1. Who is responsible for processing my data?
Arvato Distribution GmbH
An der Autobahn 22
Phone +49 5241 527-6000
Fax +49 5241 527-6001
is responsible for processing your data on the website. You can contact the data protection officer of Arvato Distribution GmbH using the above postal address with the addition “To the data protection officer” or using the email address firstname.lastname@example.org.
Arvato Distribution GmbH (hereinafter “we” or “us”) process personal data in accordance with the provisions of GDPR and the German Federal Data Protection Act (hereinafter “BDSG”).
2. Which data is recorded?
In connection with your visit to the website and exclusively where technically, contractually or legally required, your data will be processed in order to display the desired content and to facilitate your use of the website’s features.
When you visit the website, information is collected automatically from the computer used to access it (hereinafter “access data”). This access data includes details about the content you request on the website and your usage behavior as well as information about the browser type and version, operating system, internet service provider, the date and time of the use of the website, the websites visited previously and websites newly accessed via our website and the IP address of the computer (also referred to as “server log files”). Pseudonymous usage profiles are created from the access data using web tracking and are analyzed. It is therefore not possible for us to identify you personally.
In principle, you can use the website’s features, such as finding out about us, without entering your data. However, it is necessary to enter data such as your name, address, email address or telephone when using certain features, such as contacting us or signing up to a newsletter. Mandatory information is usually marked with an *.
3. Which cookies are used?
Cookies are used on the website. Cookies are small text files that are stored on your computer when you visit a website. The cookies saved are determined by the browser you use. When the relevant website is accessed again, the web browser sends the content of the cookies back and allows the user to be recognized. Cookies are limited to a certain time period (e.g. once the browser session ends). In addition, you can configure and delete cookies as you desire using your browser’s settings. Deleting them prematurely can however lead to the features of the website only being available to a limited extent.
The website distinguishes between two types of cookies: functional cookies and optional cookies. Functional cookies are used to provide the website in a technically and functionally flawless way (e.g. identification and authentication of the user, language settings, display of images). Without the functional cookies, the features of the website are only available to a limited extent. The optional cookies help to optimize features of the website by recording user behavior and analyzing it in the form of statistics.
In principle, cookies serve as online recognition only and are not personalized. Cookies can include personal data if the information created by the cookies is combined with further data, such as the access data in accordance with Section 2 (e.g. when using web tracking). In principle, such combination only takes place in pseudonymized form. A personal combination is only permitted if you have consented to it or where allowed by law.
4. Which data is collected and for what purposes?
The purposes of data processing can be based on technical, contractual or legal requirements or be based on permission granted if applicable. We use your data for the following purposes:
- Provision of the website and guaranteeing of technical security, especially the rectification of technical errors and to ensure that unauthorized parties do not gain access to the website systems;
- Coverage measurements and web analyses in order to design the website to be more efficient and interesting for you and to carry out market research;
- Communication, contract initiation and customer care;
- Provision of free downloads; and
- Advertising communication.
4.1 Technical provision of the website
4.1.1 Description and scope of data processing
For the functionality of the website, the implementation of security analyses and to defend against attacks, the server log files are collected automatically as part of the access data in accordance with Section 2 accrued by the computer system accessing it and during the use of the website and are stored temporarily. The server log files are not stored alongside other data. We use the server log files for statistical analyses, to analyze and rectify technical disruptions, to combat attempts at attacks and fraud, as well as to optimize the functioning of the website.
4.1.2 Purposes and legal basis for data processing
The legal basis for the collection of server log files is Art. 6 (1) (f) GDPR. Legitimate interests lie in the functionality of the website, the performance of security analyses and the defense against dangers.
4.1.3 Duration of storage or criteria to define this duration
After loading the websites, the server log files are stored on the web server and the IP address contained therein is deleted after seven days at the latest in accordance with the requirements of the Telecommunications Act (“TKG”). Other regulations apply if concrete suspicion exists and storage going beyond this is legally required for the purpose of evaluation and clarification.
4.1.4 Right to objection or elimination
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your data. If you would like to assert your right to object, please contact the contact address specified under point 1.
4.2 Contact Form
4.2.1 Description and scope of data processing
On the website, there is the option to contact us via a contact form. If you take this opportunity, you will provide us with your data such as your email address, telephone number, first name and surname and your query (also referred to as “contact details”). The contact details are only stored and used to process your query (e.g. questions about products and services).
4.2.2 Purposes and legal basis for data processing
The legal basis for the processing of your contact details is usually Art. 6 (1) (f) GDPR. There are legitimate interests in the processing of your specific query and further communication. If the purpose of you getting in contact is to enter into a contract (e.g. to avail of our services), the legal basis for the contract shall be Art. 6 (1) b GDPR.
4.2.3 Duration of storage or criteria to define this duration
After processing your query and ending further communication, your contact details will be deleted. Other regulations apply if the purpose of getting in contact is to enter into a contract. For this purpose, the data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
4.2.4 Right to objection or elimination
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your contact details. If you would like to assert your right to object, please contact the contact address specified under point 1. If you object, the processing of your query cannot continue. Other regulations apply if the storage of your contact details is required to initiate a contract or to execute a contract.
4.3 Assertion of data subject rights
4.3.1 Description and scope of data processing
4.3.2 Purposes and legal basis for data processing
We are legally obliged under GDPR to process your data in order to assert data subject rights. The legal basis for this is Art. 6 (1) (c) GDPR.
4.3.2 Duration of storage or criteria to define this duration
We store the correspondence held with you in relation to the assertion of data subject rights for a period of three years. This excludes evidence of identity such as a marked copy of your personal ID, if you provide us with one. This will be deleted once your identity has been confirmed.
4.3.3 Right to objection or elimination
The processing of your data is required in order to satisfy your data subject rights. In this respect, you have no right to object.
4.4 Downloading free content (e.g. studies, white papers)
4.4.1 Description and scope of data processing
Via the website, you can download content we have provided, such as studies or white papers on current topics from our areas of business. When you download, your contact details will be sent to us via the registration screen and stored. We will also record the date and time of your download when doing so. Downloading is voluntary, free of charge and generally independent from any other features of the website. You can see further details in the contractual provisions (link to T&Cs from the footer).
4.4.2 Purposes and legal basis for data processing
The download of free content is an online feature we offer you. The legal basis for the processing of your related data is the contract under Art. 6 (1) (b) GDPR.
4.4.3 Duration of storage or criteria to define this duration
Your data will be stored for as long as is necessary to execute the contract concerning the downloading of free content. The contract ends automatically once the download has completed successfully. After the end of the contract, your data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
4.4.4 Right to objection or elimination
The processing of your data is required in order to fulfil the contract governing the downloading of free content. In this respect, you have no right to object.
4.5 Registration for events
4.5.1 Description and scope of data processing
You can register for individual events via the website. In general, the events consist of presentations on current topics and developments in our areas of business. Our portfolio of services plus new products and services may also be presented. Your contact details are sent to us via the registration form and are processed for your participation. We will also record the date and time of your registration when doing so. Your data is only forwarded to third parties (e.g. event organizers, hotels) exclusively where this is necessary for your participation in the event.
4.5.2 Purposes and legal basis for data processing
Participation in events is an online feature we offer you. The legal basis for the processing of your related data is the contract under Art. 6 (1) (b) GDPR.
4.5.3 Duration of storage or criteria to define this duration
You data will be stored for as long as is necessary for participation in the individual events. After your participation, your data will only be stored until the contractual and/or legal storage periods (currently 6 to 10 years) are complete.
4.5.4 Right to objection or elimination
The processing of your data is necessary in order for you to participate in the specific event. In this respect, you have no right to object.
4.6 Business customer survey
4.6.1 Description and scope of data processing
As part of our business customer relationships, we occasionally conduct customer surveys in order to record satisfaction and to improve our services. The customer survey is intended for our business customers, but we generally store your contact details in our customer database if you act as a contact person. We use your contact details to invite you to take part in the customer survey. Participation is voluntary and you have the option to communicate to us at any time that you would no longer like to receive invitations to take part in customer surveys in the future. Your contact details are generally no longer required for analysis, as the survey results consist of purely statistical information. It is then no longer possible to identify you personally.
4.6.2 Purposes and legal basis for data processing
The legal basis for the processing of your contact details is Art. 6 (1) (f) GDPR. There are legitimate interests in customer care and retention and in the improvement of our services.
4.6.3 Duration of storage or criteria to define the duration
In principle, survey results will be stored for the duration of the business relationship. Other provisions apply in the event that the survey results consist of purely statistical data.
4.6.4 Right to objection or elimination
You have the right, for reasons that result from your particular situation, to submit an objection to the processing of your contact details. If you would like to assert your right to object, please contact the contact address specified under point 1.
4.7 Web tracking
The web tracking services are regularly provided by service providers who process the usage profile according to our instructions, and not for their own purposes. This is ensured based on order processing contracts. If the service providers have offices outside of the European Union or the European Economic area (hereinafter “EU/EEA”), then what is called a third-country transfer takes place. This is permitted if you have consented to it, we have provided guarantees for a level of data protection in line with the European standard or the European Commission has classified the third country as a secure third country. The third-country transfer of the respective service is detailed below. You can find further information about the recipients of your data and the third-country transfer in Sections 6 and 7.
4.7.1 Google Tag Manager
The website uses the Google Tag Manager. This service is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google Inc.). The Google Tag Manager can be used to manage the web tracking services integrated into this website and other services using so-called "tags" (placeholders for a website code). The Google Tag Manager only implements these tags. No cookies are used and no personal data is collected by the Google Tag Manager. The Google Tag Manager only triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data.
4.7.2 Google Analytics
This website uses the Google Analytics service. Google Analytics is supplied by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). Google Analytics creates a pseudonymized usage profile in order to optimize the user-friendliness of the website. Pseudonymity is ensured by the IP address being shortened before your data is transmitted to Google and it not being possible for conclusions about your identity to be drawn. The pseudonymized usage profile is analyzed after transmission for the purpose of optimizing user-friendliness. It is not combined with other Google data. By means of an order processing contract, we ensure that Google only processes the data in line with our instructions.
A third-country transfer takes place through the use of Google Analytics. With certification under the EU-US Privacy Shield, however, Google ensures that the same level of data protection as in Europe is guaranteed during the third-country transfer. You can find further details about the third-country transfer under Section 7.
4.7.5 Purposes and legal basis for data processing
The legal basis for the collection and analysis of pseudonymous usage profiles is Art. 6 (1) f GDPR/Section 15 (3) German Telemedia Act (TMG). We have legitimate interests in the optimization of the user-friendliness of the website and measuring coverage.
4.7.6 Duration of storage or criteria to define this duration
Data that is collected and analyzed when using web tracking services is generally stored until you object to its use. The storage duration of cookies is generally no longer than 24 months.
4.7.7 Right to objection or elimination
You can object to the use of Google Analytics at any time by changing your browser settings and/or clicking on the following link to download and install the available browser plug-ins: https://tools.google.com/dlpage/gaoptout?hl=en.
In addition, you can centrally deactivate web tracking by all providers who are part of the “Your Online Choices” self-regulatory initiative via the link http://www.youronlinechoices.eu.
We also use your access data under Section 2 to activate tailored advertising on our websites and the newsletter of Arvato Supply Chain Solutions. This allows us to recognize click fraud and to activate advertisements that are as relevant to you as possible. The advertising that is presented to you is chosen based on your access data that accrues when you use the websites and the newsletter (called “re-targeting”).If you have given us your consent to personalized advertising, we will process your data on this basis to the extent you have permitted. Without your consent, we will only process your data using pseudonyms, i.e. the data that accrues as part of online advertising is not combined with your other data (e.g. contact details).
4.8.1 Targeted advertising (newsletter)
You can register for a free newsletter on the website. So that we can check your identity and see that you have registered, we use what is called the double opt-in procedure. In this procedure, the technical data of your registration is stored (e.g. time and date). For the registration, your data will also be sent to us via the registration form and processed further by service providers to send the newsletter via email. In principle, this is only your email address. Further information is optional.
By registering, you agree to receive advertising tailored to your interests from us and our subsidiaries from our corporate group Arvato Supply Chain Solutions via email about our products and services in logistics
Using cookies and tracking technology, we record your data when using the content of the newsletter (e.g. which links were clicked on). For one, this is so that we can determine when the newsletter is opened and how it is used (e.g. click rate or opening rate). In addition, we can tailor the content and therefore the advertising to your personal interests (e.g. interest in a certain business area, such as Consumer Products). For this individualization, we look at the following data in addition to the newsletter usage data:
- access data accrued from your use of our website under Section 2 (log files and features utilized, e.g. downloading a study or white paper);
- contact details shared by you and voluntary information (name, email, telephone, company-specific information, e.g. company name and industry).
Your data accrued is combined and stored as a personal usage profile in our CRM customer database.
4.8.2 Purposes and legal basis for data processing
The legal basis for online advertising using pseudonymous usage profiles is Art. 6 (1) f GDPR/Section 15 (3) TMG. The legitimate interest lies in the tailored presentation of advertising and offering of our products and services via the website and the newsletter.
The legal basis for individualized advertising is your consent in accordance with Art. 6 (1) a GDPR/Section 7 (2) 3 Unfair Competition Prevention law (hereinafter “UWG”). The newsletter aims to approach (potential) business customers of Arvato Supply Chain Solutions with advertising to inform them of its own products and services. Registration for our newsletter is voluntary and generally independent of any other features of the website.
4.8.3 Duration of storage or criteria to define this duration
The pseudonymized usage profiles created for online advertising are stored for a duration of 4 years, unless you object to the processing of your data for the processing of the online advertising. Google cookies generally become invalid after 30 days.
The individual interests recorded through the use of the newsletter are saved until you withdraw your consent. Due to legal evidence obligations, we store your permission granted and your revocation for three years after receipt.
4.8.4 Right to objection or elimination
You can deactivate online advertising of Google services as follows:
- by blocking cookies for conversion tracking by setting up your browser so that cookies are blocked by the domain “www.googleadservices.com”.
- by changing your Google advertising settings at https://adssettings.google.de/authenticated?hl=en; or
- by installing the deactivation plugin in your Firefox, Internet Explore or Google Chrome browser using the link https://support.google.com/ads/answer/7395996?hl=en&ref_topic=7048998
In addition, you can centrally deactivate online advertising by all providers who are part of the “Your Online Choices” self-regulatory initiative via the link http://www.youronlinechoices.eu.
You can revoke your consent to the processing of your data to receive individualized advertising and therefore the newsletter at any time with future effect by using the deregister link or by sending your revocation to Arvato Distribution GmbH via email email@example.com or via post “An der Autobahn 22, 33333 Gütersloh”.
4.9 Online Application
4.9.1 Description and scope of data processing
Job vacancies are published on this website, which you can use to apply for a job at Arvato Supply Chain Solutions . You are forwarded to the Bertelsmann applicant portal via the job advert. Therefore the actual data processing for the application process for your online application does not take place on this website. Responsibility for the job adverts is borne by the company that has posted them. This company is also the one that regularly receives your data when receiving your online application. Your data is therefore not forwarded to any other parties
You can find further details about data processing for your online application during registration and when creating your applicant profile, and can be accessed via the following link: https://jobsearch.createyourowncareer.com/content/Privacy-Policy/?locale=en_US
4.9.2 Purposes and legal basis for data processing
When your online application for a specific job vacancy is received, your data will be processed for recruitment purposes. In the employment contract initiation phase, your potential employer has an interest in ensuring that you possess the specialist skills and personal qualities required for the vacant position. The legal basis for the processing of your data is the contract under Art. 6 (1) (b) GDPR.
4.9.3 Duration of storage or criteria to define this duration
Your data is only processed where required for the recruitment decision. After finishing the online application, your data will be deleted after the end of the statutory storage period (currently usually six months).
4.9.4 Right to object or elimination
The processing of your data is required for the recruitment decision, i.e. (pre-)contractual purposes. There is thus no option to object.
5. External service providers and content
We include external services and content on our website. If you use such a service or if you are shown third-party content, technical communication data will be shared between you and the provider in question.
In addition, it may transpire that the provider of the services or content in question will process your data for its own further purposes. To the best of our knowledge, we have configured third-party services and content from providers who knowingly process data for their own purposes in such a way that either stops communication for purposes other than the presentation of content or services on our website, or communication only takes place if you actively decide to use the service. Since we have no influence on the data collected by third parties and its processing, we cannot provide any binding information about the process and scope of the processing of your data.
You can therefore find further information about the purpose and scope of the collection and processing of your data in the data protection information for the data controllers of the providers of the services and content we have integrated:
- Social Media: […]
- YouTube: https://support.google.com/youtube/answer/7671399
- Google Maps: https://maps.google.com/help/terms_maps.html
6. Who receives my data?
In our company, the departments that require your data to fulfil the purposes presented under Section 4 will receive access to it. The service providers we commission may also receive access to your data (also referred to as “processors”). The requirement to observe instructions, data security and the confidential handling of your data by these service providers is ensured by means of processing contracts.
The forwarding of data to further recipients such as advertising partners, providers of social media services or law enforcement authorities (referred to as “third parties”) only takes place where required by statutory provisions or where you have given your permission. In connection with receipt of our newsletter, you have consented to your data also being forwarded to the subsidiaries of our corporate group Arvato Supply Chain Solutions for the purpose of tailored advertising. The confidential handling of your data and compliance with data protection regulations is ensured by means of internal data protection guidelines and joint data security management.
7. Is my data processed in a third country?
Insofar as the service providers and/or third parties named under Section 6 have branches outside of the EU/EEA, this can lead to your data being transmitted to a country where a level of data protection suitable for the EU/EEA cannot be guaranteed. Such a level of data protection can be ensured by means of a suitable guarantee, however. Standard contractual clauses provided by the EU Commission are an example of a suitable guarantee. Any guarantees may be waived by way of exception if you give your permission or the third-country transfer is necessary to execute our contractual relationship. The EU Commission has also recognized certain third countries as secure third countries, meaning that the company does not need to make suitable guarantees in these cases.
A third-country transfer takes place through the use of Google services for web tracking and online advertising. In principle, the data will be processed by Google within the EU. Google will only be able to access the data in the USA in exceptional cases, such as due to technical maintenance. With certification under the EU-US Privacy Shield, however, Google ensures that the same level of data protection as in Europe is guaranteed during this third-country transfer. You can find more information here about this certification here https://www.privacyshield.gov/welcome.
A third-country transfer may also take place via our newsletter in the case of targeted advertising. Some of our subsidiaries are based outside of the EU/EEA (e.g. USA or Shanghai). We have entered into standard contractual clauses with these subsidiaries in accordance with the EU Commission’s stipulations. You can find more information here https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:385:0074:0084:DE:PDF.
8. What data protection rights do I have?
You have the right to be informed about the personal data we have stored about you at any time. Should data about you be incorrect or no longer up-to-date, you have the right to request its correction. You also have the right to request the deletion or restriction of processing of your data in accordance with Art. 17 and 18 GDPR. You may also have the right to receive the data you have provided in a common and machine-readable format (also known as “right to data portability”).
If you have granted consent to the processing of personal data for certain purposes, you can revoke this consent at any time with future effect. The withdrawal should be addressed to the company via the contract address specified under Section 1.
In accordance with Art. 21 GDPR, you have the right, for reasons that result from your particular situation, to submit an objection against the processing of your personal data in accordance with Art. 6 (1) f GDPR at any time. You have the right to object to the processing of your personal data for the purpose of direct advertising at any time. The same applies for automated procedures when using individual cookies, provided that these are not absolutely necessary for the provision of the website.
In addition, you have the option to contact a data protection authority and to submit your objections to it. The responsible authority is
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Phone: +49 211/38424-0
Fax: +49 211/38424-10
You can also contact the data protection authorities responsible for your place of residence.
Last updated: April 2019