Data protection/privacy

1 Name and contact details of the controller responsible for processing

This data protection notice applies to data processing by

shopping24 Gesellschaft für multimediale Anwendungen mbH
An der Alster 45
20099 Hamburg
[Germany]

Represented by the managing director(s): David Reed (CEO), Nils Grabbert (CTO) and Michael Schambach (CFO)
+49 (0)40 228 525 10
info@s24.com

www.s24.com

for the following websites: s24.com

2 Contact details of the data protection officer

The controller's operational data protection officer(s) can be contacted at

ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Große Bleichen 21
20354 Hamburg
[Germany]

datenschutz@s24.com

3 Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party, and categories of recipients

3.1 Accessing our websites/applications

3.1.1 Log-Files

Each time you access websites/applications, information is sent to our website/application server by your end device’s web browser and is temporarily stored in ‘log files’. The stored data records contain the following data, which is stored until automatic erasure: date and time of access, name of the page accessed, IP address of the requesting device, referrer URL (URL from which you came to our website), amount of data transferred, loading time, product and version information of the browser used as well as the name of your access provider.
The legal basis for processing the IP address is Article 6 (1) (f) of the GDPR. Our legitimate interest is based on

• ensuring a smooth connection is established;
• ensuring the convenient use of our website/application;
• evaluating system security and stability; and
• Fraud prevention (see 3.2.2)

This data does not provide any direct indication of your identity and we do not make any assumptions in this regard.
The data will be stored and automatically erased once the aforementioned purposes have been achieved. The standard periods for erasure depend on the criterion of necessity.

3.1.2 Cookies, tracking, social media plugins

We use ‘cookies’, tracking tools, targeting procedures and social media plugins for our website/application. The exact procedures involved and how your data is used for this purpose are explained in detail below.

3.2 Establishment, execution and/or termination of a contract

3.2.1 Data processing on contract conclusion

If you register with one of our websites/applications and conclude a contract with us, we process the data required for the conclusion, execution or termination of a contract with you. This includes:

• First name, surname
• E-mail address

The legal basis for this is Article 6 (1) (b) of the GDPR, i.e. you provide us with the data on the basis of the respective contractual relationship (e.g. management of your customer account, processing of a purchase agreement) between you and us. In order to process your e-mail address in the event of a purchase via our websites/applications, we are also obliged to send an electronic order confirmation (Article 6 [1] [c] of the GDPR) on the basis of legal requirements in the German Civil Code (Bundesgesetzbuch, BGB).

If we do not use your data for advertising purposes (see 3.3. below), we store the data collected for contract processing until the statutory or possibly contractual warranty and guarantee rights expire. After this period, we shall retain the information concerning the contractual relationship required under commercial and tax law for the periods specified by law. For this period, the data will only be processed again in the event of verification by tax authorities.

3.2.2 Use of data for fraud prevention purposes

The data you provide when placing an order can be used to check whether an atypical order process has occurred (e.g. artificially generated traffic for our shop partners). We fundamentally have a legitimate interest in carrying out such a check. The legal basis for processing is Art. 6 Paragraph 1 Letter f) GDPR.

3.3 Data processing for advertising purposes

3.3.1 Newsletter

We give you the option of subscribing to our newsletter on our websites/applications. To ensure that no errors occurred when entering the e-mail address, we use the ‘double opt-in procedure’ (DOI procedure): after you have entered your e-mail address in the registration field, we will send you a confirmation link to the address provided. Only when you click on this confirmation link will your e-mail address be added to our newsletter mailing list. The legal basis for this data processing is Article 6 (1) (a) of the GDPR.

Reference to the right of withdrawal

You can revoke your consent at any time with effect for the future using the unsubscribe option at the end of each newsletter.

3.3.2 Competitions

If you register for competitions organised by us, we will use the data you provide at the time of registration for the purpose of executing the participation contract, particularly notifying you of your winnings and, if applicable, advertising our offers and/or those of our competition partners. Detailed information can be found in the conditions of participation for each competition. The legal bases for this data processing are Article 6 (1) (a) of the GDPR, Article 6 (1) (b) of the GDPR and Article 6 (1) (f) of the GDPR.

3.4 Website and website optimisation

Brief summary

As the operator of the s24.com website, shopping24 collects data on the behavior of users on the website mentioned (tracking data). This includes, among other things, which individual sub-pages (item detail pages) were accessed. For this purpose, shopping24 and / or partners of shopping24 can set cookies in the browser used by the respective user. The collection of tracking data is generally only permitted if you have given your prior consent. You can give such consent by clicking the "OK" button in the "cookie banner" displayed on s24.com. The granting of consent is not necessary for the processing of such tracking data, which is required for the offer on the s24.com website. This includes e.g. the setting of cookies for the purpose of displaying the shopping cart. Among other things, shopping24 can use the information about your usage behavior to show you interesting offers on s24.com or to advertise you on other websites using personalized content (e.g. retargeting). Insofar as personal data about your usage behavior on s24.com are also provided by other providers, e.g. can be used for the purpose of "enriching your own information", such use will only take place in these cases if you have given your prior consent. Tracking data that shopping24 collects and stores itself is processed by shopping24 exclusively in a pseudonymized manner. This prevents the data from being assigned to you personally. If you want to delete individual cookies set in your browser or want to find out which service providers / providers have set cookies in your browser, you can do this via a "preference manager". Such is e.g. available at www.youronlinechoices.com. You also have the option of setting your browser in such a way that it prevents the setting of cookies or only allows certain types of cookies to be set. Details on the possibility of changing the settings of the common browser types (including Google Chrome, Firefox) can be found under section 4.2. this information on data protection.

3.4.1 Cookies – general information

Cookies are used on this website. Cookies are small text files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.). Information is stored in the cookie that results in connection with the specific device used. However, this does not mean that we are immediately aware of your identity. Some of the cookies we use are deleted again at the end of the browser session (so-called session cookies). Through this we can e.g. Offer the cross-page shopping cart display, in which you can see how many items are currently in your shopping cart and how high your current purchase value is. Other cookies remain on your computer and enable us to recognize your computer the next time you visit (so-called permanent or cross-session cookies). These cookies in particular serve, among other things, to make our offer more attractive to you. Thanks to these files, it is possible, for example, to display information that is specifically tailored to your interests on the s24.com website.

According to the legal requirements, the storage of information on end devices (desktops, cell phones, tablets, etc.) - e.g. by setting cookies and retrieving information from end devices (tracking) only if you have given your prior consent. However, consent does not have to be given if such storage / retrieval is necessary for the offer on the website (including technically necessary cookies). A requirement is e.g. with regard to ensuring the following functionalities / achievement of the following purposes:

• Wishlist,
• Enabling and maintaining log-in,
• Prevention of click fraud,
• Ensuring system security.

With regard to the data processing that is necessary for the operation of the website, you have no right of objection. Therefore, within the consent preferences in the consent tool, the selection “technically necessary cookies” is always activated and cannot be deselected.

You can use the s24.com website without data being retrieved from or stored on your device for purposes that are not required for the offerings of the s24.com website. For this reason, when you use the s24.com website - unless you have given any further consent - only "basic tracking" is activated.

3.4.2 Intervention options / browser settings

Of course, you can set up your browser so that it does not save our cookies on your hard drive. The help function in the menu bar of most web browsers will explain how you can prevent your browser from accepting new cookies, how you can have your browser notify you when you receive a new cookie or how you can delete all cookies you have already received and block future cookies.

Please follow the steps below:

In Internet Explorer

1. Select ‘Internet options’ from the ‘Tools’ menu.
2. Click on the ‘Privacy’ tab.
3. Now you can change the security settings for the Internet zone. Here, you set whether cookies should be accepted or rejected and which cookies should be accepted or rejected.
4. Confirm your settings by clicking ‘OK’.

In Firefox:

1. Select ‘Settings’ from the ‘Extras’ menu.
2. Click on ‘Privacy’.
3. Select ‘Create according to user-defined settings’ from the drop-down menu.
4. Now you can set whether cookies should be accepted and how long you want to keep these cookies for, and add exceptions to which websites you always or never want to allow cookies for.
5. Confirm your settings by clicking ‘OK’.

In Google Chrome:

1. Click the Chrome menu on the browser toolbar.
2. Now select ‘Settings’.
3. Click on ‘Show Advanced Settings’.
4. Under ‘Privacy’, click on ‘Content settings’.
5. Under ‘Cookies’, you can change the following settings for cookies:
1. Delete cookies
2. Block cookies by default
3. Delete cookies and website data by default after closing the browser
4. Allow exceptions for cookies from specific websites or domains

However, please note that in this case, you may be unable to use all of the functions of this website to their full extent.

If these cookies and/or the information they contain relates to personal data, the legal basis for data processing is Article 6 (1) (f) of the GDPR. Our interest in optimising our website shall be deemed to be legitimate within the meaning of the aforementioned provision.

3.4.3 Piwik Consent Manager

We use a consent tool (“Piwik Consent Manager”) from the provider Piwik Pro GmbH to manage your settings and document the consent of users of our services, LLC (German headquarter: Kurfürstendamm 21, 10719 Berlin). Piwik will i.a. used to save the cookie settings for the entire website. Piwik Consent Manager stores information about the categories of cookies used by the website and whether users have given or revoked their consent to the use of each category. This enables us to prevent cookies from being set in each category in the user's browser if consent is not given for individual categories. Piwik Consent Manager uses cookies for information storage, which have a normal lifespan of one year, so that the settings of returning visitors are saved.

3.4.4 Consent to the use of individual online services / the collection of tracking data

As in section 3.4. In this information on data protection, shopping24 collects and processes some tracking data. on the basis of consent. You give this consent by clicking on the button "Ok" on the website s24.com that is linked to this consent text. By clicking the "OK" button, you give your consent for shopping24 to store data on your device (e.g. by setting cookies) or to retrieve data from your device. Furthermore, by clicking on the "OK" button, you give your consent to the use of certain advertising functions, the use of which requires consent. You also have the option of clicking "Settings" in the banner and managing your consent preferences there. A distinction is made there between "functional cookies", "statistics and analysis cookies", "cookies for marketing purposes" and "ads". The data processing that takes place in connection with these advertising functionalities is described below (section 3.4.4.1. To section 3.4.4.4 of this data protection declaration).

3.4.4.1 Consents for functional cookies

3.4.4.2 Consents for statistics and analysis cookies

3.4.4.3 Consents for cookies for marketing purposes

3.4.4.3.1 Consent for Google-Remarketing

This website uses the Google remarketing service. Google Remarketing is an online advertising program from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). We use the remarketing function within the Google AdWords service. With the remarketing function, we can present you with advertisements based on your interests on other websites within the Google advertising network. Your surfing behavior on our website is analyzed for this, e.g. which offers you have viewed. This enables us to display so-called "Google ads" and individualized advertising on other websites even after you have visited our website on the Google online search engine. For this purpose, Google saves a cookie in your browser when you visit Google services or websites in the Google advertising network. This cookie is used to record your visits. The cookie is used to uniquely identify your web browser and not to identify you personally. It is possible for Google to use the data collected about your usage behavior via the s24.com website for its own purposes or for the purposes of other Google customers (e.g. to display individualized third-party advertisements). Such further processing of the data as well as the processing of the data after their transmission by shopping24 to Google is carried out by Google as the sole data protection officer. The legal basis for this data processing is Article 6 Paragraph 1 Letter a) GDPR (consent).

You can find more information about Google remarketing and Google's data protection declaration at: www.google.com/privacy/ads/. Here you can also assert your rights as a data subject (e.g. right to deletion) with regard to the data that Google, as the person responsible for data protection, processes. You can revoke the consent you have given for the use of Google remarketing here or refuse to give your consent and use Google remarketing.

3.4.4.3.2 Consent for Microsoft Advertising

Our website uses the Microsoft Advertising service. Microsoft Advertising is an online advertising program operated by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521). ("Microsoft"). We use so-called Universal Event Tracking (UET) within the Microsoft Advertising service with which data is collected and stored on this website for marketing and optimization purposes. Your surfing behavior on our website is analyzed for this, e.g. which offers you have viewed. Microsoft saves a cookie in your browser for this purpose. Your visits are recorded via this cookie. The cookie is used to uniquely identify your web browser and not to identify you personally. The legal basis for this data processing is Article 6 Paragraph 1 Letter a) GDPR (consent). You can see more information on Microsofts privacy policy at: https://privacy.microsoft.com/de-DE/privacystatement Here you can also assert your rights as a data subject against Microsoft (e.g. right to deletion). The legal basis for the data processing described above is that in Article 6 Paragraph 1 Letter a) GDPR (consent).

You can deactivate the use of cookies by Microsoft and thus revoke the consent you gave us to use the Microsoft Advertising service or refuse your consent to the use of Microsoft retargeting by following the link below: http://choice.microsoft.com/de-DE /opt-out

3.4.4.3.3 Consent for social media plugins

We use social plug-ins from the social networks Facebook, Youtube and Google+ on our website on the basis of Article 6 Paragraph 1 Letter f) GDPR in order to make our company better known. The underlying advertising purpose is to be regarded as a legitimate interest within the meaning of the GDPR.

The purpose and scope of the data collection and the further processing and use of the data by the respective provider as well as your related rights and setting options to protect your privacy can be found in the respective data protection information of the provider, which we link below.

By logging out of the social network pages beforehand and deleting cookies that have been set, you can prevent social networks from assigning the information collected about you to your user account on the respective social network during your visit to s24.com. If you do not want social networks to assign the data collected via our website directly to your profile, you must log out of the relevant social networks before visiting our website. You can completely prevent the loading of the plugins with add-ons for your browser, e.g. B. with the script blocker "NoScript", to be found at: https://noscript.net.

3.4.4.3.3.1 Facebook, Google+ und YouTube

Social plugins from Facebook and Google (Google+ and YouTube) are used on this website. These are offers from the US company Facebook and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

When you visit a page that contains such a plugin, your browser connects to Facebook or Google and the content is loaded from these pages. Your visit to this website can possibly be tracked by Facebook and Google, even if you are not actively using the social plugin function. If you have an account on Facebook or Google, you can use such a social plugin and share information with your friends. shopping24 has no influence on the content of the plugins and the transmission of information.

Facebook and Google provide detailed information on the scope, type, purpose and further processing of your data on their websites. Here you will also find further information on your rights and setting options to protect your privacy.

Data protection information from Facebook: https://www.facebook.com/about/privacy.

Googles privacy policy: http://www.google.com/intl/de/policies/privacy.

3.4.4.3.3.2 Twitter

Functions of the Twitter service are also integrated on this website. These functions are offered by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (“Twitter”). By using Twitter and the “Re-Tweet” function, the websites you visit on shopping24 are linked to your Twitter account and made known to other users. This data is also transmitted to Twitter. Your internet browser establishes a direct connection to the Twitter servers and transmits data to Twitter.

We would like to point out that we have no knowledge of the content of the transmitted data or their use by Twitter. You can find more information on this in Twitter's data protection declaration: https://twitter.com/privacy.

You can change your data protection settings on Twitter in the account settings http://twitter.com/account/settings.

3.4.4.3.3.3 Xing, kununu und LinkedIn

This website also includes plugins from the social networks LinkedIn, LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA and Xing AG (Xing and kununu), Gänsemarkt 43, 20354 Hamburg. Information on data protection can be found in the data protection declaration of LinkedIn and Xing (+ kununu), which you can find here:

http://www.linkedin.com/legal/privacy-policy

http://www.xing.com/privacy

3.4.4.4 Revocation of all consents

You can completely revoke the consent you have given for the data processing described above (sections 3.4.4.1. To 3.4.4.4) here.

3.4.4.5 Further processing of tracking data for legitimate interests

3.4.4.5.1 Legitimate interests of shopping24 / weighing of interests

shopping24 is entitled to further process tracking data that has been collected after consent has been given on the basis of legitimate interests. This further processing is based on the legal basis in Article 6 Paragraph 1 Letter f) GDPR (weighing of interests). Insofar as shopping24 processes tracking data on the basis of the legal basis in Article 6 Paragraph 1 Letter f) GDPR, this is done exclusively for purposes which shopping24 has a legitimate interest in tracking. These legitimate interests include, among other things, the processing of tracking data for the purpose of displaying individualized advertising on third-party sites and making product suggestions on s24.com. In connection with the further processing of tracking data, shopping24 does not process any data that is classified as particularly sensitive by law in Article 9 GDPR (e.g. health data). Furthermore, shopping24 does not use the tracking data to create evaluation results that could be assigned to the areas specially protected by Article 9 GDPR. On the basis of the tracking data, shopping24 does not make any automated decisions that could have legal effects on you as a user of the s24.com website or significantly affect you in a similar manner (e.g. individualized price adjustments based on your usage behavior). In addition, the tracking data is subject to pseudonymisation by shopping24 - depending on its scope and the risks arising from the processing of the tracking data for your rights to be safeguarded - which prevents the data from being assigned to you personally.

3.4.4.5.2 Piwik Pro Basic Tracking

For the purpose of the needs-based design and continuous optimization of :host, data collected on the basis of the basic tracking of Piwik Pro on the legal basis in Article 6 Paragraph 1 Letter f) GDPR (legitimate interest). The basic version of Piwik Pro is a web analysis service from Piwik Pro GmbH. Piwik Pro uses so-called "cookies" (text files) that are stored on your computer and that enable your use of the website to be analyzed. On behalf of shopping24, Piwik Pro will use this information to evaluate your use of the website and to compile reports on website activity. Piwik Pro GmbH processes the data collected through the use of the "basic tracking" of Piwik Pro exclusively on the instructions of shopping24 and for the purposes of shopping24.

3.4.4.5.3 AWIN

For the correct recording of sales and / or leads, AWIN AG, Eichhornstrasse 3, 10785 Berlin (hereinafter “AWIN”) places a cookie on a visitor's device. The cookies used by AWIN are accepted in the standard setting of the Internet browser. If you do not want these cookies to be stored, please deactivate the acceptance of cookies for the relevant domains in your Internet browser. AWIN cookies only save the ID of the intermediary partner and the serial number of the advertising material clicked on by the visitor (banner, text link, etc.), which are required for payment processing. When concluding a transaction, the partner ID is used to assign the commission to be paid to the mediating partner. The legal basis for this data processing is Article 6 Paragraph 1 Letter f) GDPR.

Details on data protection can be found at: www.awin.com/de/rechtliches/

3.5 Customer account/user account

To make use as convenient as possible for you, we give you the option of permanently storing your personal data in a password-protected customer account/user account.

The creation of the customer account is voluntary and takes place on the basis of your consent within the meaning of Article 6 (1) (b) of the GDPR. Once a customer account has been set up, no further data entry is required. In addition, you can view and change the data stored about you in your customer account at any time.

It is only necessary to open a customer account if you want to place orders via our website/application, so that we can then process the contract. The legal basis for data processing in this case is (additionally) Article 6 (1) (b) of the GDPR.

In addition to the data requested for an order, you must also enter a password of you have chosen to set up a customer account. Together with your e-mail address, these are the login details for your customer account. Please treat your personal login details as confidential and, in particular, do not make them accessible to unauthorised third parties. Please note that you will automatically stay signed in after leaving our website, unless you actively sign out. You have the option of deleting your customer account at any time. However, please note that this does not simultaneously erase the data that can be seen in the customer account once you have placed an order with us. Your data is automatically erased after expiry of our retention obligations under commercial and tax law. The legal bases for this data processing are Article 6 (1) (c) and Article 6 (1) (f) of the GDPR.

3.6 Contacting us

You have the opportunity to get in touch with us in several ways. By e-mail, by phone, by chat or by post. When you contact us, we use the personal data that you voluntarily provide to us in this context for the sole purpose of being able to contact you and process your request.

The legal basis for this data processing is Art. 6 Paragraph 1 Letter a), Art. 6 Paragraph 1 Letter b), Art. 6 Paragraph 1 Letter c) GDPR and Art. 6 Paragraph 1 Letter f) GDPR.

4 Data protection information for applicants

We are pleased that you are interested in us and that you are applying or have applied for a position in our company. We attach particular importance to the protection of your personal data. Your personal data will be processed in accordance with the current data protection regulations in accordance with the legal regulations applicable from May 25, 2018, i. H. of the General Data Protection Regulation and new provisions of the Federal Data Protection Act. In the following, we would like to provide you with information on the processing of your personal data in connection with your application.

4.1 Responsible in terms of data protection law

The person responsible within the meaning of data protection law is

shopping24 company for multimedia applications mbH
An der Alster 45
20099 Hamburg

4.2 What is personal data?

According to Art. 4 No. 1 GDPR, personal data is all information that relates to an identified or identifiable natural person.

4.3 Which data are processed?

4.3.1 The following data or data categories are processed to carry out the application process:

• Applicant master data (first name, surname, salutation, email address, telephone number, address, date of birth, citizenship)
• Qualification data (cover letter, letter of motivation, curriculum vitae, previous activities, professional qualifications and skills)
• Voluntary information, such as an application photo, information on severely disabled status or other information that you voluntarily provide to us in your application or that you upload voluntarily
• Additional questions depending on the respective advertisement (e.g. driver's license, citizenship)
• the communication between you and us as well as comments and ratings that are written about you in the course of your application process
• Other data / data categories, e.g. job-related data made publicly available, e.g. a profile on professional social media networks such as XING or LinkedIn.
• Special categories of personal data: If you provide information in your application documents that contain special categories of personal data within the meaning of Art. 9 Paragraph 1 GDPR (e.g. information that allows conclusions to be drawn about your sexual orientation; information about your health; information that draws conclusions your ethnic origin or your religion), we will only process this data within the legally permissible framework.

4.3.2 In connection with the use of the platform, the following additional personal data are processed:

• Automatically collected usage data

When accessing the jobbase.io domain, your internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is recorded by Prescreen:

• Date and time as well as duration of the access,
• Browser type / version,
• operating system used,
• URL of the previously visited website,
• amount of data transferred,
• A GeoIP lookup is made based on the IP address (Internet protocol address),
• Name of the files accessed,
• http status code (e.g. "request successful"),
• and URL of the accessed website,
• Access type (GET, POST).

This data is technically necessary to offer the functions of the e-recruiting system and to guarantee its stability and security. Prescreen stores them for a period of 12 months. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified.

The legal basis for processing the data is Article 6 (1) (f) GDPR.

• Cookies

Prescreen uses cookies. These serve to make the online application more user-friendly and effective. The cookies are technically necessary to make this website available to you. The website would not be able to operate without the use of cookies. There is therefore no way to object to the use of cookies.

The legal basis for processing the data is Article 6 (1) (f) GDPR.

The cookies used by Prescreen can be found in the Prescreen data protection information at: https://prescreen.io/de/datenschutzerklaerung/

4.4 For what purposes do we process your data and on what legal basis?

4.4.1 Data processing for the purposes of the employment relationship - § 26 BDSG

Your personal data will be processed for the purpose of personnel selection to fill vacancies, i.e. to initiate an employment contract. The necessity and the scope of the data collection are assessed, among other things, according to the position to be filled. If your desired position is associated with the performance of particularly confidential tasks, increased personal and / or financial responsibility, or if you have certain physical and health requirements is checked, more extensive data collection may be necessary. The legal basis is Section 26 (1) of the Federal Data Protection Act (BDSG).

4.4.2 Consent - Article 6 (1) (a) and Article 9 (2) (a) GDPR, Section 26 (2) BDSG

If you have given us your voluntary consent to the processing of certain personal data, then this consent forms the legal basis for the processing of this data.

In the following cases, we process your personal data on the basis of your consent:

Inclusion in the applicant pool, i.e. we save the application documents beyond the current application process for consideration in later application processes.

If we base data processing on your consent, you have the right to revoke your consent at any time with effect for the future. If possible, send the revocation by email to job@s24.com. The legality of the processing of your data up to the time of the revocation remains unaffected.

4.4.3 Data processing based on legitimate interest - Art. 6 Paragraph 1 lit. f GDPR

In certain cases we process your data to safeguard a legitimate interest of us or of third parties. A legitimate interest exists, for example, if your data is required to assert, exercise or defend legal claims in the context of the application process (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes.

4.4.4 Feedback questionnaire

In order to optimize our application processes and to improve ourselves as an employer, we offer you the opportunity to provide your personal feedback. For this purpose, we will send you (with your prior consent) a feedback questionnaire to the email address you provided. If you take part in the survey, our service provider Prescreen (see point 4.5 "Who will your data be passed on?") Will record the feedback, position title and location of the position as well as the job category and, if applicable, the type of employment for which you have applied . This information is then transmitted to kununu GmbH and possibly other verified review platforms and published there without mentioning your name. Kununu cannot relate to you personally. Please note, however, that others, e.g. your employer, may be able to identify you based on the information you have provided in the published feedback.

4.5 Who will your data be passed on to?

Your data will mainly be processed by our human resources department. In some cases, however, other internal and external bodies are also involved in the processing of your data.

Internal positions can be departments or departments in our company.

We use New Work SE as an external service provider. New Work SE, Dammtorstraße 30, 20354 Hamburg (hereinafter “Prescreen”) operates the e-recruiting system Prescreen under the domain * .jobbase.io (hereinafter “jobbase.io”), on which the company places job advertisements and receives applications and manage.

In the context of these activities, Prescreen only processes personal data on behalf of and for the purposes of shopping24 and is therefore a so-called processor within the meaning of Art. 4 No. 8 GDPR.

Jobbase.io is the central platform for our applicant management. When you use our online form, your personal data is recorded directly in jobbase.io. Your data can also be transferred to the e-recruiting system in the case of a post or e-mail application.

4.6 How long will your data be stored?

4.6.1. We store your personal data for as long as this is necessary to make a decision about your application. If an employment relationship does not come about between you and us, we can also continue to store data insofar as this is necessary to defend against possible legal claims. Your data will be regularly deleted within [six] months after the end of the application process.

4.6.2. If there is no employment relationship, but you have given us your consent to the further storage of your data ("applicant pool"), we will store your data until you withdraw your consent, but for a further [three] years at the most. If there is a specific reason, we can also store your data for a longer period of time for the purpose of defending against possible legal claims.

4.6.3. If you withdraw your application before the end of the application process, i.e. delete your data and your account, the stored data will be blocked for the period of the ongoing application process and will be permanently deleted after [six] months after the end of the application process.

4.6.4. If you no longer use your candidate profile and have not given your consent to longer data storage in the applicant pool, the data will be deleted within [six] months of the end of the application process.

4.6.5. You yourself can delete your candidate profile and your application documents at any time, request deletion or have processing restricted.

4.7 What rights do you have in connection with the processing of your data?

4.7.1. You can request information about whether we have stored personal data about you. If you wish, we will tell you what data it is, for what purposes the data is processed, to whom this data will be disclosed, how long the data will be stored and what other rights you have with regard to this data.

4.7.2. You also have the right to have your data corrected or deleted. You can also request that we provide all personal data that you have provided to us in a structured, common and machine-readable format either to you or to a person or company of your choice.

4.7.3. You also have the right not to be subject to a decision based solely on automated processing - including profiling - which has legal effect on you. As part of the application process, we do not use exclusively automated processing processes for decision-making.

4.7.4. You also have the right, for reasons that arise from your particular situation, to object at any time to the processing of personal data relating to you, which is based on Art. 6 Paragraph 1 lit. e GDPR (data processing in the public interest) or on the basis of Art. 6 Paragraph 1 lit. In the event of your objection, we will no longer process your personal data unless we can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

4.7.5. In addition, there is a right of appeal to the responsible data protection supervisory authority.

4.7.6. To exercise your rights, you can send an email to datenschutz@s24.com. We will process your inquiries immediately and in accordance with the legal requirements and inform you which measures we have taken or will take.

4.8 Is there an obligation to provide your personal data?

The provision of personal data is not required by law or contract, nor are you obliged to provide the personal data. However, the provision of personal data is required to carry out the application process. This means that if you do not provide us with any personal data when you apply, we will not be able to carry out the application process.

4.9 What if you interrupt your online application?

You can interrupt the creation of your online application at any time and continue at a later point in time. For this purpose, technically necessary cookies are used on the platform. During the application process, data is transferred to jobbase.io. This means that the data you provide to create the user account and uploaded documents are recorded in jobbase.io. The data remains recorded even if you interrupt and / or not complete an application. In this case, your application will be marked as incomplete and the data will remain partially visible to our company.

You can view, edit or update the data you provided in the online application in your candidate profile at any time.

If you do not make any further changes in your candidate profile, for example complete an ongoing application, start a new application or change the data of an existing application, your data will be deleted within [six] months after the end of the last active application process.

You can request deletion of your candidate profile and your application documents yourself at any time. After the request for deletion has been made, you will be informed of the exact deletion date and your data will be automatically deleted according to the conditions set out in this data protection guideline.

5 Data protection information for partners

5.1 Salesforce

We use the CRM system of the provider salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, in order to be able to process inquiries from our partners faster and more efficiently (legitimate interest according to Art. 6 Para. 1 lit. f. GDPR). We have concluded a data processing contract with Salesforce in accordance with the requirements of the GDPR. salesforce has submitted to the EU-US Privacy Shield.

Users can find further information in the salesforce data protection declaration: https://www.salesforce.com/de/company/privacy/.

6 Recipients outside the EU

With the exception of the processing operations described above, we do not share your data with recipients based outside the European Union or the European Economic Area. The processing operations outlined in [xxx] mean that we transmit data to the servers of the providers of tracking or targeting technologies commissioned by us. These servers are located in the USA. Data transmission is based on ‘standard contractual clauses’ of the EU Commission.

7 Your rights

7.1 Overview

In addition to the right to withdraw your consent, which you have given to us, you are entitled to the following additional rights if the respective legal conditions have been met:

• the right of access to your personal data stored by us (Article 15 of the GDPR), in particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom the data has been or is being disclosed, the intended storage period, the origin of your data if it was not collected directly from you;
• the right to rectify inaccurate data or to complete correct data (Article 16 of the GDPR);
• the right to erase your data which is stored by us (Article 17 of the GDPR), provided that we are not obliged to comply with any legal or contractual retention periods or other legal obligations or rights for further storage;
• the right to restrict processing of your date (Article 18 of the GDPR), if the accuracy of the data is disputed by you or processing is unlawful, but you have objected to such data being erased and the controller no longer requires the data, but you require it to establish, exercise or defend legal claims, or you have objected to processing pursuant to Article 21 of the GDPR;
• the right to data portability in accordance with Article 20 of the GDPR, i.e. the right to have selected data concerning you that is stored by us transmitted in a commonly used, machine-readable format, or to request that it is transmitted to another controller; and
• the right to lodge a complaint with a supervisory authority. You can generally contact the supervisory authority where you have your usual place of residence or place of work or where our company headquarters are based.

You can assert the aforementioned rights to which you are entitled at datenschutz‚24.com. You can assert your right to data portability at info@s24.com.

7.2 Right to object

Under the conditions of Article 21 (1) of the GDPR, data processing may be objected to on grounds relating to the data subject's particular situation.

The aforementioned general right of objection applies to all processing purposes described in this data protection notice, which are processed on the basis of Article 6 (1) (f) of the GDPR. In contrast to the right to object especially designed for data processing for advertising purposes (see above 3.3), we are only obliged to act on such a general right to object under the GDPR if you specify grounds of overriding importance (e.g. potential danger to life or health).

7.3 Right of withdrawal

If we process data on the basis of consent given by you, you have the right to withdraw consent given at any time. The withdrawal of the consent does not make data processing previously carried out on the basis of consent up to the time of withdrawal invalid.