Data protection information of the BAUR Group

This data protection information applies to data processing by

BAUR Versand (GmbH & Co KG)
Bahnhofstraße 10
96224 Burgkunstadt
Germany

represented by:
Stephan P. Elsner (Chairman)
Achim Güllmann

Telephone: 09572 91-0
E-mail address: bewerbung@baur-gruppe.com

for the following website: www.jobs.baur-gruppe.com

You can contact the data protection officer of the controller at

BAUR Versand (GmbH & Co KG)
- Data Protection Officer -
Bahnhofstraße 10
96224 Burgkunstadt
Germany

Telephone: 09572-91 30 06
E-mail address: service@baur.de

Each time you access websites/applications, information is sent to the server of our website/application by the respective Internet browser of your respective end device and temporarily stored in log files. The stored data records contain the following data, which is stored until it is automatically deleted: Date and time of access, name of the page accessed, IP address of the requesting device, referrer URL (origin URL from which you came to our websites), the amount of data transferred, loading time, as well as product and version information of the browser used in each case and the name of your access provider.

The legal basis for processing the IP address is Article 6(1)(f) GDPR. Our legitimate interest arises from the

• Ensuring a smooth connection setup,
• Ensuring convenient use of our website/application,
• evaluating system security and stability.
  

It is not possible to draw any direct conclusions about your identity from the information and we will not do so.

The data is stored and automatically deleted once the aforementioned purposes have been achieved. The standard periods for deletion are based on the criterion of necessity.

If you have agreed to geolocalization in your browser, operating system or other settings on your device, we use this function to offer you individual services based on your current location. We process your location data processed in this way exclusively for this function. If you stop using this function, the data will be deleted.

Cookies are used on this website. Cookies are small text files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.). Information is stored in the cookie that results in each case in connection with the specific end device used. However, this does not mean that we gain direct knowledge of your identity. Some of the cookies we use are deleted again at the end of the browser session (so-called session cookies).

Other cookies remain on your computer and enable us to recognize your computer on your next visit (so-called persistent or cross-session cookies). These cookies in particular serve to make our website more user-friendly, effective and secure.
According to the legal requirements, the storage of information on end devices (desktops, cell phones, tablets, etc.) - e.g. by setting cookies - and the retrieval of information from end devices (tracking) is generally only permitted if you have given your prior consent. However, consent does not have to be granted if such storage/retrieval is necessary for the website's offering. A necessity is given, for example, with regard to ensuring the following functionalities / achieving the following purposes:

• Display of the shopping cart,
• Display of the wish list,
• Enabling and maintaining the log-in,
• Ensuring system security.
  

You have no right to object to the data processing that is necessary for the operation of the website.
You can use this website without data being retrieved from or stored on your device for purposes that are not necessary for the provision of this website. For this reason, only "basic tracking" is activated when you use this website - unless you give further consent.

Of course, you can set up your browser so that it does not store certain cookies on your end device. The help function in the menu bar of most web browsers explains how you can prevent your browser from accepting new cookies, how you can have your browser notify you when you have received a new cookie or how you can delete all cookies you have already received and block them for all others.
Please proceed as follows:

In Internet Explorer:
1. select "Internet Options" in the "Tools" menu
2. click on the "Privacy" tab
3. now you can make the security settings for the Internet zone. Here you can set whether and which cookies should be accepted or rejected.
4. confirm your settings with "OK".

In Firefox:
1. Select "Settings" in the "Extras" menu.
2. click on "Privacy".
3. select the entry "Create according to user-defined settings" in the drop-down menu
4. now you can set whether cookies should be accepted, how long you want to keep these cookies and add exceptions to which websites you always or never want to allow cookies to be used.
5. confirm your settings with "OK".

In Google Chrome:
1. Click on the Chrome menu in the browser toolbar.
2. now select "Settings".
3. click on "Show advanced settings"
4. click on "Content settings" under "Privacy"
5. under "Cookies" you can make the following settings for cookies
- Delete cookies
- Block cookies by default
- Delete cookies and website data by default after closing the browser
- Allow exceptions for cookies from certain websites or domains

If you want to delete individual cookies set in your browser or find out which service providers have set cookies in your browser, you can also do this via a "preference manager". This is available, for example, at www.youronlinechoices.com.

For the purpose of the needs-based design and continuous optimization of this website, further processing of data collected on the basis of consent is carried out by the basic version of Google Analytics on the legal basis of Article 6 (1) (f) GDPR (legitimate interest). The basic version of Google Analytics is a web analysis service of Google Inc ("Google"). Google Analytics uses so-called "cookies" (text files), which are stored on your computer and enable your use of the website to be analyzed. On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. Google processes the data collected through the use of the "basic version" of Google Analytics exclusively on the instructions of the operator of this website and for the purposes of the operator.
You can object to the further processing of data by Google Analytics here. As a result of your objection, Google Analytics will no longer collect data relating to the device you used to access jobs.baur-gruppe.com when you lodged your objection.

Social plugins from Facebook and Google (Google+ and YouTube) are used on this website. These are offers from the US companies Facebook and Google Inc (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google")).
When you visit a page that contains such a plugin, your browser establishes a connection to Facebook or Google and the content is loaded from these pages. Your visit to this website may therefore be tracked by Facebook and Google, even if you do not actively use the social plugin function. If you have an account with Facebook or Google, you can use such a social plugin and share information with your friends. The BAUR Group has no influence on the content of the plugins and the transmission of information.
Facebook and Google provide detailed information on the scope, type, purpose and further processing of your data on their websites. Here you will also find further information about your rights and settings options to protect your privacy.
Data protection information from Facebook: https://www.facebook.com/about/privacy
Data protection information from Google: http: //www.google.com/intl/de/policies/privacy

This website also includes plugins from the social networks LinkedIn, LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA and Xing AG, Gänsemarkt 43, 20354 Hamburg, Germany. Information on data protection can be found in the LinkedIn and Xing privacy policies, which you can find here:

• LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy
  LinkedIn has submitted to the EU-US Privacy Shield.
• Data protection notice from Xing: https://www.xing.com/privacy

A WhatsApp button (WhatsApp share button) is also used on this website. You can use this button to share content from the BAUR Group via the WhatsApp application on your cell phone. The button is a hyperlink. When the button appears on this website, no personal data is transmitted to the operator of WhatsApp or other third parties. As soon as you use the WhatsApp button, the WhatsApp operator learns what content is being shared and that the button has been used on this website. You can find more information on the handling of personal data by the operator of WhatsApp in the operator's privacy policy: https://www.whatsapp.com/legal/#Privacy.

You have the option of contacting us in several ways: By e-mail, by telephone, by post or by WhatsApp. When you contact us, we use the personal data that you voluntarily provide to us in this context solely for the purpose of contacting you and processing your request.
The legal basis for this data processing is Art. 6(1)(a), Art. 6(1)(b), Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.

In addition to the right to revoke your consent given to us, you have the following additional rights if the respective legal requirements are met

• the right to information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it has not been collected directly from you;
• the right to rectification of inaccurate data or completion of correct data (Art. 16 GDPR)
• the right to erasure of your data stored by us (Art. 17 GDPR), provided that no statutory or contractual retention periods or other statutory obligations or rights to further storage are to be complied with by us
• the right to restrict the processing of your data (Art. 18 GDPR) if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it; the controller no longer needs the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR
• the right to data portability pursuant to Art. 20 GDPR, i.e. the right to receive selected data stored by us about you in a structured, commonly used and machine-readable format or to request transmission to another controller
• the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.
  

You can assert the aforementioned rights to which you are entitled against us at bewerbung@baur-gruppe.de. You can also assert your right to data portability at bewerbung@baur-gruppe.com.

Under the conditions of Art. 21 (1) GDPR, data processing may be objected to on grounds relating to the particular situation of the data subject.
The above general right to object applies to all processing purposes described in this data protection information that are processed on the basis of Article 6 (1) (f) GDPR. In contrast to the special right to object to data processing for advertising purposes, we are only obliged under the GDPR to implement such a general objection if you give us reasons of overriding importance (e.g. a possible danger to life or health).

Insofar as we process data on the basis of your consent, you have the right to withdraw your consent at any time. The revocation of consent does not have the consequence that the data processing carried out on the basis of the consent up to the time of revocation becomes ineffective.

The security of our applicants' data is our top priority. We would like to give you some security advice below.

Beware of so-called phishing and spoofing attempts:
Unfortunately, the BAUR Group is also misused as a supposed sender in this scam. Specifically, this means that consumers receive fake e-mails in the name of the BAUR Group. These emails are often even based on the BAUR Group brand layout and may be difficult to distinguish from genuine emails from the BAUR Group.

The fraudsters want to exploit the position of trust between the BAUR Group and our applicants to steal sensitive data or install malicious software (such as viruses or Trojans) on your computer or smartphone.

These emails are not created and sent by the BAUR Group, even if our name is used as the sender. Unfortunately, the BAUR Group therefore has no influence on the sending of these unauthorized emails.

How to deal with spam, phishing and spoofing emails correctly:

• We recommend that you delete suspicious emails immediately.
• Never open links or attachments in suspicious emails and do not disclose any personal data.

In today's networked world, unauthorized attempts to access personal information are a reality that individuals and companies have to face every day. This is undoubtedly a major challenge.

As data protection is our top priority, we invest in the security of our systems and constantly monitor them.

Controller for the purposes of data protection law
Baur Versand (GmbH & Co KG)
Bahnhofstraße 10
96224 Burgkunstadt

Further information about our company, details of the authorized representatives and other contact options can be found in the legal notice on our website: www.jobs.baur-gruppe.com/impressum

The following special data protection information applies to the talent management pool. In addition, we refer to the general data protection regulations mentioned above.

Purpose of the talent pool
Our talent pool is a candidate management system that focuses on talent acquisition. The talent pool is intended to enable the BAUR Group (this applies in particular to the companies Baur Versand (GmbH & Co KG), BFS Baur Fulfillment Solutions GmbH and empiriecom GmbH & Co KG) to simplify contact with talented individuals and make them transparent for future development and exciting challenges within the company. To this end, the selected individuals are sent invitations and information on specialist and career events as well as current events in the BAUR Group via their respective profile in the talent pool and, if desired, by e-mail. Finally, you will be informed about special job offers from the BAUR Group.

Data processing in the talent management pool
In order to be able to offer candidates the benefits listed and to operate an administrative talent management system, certain personal data must be processed by the system used.

The following data provided by you will be processed

• Title, surname, first name
• Image data
• e-mail address
• Postal address
• Telephone number
• Personal data (e.g. about your education)
• Your interests
• Competencies
• (Future) salary expectations
• Attachments
• If available: Relevant projects in the BAUR Group
  

Only authorized employees of the HR department of the BAUR Group have access to the personal data stored in the talent pool. They may only use the data for the purposes specified above. If you are transferred to an application process, your data will be shared with the relevant department and will also be handled there in accordance with the data protection guidelines. The personal data will of course be treated in strict confidence.

Basis of data storage and processing
The legal basis for the processing of personal data of employees of the BAUR Group is § 26 BDSG-Neu in conjunction with the applicable company regulations; for all others, the basis is a separate consent to be given, which is obtained during the registration process based on the data protection information presented here. As soon as an application process has been initiated by the talent, the information on the application process also applies: www.jobs.baur-gruppe.com/datenschutz

Involvement of external companies for data processing
In the course of a targeted display of interesting content for you, your submitted data will be sent to our service provider Textkernel once for each update of the profile. More information about Textkernel can be found here: www.textkernel.de/datenschutzerklärung

Textkernel specializes in CV parsing and semantic matching and uses an index of your data, which is stored on a server in Germany. Of course, this data will not be made available to other external companies, but only to the BAUR Group for the period in the talent pool. When the profile is deleted, the stored index is also deleted.

Duration of data storage
We will store your data for a maximum of two years after you join the talent pool. Irrespective of this, if your personal data is stored in the talent pool, the data will be deleted in accordance with the relevant data protection principles mentioned above, with the proviso that we will request an update of your data by e-mail if you have not adjusted or used your profile for a period of twelve months. If you do not respond to this email within one month, we will remove you from the talent pool and delete your personal data.

In addition, we will contact you at the latest shortly before the end of the two years since you joined for the purpose of determining whether you remain in the talent pool system.

Updating data/withdrawal of consent/information
You can delete your data stored in the talent pool from your profile at any time without giving reasons. You can also update your data yourself by entering it manually or using the automated CV upload or link to the aforementioned business networks. If you have any problems updating or deleting your data, please contact either your personal advisor or bewerbung@baur-gruppe.com.

Your rights as a "data subject"
If you wish to assert your rights as a data subject, please send your request in writing or in text form to

Baur Versand (GmbH & Co KG)
- Personal -
Bahnhofstraße 10
96224 Burgkunstadt

or by email to bewerbung@baur-gruppe.com

• Right to information
  You have the right to information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it has not been collected directly from you. Please understand that we may require you to provide proof that you are the person you claim to be.
• Right to rectification and erasure
  You have the right to have your personal data rectified or erased at any time if the legal requirements for this are met. In the event of inaccuracies, we will correct the data stored by us immediately upon notification by you. Personal data will be deleted if legal requirements are met, for example because the data is no longer necessary for the purposes for which it was collected or otherwise processed or because this data was processed unlawfully.
  The only data that is exempt from deletion is data that we need to process outstanding tasks (e.g. to fulfill a contract) or to enforce our rights and claims, as well as data that we must continue to store due to statutory retention periods.
• Restriction of processing
  If the legal requirements pursuant to Art. 18 GDPR are met, you can request that we restrict the processing of your data. This is the case, for example, if and insofar as the accuracy of the data is disputed by you, the controller no longer needs the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR.
• Data portability
  You have the right to data portability in accordance with Art. 20 GDPR, i.e. the right to receive selected data stored by us about you in a commonly used, machine-readable format or to request that it be transferred to another controller.
• Objection to data processing
  Under the conditions of Art. 21 para. 1 GDPR, data processing can be objected to for reasons arising from the particular situation of the data subject. The above general right to object applies to all processing purposes that are processed on the basis of Article 6(1)(f) GDPR. In contrast to the specific right to object to data processing based on consent, we are only obliged under the GDPR to implement such a general objection if you provide us with reasons of overriding importance (e.g. a potential risk to life or health) and we cannot demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or which serve the establishment, exercise or defense of legal claims.
• Right to lodge a complaint
  You have the right to lodge a complaint with a data protection authority. You can contact the data protection authority responsible for your place of residence or your federal state or the data protection authority responsible for us.
• Right of withdrawal
  Insofar as we process data on the basis of your consent, you have the right to withdraw your consent at any time. The revocation of consent does not have the consequence that the data processing carried out on the basis of the consent up to the time of revocation becomes ineffective.
  

Data security
All personal data transmitted by you is transferred using the generally accepted and secure SSL (Secure Socket Layer) standard. SSL is a secure and proven standard that is also used in online banking, for example. You can recognize a secure SSL connection by the "s" appended to http (i.e. https://...) in the address bar of your browser or by the lock symbol at the bottom of your browser.

We also use suitable technical and organizational security measures to protect your personal data stored by us against manipulation, partial or complete loss and against unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

In some cases, we offer you the opportunity to be included in the Otto Group's internal Talent Pool System. The Otto Group Talent Pool System serves to identify, retain and promote talent, as well as to ensure succession by actively promoting internal mobility within the Otto Group.

If you have consented to the transfer of your data to the other Otto Group companies and have thus decided to store your data in the Otto Group Talent Pool System, we will transfer the data you provided when creating your profile to Otto (GmbH & Co KG) (hereinafter OTTO), which will store it in the Otto Group Talent Pool System. With regard to the inclusion of your person in the internal Otto Group Talent Pool System, as well as the provision of the Otto Group Talent Pool System, we are jointly responsible with Otto (GmbH & Co KG) and the other Otto Group companies that participate in the internal Otto Group Talent Pool System. We are primarily responsible for the collection, transmission and registration of your data and OTTO for the storage of your data and provision of the Otto Group Talent Pool System.

After Otto (GmbH & Co KG) has transmitted your data to the companies participating in the Otto Group Talent Pool System, the Group companies process this data as data controllers under data protection law, e.g. for the purpose of establishing contact. A potential application process then normally takes place directly via the company's processes. Data processing is based on your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time.

We and OTTO are available to you with regard to the processing under joint responsibility as central contact persons in their own area of activity. If you have any questions regarding data protection and to assert your rights as a data subject, please contact yournextmove@ottogroup.com. You can also assert your rights against us. If you contact us, we will coordinate in accordance with the agreement on joint responsibility in order to answer your request and ensure the implementation of your data subject rights.