is used with the settings "Before Geo-Lookup: Replace visitor's last IP octet with 0" and "Obfuscate IP-Removed". The setting "Before Geo-Lookup: Replace visitor's last IP octet with 0" ensures that the IP address is anonymized before geolocation by replacing the last octet of the IP address with zeros. The user's approximate location is added to the tracking packet, which still contains the full IP address, for purposes of statistical analysis. Before the tracking packet is stored, the IP address is then replaced with a single fixed IP address referred to as a generic IP address if the "Obfuscate IP-Removed" setting is configured. This means that the IP address is no longer included in a stored data record.

The data collected using Adobe Analytics technology is not used to personally identify visitors to this website. Nor is the usage data stored in the cookie merged with personal data about the bearer of the pseudonym.

To prevent general tracking by Adobe, simply click on this link and confirm your objection on the page it redirects you to. In this case, Adobe will place a permanent "Do not track" cookie in your browser so that the Adobe technology is no longer used.

Recipients/categories of recipient: Insofar as Adobe or other technical service providers access your data for support purposes, data processing agreements in accordance with Article 28 GDPR have been entered into with them.

8.2 Storage time/criteria to determine storage time for cookies

For information on the duration of storage for cookies, see our cookie policy. If "persistent" is entered in the "expiration" column, the cookie will be stored permanently until the corresponding consent is withdrawn.

8.3 Summary of all opportunities to object

The following tracking and analysis tools within the meaning of Article 6(1)(a) GDPR and section 25 (1) TTDSG are embedded in this website. You can object to their use with effect for the future by clicking on the respective link:

• Service provider: Adobe Webtracking System; link to object

8.4 Use of cookies and other similar technologies to process usage data

We use various types of technologies on this website. Some technologies are deployed by our partners. Some technologies save data locally for the session, in other words for the duration of your respective visit to the site. The data saved locally is deleted as soon as you end the session or close your browser. We also use technologies (e.g., local storage) that save data locally for longer periods (persistently). These technologies prevent us from defining a specific expiry date. The data saved locally is generally only deleted if you withdraw your consent or delete the data yourself (e.g., via your browser settings). Our privacy policy contains more information on who we are, how you can contact us and how we process personal data. When contacting us about your consent, please provide your consent ID and the date.

You can change or withdraw your consent at any time:

9. Rights of data subjects

Pursuant to Article 15(1) of the GDPR, you have the right to request information, free of charge, on the personal data stored about you at Kaufland.

If the statutory requirements are met, you also have a right to rectification (Article 16 GDPR), erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR) of your personal data.

If the basis of processing is Article 6(1)(e) or (f) GDPR, you have a right to object under Article 21 GDPR. If you object to processing, your data will no longer be processed thereafter, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests of the data subject in the objection.

If you have provided the processed data yourself, you have a right to data portability under Article 20 GDPR.

If the data processing is carried out on the basis of consent granted under Article 6(1)(a) or Article 9(2)(a) GDPR, you may withdraw that consent at any time with effect for the future without this affecting the lawfulness of the previous processing.

In the above-mentioned cases, or if you have questions or complaints, please write to or e-mail the data protection officer.

You also have a right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority located in the state in which you live or where the controller is domiciled has jurisdiction.

10. Contact details and address of the data protection officer

E-mail: datenschutz@kaufland.de

Mailing address:

Kaufland Dienstleistung GmbH & Co. KG

Kaufland Datenschutzbeauftragter

Rötelstraße 35

74172 Neckarsulm

Germany