Data Privacy Statement for ALDI Foto and MEDION (Last Revised May 2018)
ALDI Foto is delighted at your visit to this website and at your interest in the products and services of ALDI Foto and at your interest in our service partner MEDION (ALDI Foto/ MEDION). We take the protection of your personal data very seriously and want you to feel secure when using our website and our products. The protection of your privacy when processing personal data is important to ALDI Foto/ MEDION and its centrality is evident in all our business practices. We are concerned for the protection of your data which we collect, process and use when you visit the ALDI Foto/ MEDION website. Please do not hesitate to contact us if you have any questions on the subject of data protection with reference to ALDI Foto/ MEDION and we will make every effort to deal with your inquiry promptly. We also welcome your suggestions. The privacy statement may be updated from time to time. We therefore ask you to read this page regularly. The last line of this statement below indicates when it was last updated.
1. Basic principles
Your personal data are collected, processed and used in strict compliance with the statutory provisions and according to the principles of good faith. As far as possible, we conduct our business processes in such a way that the data protection requirements are already taken into account during the development of the products and services and ensure that personal data are anonymised in such a way that the data subject cannot be identified or can no longer be identified if this does not jeopardise the agreed purpose. ALDI Foto/ MEDION will use your personal data for the technical administration and further development of this website, for customer management, user administration and marketing, to inform you about our services and products and for other precisely defined purposes.
Your image data will be automatically stored for 60 days for the purpose of providing photo products. The storage period of any given project will be extended by 30 days each time the data are edited. You can delete your image data (projects) in the project folder at any time. Aldi Foto/ MEDION will also provide you with online storage space at your request which you can optionally use to save the configuration of selected products over a longer period of time. You have the option of deleting your design projects from the online storage space (online project folder) at any time using your online login and access password. The data collected from you will be processed exclusively in Germany.
2. Sources and data
We process personal data which we have received directly from you in the context of our business relations. We also process personal data which we legitimately obtain from publicly accessible sources or which are rightfully transmitted to us by other third parties, insofar as these data are required for the provision of the relevant services and for the agreed purpose.
We save your data as required to process your purchase orders, to make photo products, to enable the use of our products or to provide services, such as repairs, and – if you so choose – to process payments. These are personal data, such as your address details, date of birth (for transactions requiring age verification), image data, and data required for certain payment methods. The relevant purchase order data (item, quantity, price, etc.) are filed with your address. In most cases ALDI Foto/ MEDION is already required by law to collect these data (in the case of age verification, for example, under the German Youth Protection Act (Jugendschutzgesetz - JuSchG) or under the German Fiscal Code (Abgabenordnung - AO).
3. Purpose of processing and legal basis
Your personal data will be processed in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) as well as the regulations in force in the state of North Rhine-Westphalia:
For the fulfilment of contractual obligations (Art. 6 (1) b) GDPR):
In connection with the balancing of interests (Art. 6 (1) f) GDPR):
If necessary, we will process your data beyond the actual performance of the contract to safeguard our legitimate interests or the legitimate interests of third parties. This will include the review and optimisation of procedures for the analysis of requirements for the purposes of approaching customers directly, advertising, market research and opinion polls (unless you have objected to the use of your data for these purposes), the assertion of legal claims and defence in legal disputes, the guarantee of IT security and IT operation of ALDI Foto/ MEDION, the prevention and investigation of criminal offences based on official orders, and the measures put in place for the business management and further development of ALDI Foto/ MEDION services and products.
On the basis of your consent (Art. 6 (1) a) GDPR):
If we have your consent to process personal data for specific purposes (e.g. forwarding of data within the group of companies, evaluation of data for marketing purposes), the legality of such processing is based on your consent. Once granted, consent may be revoked at any time. This also applies to the revocation of consent granted to us before the GDPR entered into force, i.e. before 25.05.2018. The revocation of the consent does not affect the legality of the data processed until the revocation.
For compliance with legal requirements (Art. 6 (1) c) GDPR) or in the public interest (Art. 6 (1) e) GDPR):
This might include identity and age checks, for example, or the fulfilment of inspection and reporting obligations under tax law. Unless specifically stated below, no personal data are processed during the use of this website, i.e. no personal data are saved, changed or passed on to third parties.
4. Transmission of data to third countries or international organisations
Data are transmitted to bodies in countries outside the European Union (referred to as third countries) insofar as this is necessary to process your orders or if required by law or if you have given us your consent. ALDI Foto/ MEDION does not transfer any personal data to bodies in third countries or international organisations in any further respects. ALDI Foto/ MEDION does, however, use service providers for certain orders who in turn use service providers who may have their company headquarters, parent company or data processing centres in a third country. Under Art. 45 GDPR, data may be transmitted if the European Commission has decided that there is an adequate level of protection in a third country. If no such decision has been taken, ALDI Foto/ MEDION or the service provider may only transfer personal data to a third country or to an international organisation if appropriate safeguards are in place (e.g. standard data protection clauses adopted by the Commission or by the supervisory authority in a particular procedure) and if enforceable rights and effective legal remedies are available. ALDI Foto/ MEDION has agreed contracts with these service providers for order processing, as it is called, which stipulate that fundamental data protection standards are always agreed with their contractual partners in keeping with the European level of data protection.
5. Storage periods
ALDI Foto/ MEDION processes and stores your personal data for as long as is necessary for the fulfilment of our contractual and legal obligations. If the data are no longer required for the fulfilment of contractual or legal obligations, they are routinely deleted unless their further processing is necessary – for a limited period – for the purpose of preserving evidence under the statute of limitations. Under sections 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch - BGB), these statutory limitation periods can be up to 30 years although the regular limitation period is three years. This also includes the fulfilment of statutory retention obligations under commercial law and tax law, as set out in the German Commercial Code (Handelsgesetzbuch - HGB) or the German Fiscal Code (Abgabenordnung - AO). The mandatory data and documentation storage periods specified in the aforementioned laws range from two to 10 years.
6. Your rights as the data subject
Any person whose personal data are processed has the following rights as the data subject:
Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR) and
Right to object (Art. 21 GDPR)
There are restrictions under sections 34 and 35 BDSG, however, which apply to the right of access and the right to erasure. There is also a right to lodge a complaint with a supervisory authority with responsibility for data protection (Art. 77 GDPR in conjunction with section 19 BDSG). The supervisory body for ALDI Foto/ MEDION is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW) at the following address: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein Westfalen, Postfach 200444, 40212 Düsseldorf. www.ldi.nrw.de/kontakt
7. Obligation to provide data
Within the context of our business relationship, you are required to provide such personal data as are necessary to establish and conduct business relations and to fulfil the contractual obligations associated therewith or such personal data as we are legally obliged to collect. Without these data we will generally not be able to conclude or execute the contract with you, or your statutory rights (e.g. guarantees and warranties) will be at risk.
8. Automated individual decision-making and profiling
As a general principle, we do not use fully automated decision-making processes, as defined in Art. 22 GDPR, to establish and conduct business relations. Should we use these procedures in individual cases, we will specifically inform you if required to do so by law. We process some of your data automatically with the aim of evaluating certain personal aspects (profiling). We use profiling for various purposes, such as to be able to provide you with targeted information on products and services or we use evaluation tools. These enable needs-based communication and advertising, including market research and opinion polls.
9. Collection of personal data during visits to our website
If you visit the website for information purposes only, as in merely browsing, i.e. if you do not register or otherwise provide us with information, we will only collect the personal data which your browser transmits to our server. If you view our website, we will therefore collect the following data which are technically necessary for us to display our website to you and to guarantee stability and security (legal basis is Art. 6 (1) section 1 f) GDPR):
– IP address
– Date and time of the request
– Time zone difference to Greenwich Mean Time (GMT)
– Content of the request (specific page)
– Access status/HTTP status code
– Volume of data transmitted in any given case
– Website from which the request is sent
– Operating system and its interface
– Language and version of the browser software
In addition to the aforementioned data, cookies will also be stored on your computer when you use our website. Cookies are small text files which are stored on your hard drive and assigned to the browser you are using and through which certain information is sent to the body which places the cookie (us in this case). This is used in various ways, such as to analyse the performance of the website through cookies which help to improve our website by providing us with overall statistics on the number of visitors to a site, the sections of a site viewed most frequently, and the city or location of the users. These may be installed by external analysis service providers acting on our instructions. These cookies cannot identify you personally. Cookies cannot run programs or transmit viruses to your computer. They serve merely to make the website easier to use and more efficient overall. ALDI Foto/ MEDION uses the following types of cookies: transient cookies and persistent cookies.
Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies which store a session ID with which various requests sent by your browser can be assigned to the common session. This will allow your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close the browser.
Persistent cookies are automatically deleted after a specified period which can vary depending on the cookie. You can delete cookies at any time in the security settings in your browser.
You can configure your browser settings as you wish and refuse the acceptance of third-party cookies or all cookies, for example. We would point out that you may not be able to use all the functions of this website in this case. Please note that most browsers offer different ways of protecting your privacy. You can allow first-party cookies, for example, but block third-party cookies or ask to be notified each time a website wants to install a cookie. Please note that disabling cookies in this way will mean that it is not possible to set new cookies but it will not prevent cookies previously set from continuing to function on your device until you have deleted all the cookies in your browser settings. You can usually find the instructions for managing cookies on your browser under the help function in the browser or in the operating instructions for your smartphone or for the stationary or mobile product with Internet access which you are using.
You have the right to prevent our partners from recording performance data at any time by means of the opt-out options listed below.
· Adition (link to www.adition.com/kontakt/datenschutz/)
· Google AdWords, Google Remarketing (link to adssettings.google.com/u/0/authenticated)
· Performance Media (link to performance-media.de/opt-out)
Name of cookie
Type of cookie
Tracking & analytics
The code of the provider is used to evaluate and optimise the ALDI Foto online campaigns.
The code of the provider is used to flag and unflag users in the ALDI Foto online shop for advertising purposes (reconnecting with users) outside the ALDI Foto online shop.
Our website uses social network plug-ins (Twitter, Facebook, etc.).
Rating reminder from Trusted Shops
If you have given your express consent during or after the purchase order process to be reminded to submit a review of your order, by activating a checkbox or by clicking a button provided for this purpose ("Rate Later"), we will send your email address to Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Köln (www.trustedshops.de) so that it will send you an email reminding you of the option of submitting a rating. This consent can be revoked at any time by sending a note to this effect to the contact below or directly to Trusted Shops.
Seal of approval with reviews:
Integration of the Trusted Shops Trustbadge
The Trusted Shops Trustbadge is featured on this website to display our Trusted Shops seal of approval and any reviews which may have been received and to advertise Trusted Shops products to buyers who have placed a purchase order. The purpose of this is to safeguard our legitimate interests in marketing our range of products and services in the best possible way which are seen as overriding when weighed against other interests. The Trustbadge and the services promoted with it are provided by Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Köln. When the Trustbadge is requested, the web server automatically saves a server log file which contains various data, such as your IP address, the date and time of the request, the volume of data transmitted and the requesting provider (access data), and documents the request. These access data are not evaluated and are automatically overwritten within seven days of the end of your visit. No further personal data will be sent to Trusted Shops unless you opt to use Trusted Shops products after completing a purchase order or have already registered for use. In this case the contractual agreement between you and Trusted Shops will apply.
11. Management of your data while processing payments
If you choose to pay by invoice, you will receive an invoice with the delivery of your photo order. If the delivery address is different, you will receive the invoice in PDF format with the confirmation of dispatch by email.
For all the payment methods listed below, the entire payment process will be handled by the respective service provider. Therefore ALDI Foto/ MEDION will not have access to any personal data relating to customers in respect of specific payments.
If you choose to pay by credit card, your payment will be forwarded and processed by Elavon Merchant Services, Postbus 20 000, Boîte Postale Brussel 1000 Bruxelles 1, Belgium. Therefore this name may also appear on your credit card statement. Elavon processes payment data on behalf of ALDI Foto/ MEDION in the course of providing payment management services and related services. In its role as order data processor, Elavon is particularly concerned with adhering to the principle of data economy and so collects and stores only such information as is absolutely essential. The entire payment process is managed by Elavon therefore ALDI Foto/ MEDION has no access to payment-related data of the customer.
If you choose to pay by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal, L-2449 Luxembourg), you will be redirected to PayPal at the end of the purchase order process. If you are already a PayPal customer, you can log in there with your user data and confirm the payment. If you are new to PayPal, you can open a PayPal account and then confirm the payment. It usually only takes a few minutes for us to receive confirmation of the payment from PayPal after the order has been placed and so your order is prepared for dispatch immediately. Please note, however, that in rare cases processing errors may occur on PayPal sites over which we have no control. If you return the goods, the refund will be credited to your PayPal account. For more information about PayPal, please visit www.paypal-deutschland.de/privatkunden/was-ist-paypal.html.
If you opt to pay by direct debit, you will be asked to enter your bank details in the payment form including the IBAN and BIC.
The data are sent in encrypted form. If you pay by direct debit, the relevant amount will be debited from your account after completion of your order.
paydirekt (paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am Main) is a fast, simple and secure payment procedure for German banks. Payments are made online through your paydirekt account which is linked to your current account. At the end of the purchase order process you will be forwarded to paydirekt. As soon as you click the “Buy Now” button there, your booking will be confirmed. In order to make the payment through paydirekt, you will need a paydirekt account.
12. Information about your right to object under Art. 21 of the General Data Protection Regulation (GDPR)
You may withdraw your consent from ALDI Foto/ MEDION at any time for the processing of personal data. This also applies to the withdrawal of any declarations of consent issued to us before the General Data Protection Regulation (GDPR) entered into force, i.e. before 25.05.2018. Please note that the revocation will only be effective for future processing. Any processing which took place before the revocation will not be affected by this.
Right to object in individual cases
You have the right, at any time for reasons arising from your particular situation, to object to the processing of personal data concerning you pursuant to Article 6 (1) e) GDPR (data processing in the public interest); this also applies to any profiling based on this provision as defined in Art. 4 (4) GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for their processing which override your interests, rights and freedoms or if the data are processed for the establishment, exercise or defence of legal claims.
If we base the processing of your personal data on the balancing of interests, you may object to the processing. This will be the case if the processing in particular is not necessary to fulfil a contract with you which will be set out by us in each case in the following description of the functions. When any such objection is raised, we will ask you to explain the reasons why we should not process your personal data as we have done. Having received the reasons for your objection, we will investigate the situation and either stop processing the data and/or adapt our processing practices or explain the compelling legitimate reasons why we are required to continue processing the data.
Right to object to the processing of data for direct marketing purposes
In individual cases we will process your personal data for direct marketing purposes. You have the right to object to the processing of your personal data for the purpose of such advertising at any time; this also applies to profiling insofar as it is associated with such direct advertising. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes. The notice of objection need not take any official form and should preferably be addressed to MEDION AG, Datenschutz, Am Zehnthof 77, 45307 Essen.
13. Body responsible for ALDI Foto/ MEDION: MEDION AG, Am Zehnthof 77, 45307 Essen
You can also contact the company data protection office and the company data protection officer, Peter Staab, by email: firstname.lastname@example.org