Privacy Policy of the
Otto Group Solution Provider (OSP) GmbH


Updated: 25/05/2018


As of 25 May 2018, the uniform requirements of the EU General Data Protection Regulation (GDPR) apply throughout Europe in the area of data protection. The Privacy Policy provides information regarding the processing of personal data by the Otto Group Solution Provider (OSP) GmbH, (“OSP“ and/or “we” and/or “controller") in accordance with the GDPR and the German Federal Data Protection Act (FDPA 2018).

Please read our Privacy Policy carefully. If you have any questions or comments regarding our Privacy Policy, please contact us at cornelia.sasse@ottogroup.com.

 

1. Controller’s name and contact details

This Privacy Policy applies to data processing by

Otto Group Solution Provider (OSP) GmbH
Freiberger Straße 35
01067 Dresden
Deutschland

Represented by the directors Dr. Stefan Borsutzky, Norbert Gödicke and Jens Gruhl

Tel.: +49 (0)351 4923 0
Email: info@osp.de
Website: www.osp.de

for the following website: www.osp.de

 

2. Data protection officer's contact details

The controller’s operational data protection officer can be reached at

Otto Group
Werner-Otto-Str. 1-7
22179 Hamburg
Deutschland

Email: cornelia.sasse@ottogroup.com

 

3. Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party as well as categories of recipients

3.1 Accessing our websites

3.1.1 Log files

Every time you access www.osp.de, information is sent to the server of our website by the internet browser of your respective device and temporarily stored in log files. The records stored contain the following data, which are stored until automatic deletion: Date and time of retrieval, name of the page requested, IP address of the requesting device, referrer URL (origin URL from which you came to our web pages), the amount of data transferred, load time as well as product and version information of the respectively used browser and the name of your access provider.

The legal basis for processing the IP address is Art. 6 (1) lit f) GDPR. Our legitimate interest lies in

  • guaranteeing a trouble-free connection
  • guaranteeing comfortable use of our website,
  • evaluation of system security and stability.


It is not possible to directly infer your identity on the basis of the information, nor do we endeavour to do so.

The data is stored and automatically deleted after the accomplishing the aforementioned purposes. The standard deletion periods are determined according to necessity.

3.1.2 Cookies, tracking

We use cookies, tracking tools and targeting procedures for our website. The exact procedures and how your data is used for this purpose is explained in detail below.

3.2 Data processing for advertising purposes

3.2.1 Newsletter

On our website, we give you the option to subscribe to our newsletter. To ensure that no errors have occurred when entering an email address, we use the double-opt-in procedure (DOI procedure): After you have entered your email address in the registration field, we will send you a confirmation link to the address provided. Your email address will be only entered in our newsletter mailing list after you click on this confirmation link. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR.

Information on the right of revocation
You can revoke your consent at any time with effect for the future by sending a mail to info@osp.de or by using the unsubscribe option at the end of each newsletter.

3.3    Website and website optimisation

3.3.1    Cookies - general Information

We use cookies on various pages to make the visit to our website attractive, to enable the use of certain functions and to statistically record the use of our website. Cookies are small text files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not harm your device and do not contain viruses, Trojans or other malicious software. Information arising in connection with the specific device used is stored in the cookie. However, this does not mean that we immediately become aware of your identity.

Most of the cookies we use are deleted after the end of the browser session (session cookies). Other cookies remain on your computer and allow us to recognise your computer the next time you visit (persistent or multi-session cookies). In particular, these cookies serve to make our offering more user-friendly, more effective and more secure.

You can of course set your browser so that it does not save our cookies on your hard disk. The Help menu on the menu bar of most web browsers tells you how to prevent your browser from accepting new cookies, how to make your browser inform you when you receive a new cookie, or how to delete all cookies you have already received and how you can block all others.

Please proceed as follows:

In Internet Explorer

  1. In the “Tools” menu, select “Internet Options”.
  2. Click on the “Privacy” tab.
  3. Now you can configure the security settings for the internet zone. Here you can set whether and which cookies should be accepted or rejected.
  4. Confirm your settings by clicking “OK”.


In Firefox:

  1. Click on the triple bar icon in the top right of the browser and select Preferences.
  2. Click on “Privacy and Security”
  3. In the drop-down menu, select “Use custom settings for history”.
  4. Now you can set whether to accept cookies, how long you want to keep these cookies and add exceptions to which sites you always or never want to allow the use of cookies.
  5. Confirm your settings by clicking “OK”.


In Google Chrome:

  1. Click on the Chrome menu icon in the toolbar.
  2. Then select “Settings”
  3. At the bottom, click “Advanced”.
  4. Under “Privacy and security,” click "Content settings".
  5. Under “Cookies”, you can make the following settings for cookies
    • Delete cookies (See all cookies and site data -> Remove)
    • Block cookies by default
    • Delete cookies and webpage data by default after quitting the browser,
    • Allow exceptions to cookies from certain websites or domains


However, we would like to point out that you may not be able to fully utilise all the functions of this website in this case.

If these cookies and/or information contained therein are personal data, the legal basis for data processing is Art. 6 (1) lit. f) GDPR. Our interest in optimising our website is considered to be justified within the meaning of the aforementioned provision. 

3.3.2 Google Analytics

For the purpose of the needs-oriented design and continuous optimisation of our pages, we use Google Analytics, a web analysis service of Google Inc. (“Google“), based on Art. 6 (1) (f) of the GDPR. Google Analytics uses “cookies”, text files which are stored on your computer and which allow an analysis of the use of your website usage. In this context, pseudonymised usage profiles are created and cookies are used. The cookie generates information about your use of this website, such as

  • browser type/version,
  • operating system used,
  • referrer URL (the previously visited page),
  • host name of the accessing computer (IP address),
  • time of server request


On behalf of the operators of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities and to provide further services for the website operator in connection with the use of the website and the Internet. The IP address provided by your browser as part of Google Analytics will not be merged with other Google data. You can prevent cookies from being saved by configuring your browser software accordingly; however, we would like to point out that in this case you may not be able to fully utilise all the functions of this website. In addition, you may prevent Google from tracking the data generated by the cookie and your use of the website (including your IP address), as well as the processing of this data by Google, by clicking on the link below and downloading and installing the available browser plug-in. https://tools.google.com/dlpage/gaoptout?hl=en

As an alternative to the browser add-on, especially for browsers on mobile devices, you can prevent the collection by Google Analytics by clicking on this link. An opt-out cookie is set that prevents the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again. For more information about privacy in relation to Google Analytics, see the Google Analytics website.

For the sake of transparency, we would like to point out that we use the Google Tag Manager. This Manager does not collect personal information. The Tag Manager makes it easier for us to integrate and manage our tags. Tags are small pieces of code used, among other things, to measure traffic and visitor behaviour, track the effectiveness of online advertising and social media channels, and test and optimise websites. For more information on Google Tag Manager see: https://www.google.com/analytics/tag-manager/use-policy/.

3.3.3 Google reCAPTCHA

On our website, we use the reCaptcha service of Google Inc. ("Google"), 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, to protect us against spam and misuse. This service is used to distinguish whether input was made by a human or in an abusive manner by automated machine processing.

To determine this, when you use the reCaptcha service Google sets a cookie in your browser and collects and processes the following data:

  • Referrer URL (address of the page on which the CAPTCHA is used)
  • Browser, browser size and resolution, browser plug-ins, date, language setting
  • Mouse or touch events within the reCaptcha box
  • Assignment to a Google Account (if you are currently logged in to Google when using the reCaptcha service, this will be detected and assigned)


Your input behaviour (such as answering the reCAPTCHA question, input speed in the form fields, order of selection of input fields by the user) is processed to improve pattern recognition by Google.    

Furthermore, Google reads the cookies from other Google services such as Gmail, Search and Analytics. All listed data will be sent to Google in encrypted form. Google's subsequent evaluation decides on the form in which the CAPTCHA is displayed on the page - in the form of a checkbox or text input. Personal data is not read or stored from the input fields of the respective form. For more information about Google's privacy policy, visit https://policies.google.com/privacy?hl=en.

3.3.4 Targeting

The tracking measures listed below and used by us are implemented based on Art. 6 (1) lit. f) GDPR. The targeting measures are used by us to ensure that only advertisements based on your actual or presumed interests appear on your devices and that we do not bother you with advertising that is not interesting to you.

3.3.4.1 Advertising partners/Third-party cookies

We work with advertising partners to make our website even more attractive for you. To this end, cookies are set by our advertising partners when you visit our site (third-party cookies). Our advertising partners’ cookies also store information about your user behaviour and your interests when visiting our site using pseudonyms. Information is also partly recorded that results on other sites before the visit to our site. This information is used to show you advertisements from our advertising partners that are based on your interests. No personal data is stored and no user profiles are merged with personal data concerning you.

You can prevent our advertising partners’ interest-based advertising by configuring the cookie settings in your browser accordingly (see also 3.3.1).

3.3.4.2 Google Adwords

Our website uses the Google Adwords service. Google Adwords is an online advertising program provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google").

You may disable Google’s use of cookies by following the link below and downloading and installing the plug-in provided there: https://support.google.com/ads/answer/7395996?hl=en.

For more information about Google Ads and Google's Privacy Policy, please visit: https://policies.google.com/technologies/ads?hl=en.

3.3.4.3 Revocation/option to opt-out

In addition to the deactivation methods described above, you can generally prevent the described targeting technologies by configuring the cookie settings in your browser accordingly (see also 3.3.1). In addition, you have the option of deactivating preference-based advertising with the aid of the preference manager available here.

3.4 Contact

You have the option to contact us in several ways: via email, over the phone or by post. When you contact us, we will use the personal information you voluntarily provide to us for the sole purpose of contacting you and processing your request.

The legal basis for this data processing is Art. 6 (1) lit. a), Art. 6 (1) lit. b), Art. 6 (1) lit. c) and Art. 6 (1) lit. f) GDPR.


4. Recipients outside the EU

With the exception of the above processing, we do not share your information with recipients located outside the European Union or the European Economic Area. The processing operations mentioned under 3.3 entail a data transfer to the servers of the providers of tracking or targeting technologies commissioned by us. These servers are located in the USA. Data is transferred on the basis of the EU Commission’s standard contractual clauses as well as in accordance with the principles of the Privacy Shield.

 

5. Your rights     

5.1. Overview

In addition to the right to revoke your consent granted to us, you are entitled to the following further rights if the relevant legal requirements apply:

  • the right to obtain information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data was or is being disclosed, the planned storage period and the origin of your data, if it was not collected directly from you;
  • the right to rectify incorrect data or to complete correct data (Art. 16 GDPR),
  • the right to deletion of your data stored by us (Art. 17 GDPR), provided that we are not required to observe any statutory or contractual retention periods or other statutory obligations or rights concerning further storage,    
  • the right to demand the restriction of the processing of your personal data (Art. 18 GDPR), provided that the accuracy of the data is disputed by you, the processing is unlawful, you however refuse its deletion and the controller no longer needs the data, you however need the data to assert, exercise or defend legal claims or you have objected to processing pursuant to Art. 21 GDPR,
  • the right to data portability pursuant to Art. 20 GDPR, i.e. the right to transfer selected data stored by us in a common, machine-readable format, or to request transmission to another controller
  • the right to complain to a supervisory authority. You can generally contact the supervisory authority of your usual domicile, place of work or our head office.


You can assert the aforementioned rights that you have regarding us under info@osp.de. You can assert the right to data portability under info@osp.de.

5.2 Right to object

Under the requirements of Art. 21 (1) GDPR, data processing can be objected to for reasons arising from the data subject's particular situation.

The above general right of objection applies to all processing purposes described in this Privacy Policy that are processed on the basis of Art. 6 (1) lit. f) GDPR. Unlike the special right of objection to data processing for advertising purposes (see above 3.2), under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance (such as a possible danger to life or health).

5.3 Right of revocation

If we process data on the basis of your consent, you have the right to revoke your consent at any time. The revocation of consent does not mean that the data processing carried out on the basis of the consent until the time of revocation becomes ineffective.