Privacy Policy of the
Otto Group Solution Provider (OSP) GmbH

Updated: 19/05/2020

As of 25 May 2018, the uniform requirements of the EU General Data Protection Regulation (GDPR) apply throughout Europe in the area of data protection. The Privacy Policy provides information regarding the processing of personal data by the Otto Group Solution Provider (OSP) GmbH, (“OSP“ and/or “we” and/or “controller") in accordance with the GDPR and the German Federal Data Protection Act (FDPA 2018).

Please read our Privacy Policy carefully. If you have any questions or comments regarding our Privacy Policy, please contact us at


1. Controller’s name and contact details

This Privacy Policy applies to data processing by

Otto Group Solution Provider (OSP) GmbH
Freiberger Straße 35
01067 Dresden

Represented by the directors Dr. Stefan Borsutzky, Norbert Gödicke and Jens Gruhl

Tel.: +49 (0)351 4923 0

for the following website:


2. Data protection officer's contact details

The controller’s operational data protection officer can be reached at

Otto Group
Werner-Otto-Str. 1-7
22179 Hamburg



3. Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party as well as categories of recipients

3.1 Accessing our websites

3.1.1 Log files

Every time you access, information is sent to the server of our website by the internet browser of your respective device and temporarily stored in log files. The records stored contain the following data, which are stored until automatic deletion: Date and time of retrieval, name of the page requested, IP address of the requesting device, referrer URL (origin URL from which you came to our web pages), the amount of data transferred, load time as well as product and version information of the respectively used browser and the name of your access provider.

The legal basis for processing the IP address is Art. 6 (1) lit f) GDPR. Our legitimate interest lies in

  • guaranteeing a trouble-free connection
  • guaranteeing comfortable use of our website,
  • evaluation of system security and stability.

It is not possible to directly infer your identity on the basis of the information, nor do we endeavour to do so.

The data is stored and automatically deleted after the accomplishing the aforementioned purposes. The standard deletion periods are determined according to necessity.

3.1.2 Cookies, tracking

We use cookies, tracking tools and targeting procedures for our website. The exact procedures and how your data is used for this purpose is explained in detail below.

3.2 Data processing for advertising purposes

3.2.1 Newsletter

On our website, we give you the option to subscribe to our newsletter. To ensure that no errors have occurred when entering an email address, we use the double-opt-in procedure (DOI procedure): After you have entered your email address in the registration field, we will send you a confirmation link to the address provided. Your email address will be only entered in our newsletter mailing list after you click on this confirmation link. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR.

Information on the right of revocation
You can revoke your consent at any time with effect for the future by sending a mail to or by using the unsubscribe option at the end of each newsletter.

3.2.2 Sweepstakes

If you register for a lottery organised by us, we will use the data you provide at the time of registration for the purpose of concluding the participation contract, in particular to notify you of your winnings and, if applicable, to advertise our offers and services. Detailed information can be found in the conditions of participation for the respective lottery. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR, Art. 6 (1) lit. b) GDPR and Art. 6 (1) lit. f) GDPR.

4.    Website and website optimisation

4.1    Cookies - general Information

We use cookies on various pages to make the visit to our website attractive, to enable the use of certain functions and to statistically record the use of our website. Cookies are small text files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not harm your device and do not contain viruses, Trojans or other malicious software. Information arising in connection with the specific device used is stored in the cookie. However, this does not mean that we immediately become aware of your identity.

Most of the cookies we use are deleted after the end of the browser session (session cookies). Other cookies remain on your computer and allow us to recognise your computer the next time you visit (persistent or multi-session cookies). In particular, these cookies serve to make our offering more user-friendly, more effective and more secure.

You can adjust your personal settings at any time using the cookie settings: Cookie-Einstellungen

You can of course set your browser so that it does not save our cookies on your hard disk. The Help menu on the menu bar of most web browsers tells you how to prevent your browser from accepting new cookies, how to make your browser inform you when you receive a new cookie, or how to delete all cookies you have already received and how you can block all others.

Please proceed as follows: 

In Internet Explorer

  1. In the “Tools” menu, select “Internet Options”.
  2. Click on the “Privacy” tab.
  3. Now you can configure the security settings for the internet zone. Here you can set whether and which cookies should be accepted or rejected.
  4. Confirm your settings by clicking “OK”.

In Firefox:

  1. Click on the triple bar icon in the top right of the browser and select Preferences.
  2. Click on “Privacy and Security”
  3. In the drop-down menu, select “Use custom settings for history”.
  4. Now you can set whether to accept cookies, how long you want to keep these cookies and add exceptions to which sites you always or never want to allow the use of cookies.
  5. Confirm your settings by clicking “OK”.

In Google Chrome:

  1. Click on the Chrome menu icon in the toolbar.
  2. Then select “Settings”
  3. At the bottom, click “Advanced”.
  4. Under “Privacy and security,” click "Content settings".
  5. Under “Cookies”, you can make the following settings for cookies
    • Delete cookies (See all cookies and site data -> Remove)
    • Block cookies by default
    • Delete cookies and webpage data by default after quitting the browser,
    • Allow exceptions to cookies from certain websites or domains

In Safari:

  1. Click on "Safari" in the menu bar.
  2. Now select "Preferences".

  3. Click on "Privacy".
  4. Here you can set the following preferences for cookies:
    • Delete Cookies
    • Block cookies and website data by default
    • Change which cookies and website data are allowed

However, we would like to point out that you may not be able to fully utilise all the functions of this website in this case.

On the one hand, we use cookies on the basis of Art. 6 (1) lit. f) GDPR (legitimate interest in the optimisation of our offers). Certain cookies are used exclusively on the basis of your consent (Art. 6 (1) lit. a) GDPR). You will find the relevant legal basis in the information on the respective service


4.2 Consent

As already stated in section 4.1 of this privacy policy, we collect and process data collected in connection with the use of cookies, in some cases on the basis of consent. You grant this consent by clicking on the "OK" button in a banner on this website that links to these consent texts or by accepting the Targeting Cookies in the Cookie Settings. The data collection and data processing, which are based on consent given as described above, as well as the right of revocation with regard to the given consent are described in the following.


4.2.1 Consent to Google Ads / Remarketing

Our website uses the Google Ads service. Google Ads is an online advertising program provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google"). In this regard, we use the remarketing feature provided as part of the Google Ads service. The remarketing feature allows us to present ads based on your interests on other sites within the Google advertising network. In order to do this, we analyse your browsing behaviour on our website, e.g. which services you have viewed. This enables us to show you customised advertising on the online search engine Google itself, so-called "Google Ads", and on other websites even after your visit to our website. For this purpose, Google stores a cookie on your browser whenever you visit Google services or websites in the Google advertising network. This cookie is used to record your visits. The cookie is used to uniquely identify your web browser, not to identify you personally. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).

You can deactivate the use of cookies by Google and thus revoke the consent you have given us for the use of the Google Ads / Google Remarketing service by following the link below and downloading and installing the plug-in provided there:

For more information about Google Remarketing and Google's privacy policy, please visit:

4.2.2 Consent for Facebook Retargeting (Website Custom Audience)

A pixel of Facebook Ireland Limited is integrated in this website (Website Custom Audience pixel). Facebook Ireland Limited uses this pixel to collect information about the use of this website (e.g. information about accessed pages). This information can be attributed to you with the aid of other information that Facebook Ireland Limited has stored about you, for example because you have an account on the social network Facebook. The information collected by the pixel can be used to display interest-related ads about our offers in your Facebook account (retargeting). The information collected by the pixel can also be aggregated by Facebook Ireland Limited and the aggregated information can be used by Facebook Ireland Limited for its own and for third-party advertising purposes. Thus, for example, Facebook Ireland Limited may infer certain interests from your browsing behaviour on this website and may also use this information to promote third-party offers. Facebook Ireland Limited may also combine the information collected by the pixel with other information that Facebook Ireland Limited has collected about you via other websites and/or in connection with the use of the social network Facebook, so that a profile about you may be stored at Facebook Ireland Limited. This profile may be used for advertising purposes. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).
 Facebook Ireland Limited is solely responsible for the permanent storage and displayed further processing of tracking data collected via the website custom audience pixel used on this website.

For more information on data protection at Facebook Ireland Limited, please click here:
Here you will also find the possibility of asserting your rights (e.g. right to deletion) against Facebook Ireland Limited.

You can withdraw your consent to the transfer to Facebook Ireland Limited by using the pixel on this website here.

4.2.3 Consent to LinkedIn Ads / Retargeting

We use the retargeting service and conversion tracking of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn").

For this purpose, our website includes the LinkedIn Insight Tag, which enables LinkedIn to collect statistical, pseudonymous information about your visit and use of our website and to provide us with aggregated statistics based on this information. As a rule, the following information is collected:

  • LinkedIn User ID (Cookie ID)
  • IP Address
  • Metadata of website visit, e.g. browser type, website visited

In addition, this information is used to provide you with offers and recommendations that are specific to your interests and relevant after you have informed yourself about certain services, information and offers on the website. This information is stored in a cookie.

You may opt out of LinkedIn's analysis of your usage patterns and the display of interest-based recommendations here:

You can find more information about LinkedIn's privacy practices in the LinkedIn Privacy Policy here:

4.2.4 Revocation of all consents
You can revoke your consent, which you have given for the data processing (point 4.2.1 to point 4.2.3) described above, in full here.

4.3 Google Analytics

For the purpose of the needs-oriented design and continuous optimisation of our pages, we use Google Analytics, a web analysis service of Google Inc. (“Google“), based on Art. 6 (1) (f) of the GDPR. Google Analytics uses “cookies”, text files which are stored on your computer and which allow an analysis of the use of your website usage. In this context, pseudonymised usage profiles are created and cookies are used. The cookie generates information about your use of this website, such as

  • browser type/version,
  • operating system used,
  • referrer URL (the previously visited page),
  • host name of the accessing computer (IP address),
  • time of server request

On behalf of the operators of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities and to provide further services for the website operator in connection with the use of the website and the Internet. The IP address provided by your browser as part of Google Analytics will not be merged with other Google data. You can prevent cookies from being saved by configuring your browser software accordingly; however, we would like to point out that in this case you may not be able to fully utilise all the functions of this website. In addition, you may prevent Google from tracking the data generated by the cookie and your use of the website (including your IP address), as well as the processing of this data by Google, by clicking on the link below and downloading and installing the available browser plug-in.

As an alternative to the browser add-on, especially for browsers on mobile devices, you can prevent the collection by Google Analytics by setting the Performance Cookies in the Cookie Settings to inactive.

Cookie Settings

An opt-out cookie is set that prevents the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again. For more information about privacy in relation to Google Analytics, see the Google Analytics website. For the sake of transparency, we would like to point out that we use the Google Tag Manager. This Manager does not collect personal information. The Tag Manager makes it easier for us to integrate and manage our tags. Tags are small pieces of code used, among other things, to measure traffic and visitor behaviour, track the effectiveness of online advertising and social media channels, and test and optimise websites. For more information on Google Tag Manager see:

4.4 Google Conversion Tracking

We also use so-called conversion tracking when using the Google Ads service. A conversion tracking cookie will be installed on your computer/device when you click on an ad placed by Google. These cookies expire after 30 days, do no contain any personal data and thus cannot be used for personal identification purposes. The information gathered using the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking.
The legal basis for this data processing is Art. 6 (1) lit. f) GDPR (legitimate interest).
You can prevent cookies from being saved by configuring your browser software accordingly; however, we would like to point out that in this case you may not be able to use the full functionality of this website. In addition, you can deactivate interest-based ads on Google and interest-based Google ads on the web (within the Google display network) in your browser by activating the "Off" button at or by deactivating them at For more information about your options in this regard and Google's privacy policy, please visit:

4.5 Google reCAPTCHA

On our website, we use the reCaptcha service of Google Inc. ("Google"), 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, to protect us against spam and misuse. This service is used to distinguish whether input was made by a human or in an abusive manner by automated machine processing.

To determine this, when you use the reCaptcha service Google sets a cookie in your browser and collects and processes the following data:

  • Referrer URL (address of the page on which the CAPTCHA is used)
  • Browser, browser size and resolution, browser plug-ins, date, language setting
  • Mouse or touch events within the reCaptcha box
  • Assignment to a Google Account (if you are currently logged in to Google when using the reCaptcha service, this will be detected and assigned)

Your input behaviour (such as answering the reCAPTCHA question, input speed in the form fields, order of selection of input fields by the user) is processed to improve pattern recognition by Google.    

Furthermore, Google reads the cookies from other Google services such as Gmail, Search and Analytics. All listed data will be sent to Google in encrypted form. Google's subsequent evaluation decides on the form in which the CAPTCHA is displayed on the page - in the form of a checkbox or text input. Personal data is not read or stored from the input fields of the respective form. For more information about Google's privacy policy, visit

4.6 Targeting

The tracking measures listed below and used by us are implemented based on Art. 6 (1) lit. f) GDPR. The targeting measures are used by us to ensure that only advertisements based on your actual or presumed interests appear on your devices and that we do not bother you with advertising that is not interesting to you.

4.6.1 Re-targeting

We also use re-targeting technologies from external service providers. This enables us to make our online offering more interesting and tailored to your needs. This enables us to target those users with online advertising on our partners' websites who are already interested in our services and our products. We know from studies that the insertion of personalized, interest-related advertising is more interesting for the Internet user than advertising that has no such personal reference.

For this purpose, a cookie is set with which interest data is collected using pseudonyms. This information is used to display interest-related advertisements about our offers on the websites of our partners. No directly personal data is stored and no user profiles are combined with personal data on you. The cookie is stored for a period of 120 days and then automatically deleted.

You have the option of deactivating the collection of data for the purpose of personalised advertising by setting the Tracking Cookies in the Cookie Settings to inactive.

Cookie Settings

A cookie is then set, which permanently prevents the collection of data, unless you delete this cookie in your browser specifically or via the function "Delete all cookies". You can repeat your objection at any time.

4.6.2 Advertising partners/Third-party cookies

We work with advertising partners to make our website even more attractive for you. To this end, cookies are set by our advertising partners when you visit our site (third-party cookies). Our advertising partners’ cookies also store information about your user behaviour and your interests when visiting our site using pseudonyms. Information is also partly recorded that results on other sites before the visit to our site. This information is used to show you advertisements from our advertising partners that are based on your interests. No personal data is stored and no user profiles are merged with personal data concerning you.

You can prevent our advertising partners’ interest-based advertising by configuring the cookie settings in your browser accordingly (see also 4.1).

4.6.3 Revocation/option to opt-out

In addition to the deactivation methods described above, you can generally prevent the described targeting technologies by configuring the cookie settings in your browser accordingly (see also 4.1). 

In addition, you have the option of deactivating preference-based advertising with the aid of the preference manager available here or adjusting your settings via the Cookie Settings for this website.

Cookie Settings

4.7 Social Media Plug-Ins

On our website, we use Social Plug-ins of the social network YouTube on the basis of Art. 6 (1) lit. f) GDPR in order to make our company better known about this. The advertising purpose behind this is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for the data protection-compliant operation is to be guaranteed by their provider.

The purpose and scope of the data collection and the further processing and use of the data by the provider as well as your related rights and setting options for the protection of your privacy can be found in the data protection information of the provider, which is linked below.

By previously logging out from the pages of social networks and deleting cookies, you can prevent social networks from assigning the information collected about you to your user account at the respective social network during your visit to If you do not want social networks to associate the information collected through our website directly with your profile, you must log out of those social networks before visiting our website. You can also completely prevent the loading of plugins with add-ons for your browser, e.g. with the script blocker "NoScript", which can be found at:

4.7.1 YouTube

This website uses the provider YouTube LLC , 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google")) for the integration of videos.

Normally, when you visit a page with embedded videos, your IP address is sent to YouTube and cookies are installed on your computer. However, we have integrated our YouTube videos with the enhanced data protection mode (in this case, YouTube still contacts Google's Double Click service, but according to Google's privacy policy, personal data is not evaluated). As a result, YouTube no longer stores information about visitors unless they watch the video. If you click on the video, your IP address will be transmitted to YouTube and YouTube will know that you viewed the video. If you are logged in to YouTube, this information is also associated with your user account (you can prevent this by logging out of YouTube before viewing the video). OSP has no knowledge of or influence over the collection and use of your data by YouTube.

Google provides detailed information on the scope, type, purpose and further processing of your data on its website. Here you will also find further information on your rights and setting options to protect your privacy.

Data protection references of Google:

5. Contact

You have the option to contact us in several ways: via email, via contact form, over the phone, by post or per WhatsApp. When you contact us, we will use the personal information you voluntarily provide to us for the sole purpose of contacting you and processing your request.

The legal basis for this data processing is Art. 6 (1) lit. a), Art. 6 (1) lit. b), Art. 6 (1) lit. c) and Art. 6 (1) lit. f) GDPR.

6. Recipients outside the EU

With the exception of the above processing, we do not share your information with recipients located outside the European Union or the European Economic Area. The processing operations mentioned under 4. entail a data transfer to the servers of the providers of tracking or targeting technologies commissioned by us. These servers are located in the USA. Data is transferred on the basis of the EU Commission’s standard contractual clauses as well as in accordance with the principles of the Privacy Shield.


7. Your rights     

7.1. Overview

In addition to the right to revoke your consent granted to us, you are entitled to the following further rights if the relevant legal requirements apply:

  • the right to obtain information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data was or is being disclosed, the planned storage period and the origin of your data, if it was not collected directly from you;
  • the right to rectify incorrect data or to complete correct data (Art. 16 GDPR),
  • the right to deletion of your data stored by us (Art. 17 GDPR), provided that we are not required to observe any statutory or contractual retention periods or other statutory obligations or rights concerning further storage,    
  • the right to demand the restriction of the processing of your personal data (Art. 18 GDPR), provided that the accuracy of the data is disputed by you, the processing is unlawful, you however refuse its deletion and the controller no longer needs the data, you however need the data to assert, exercise or defend legal claims or you have objected to processing pursuant to Art. 21 GDPR,
  • the right to data portability pursuant to Art. 20 GDPR, i.e. the right to transfer selected data stored by us in a common, machine-readable format, or to request transmission to another controller
  • the right to complain to a supervisory authority. You can generally contact the supervisory authority of your usual domicile, place of work or our head office.

You can assert the aforementioned rights that you have regarding us under or via our contact form. You can assert the right to data portability under or via our contact form.

7.2 Right to object

Under the requirements of Art. 21 (1) GDPR, data processing can be objected to for reasons arising from the data subject's particular situation.

The above general right of objection applies to all processing purposes described in this Privacy Policy that are processed on the basis of Art. 6 (1) lit. f) GDPR. Unlike the special right of objection to data processing for advertising purposes (see above 3.2), under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance (such as a possible danger to life or health).

7.3 Right of revocation

If we process data on the basis of your consent, you have the right to revoke your consent at any time. The revocation of consent does not mean that the data processing carried out on the basis of the consent until the time of revocation becomes ineffective.