Privacy Policy

This privacy notice informs you about the processing of personal data within our website. The privacy notice applies regardless of the domains, platforms and devices used (e.g. desktop, mobile, etc.).

We inform you about the processing of your personal data and the rights to which you are entitled under the the European General Data Protection Regulation (GDPR). Personal data as defined by the GDPR is any information relating to an identified or identifiable natural person (‘data subject’), e.g., name, address, e-mail, order data, vehicle data.

In our privacy notice, we use various other terms as defined by the GDPR. These include terms such as processing, restriction of processing, profiling, pseudonymisation, controller, processor, recipient, third party, consent, supervisory authority and international organisation. You can find the corresponding definitions for these terms in Article 4 of the GDPR.

 

1.Who is responsible for data processing and whom can I contact?

The entity responsible for the processing of personal data is:

ACCO Fashion Retail DE GmbH

Kurfürstendamm 224

10719 Berlin

Germany

info@accofashion.de

You can contact our data protection officer at:

mip Consult GmbH

Ms. Halah Salih

Wilhelm-Kabus-Str. 9

10829 Berlin

privacy@accofashion.de

 

2. What sources and data do we use?

We process personal data that we receive from you while using our website and, if applicable, in the course of our business relationship.

In the case of purely informational use of our website, i.e. if you do not register or otherwise submit information to us, we only collect the personal data that your browser transmits to our server. When you access our website, we collect the following access data, which is technically necessary for us to present our website to you and to ensure stability and security. The access data includes the IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (i.e. name of the specific website accessed), access status/HTTP status code, amount of data transferred in each case, referrer URL (previously visited page), operating system and its interface, language and version as well as type of browser software, notification of successful retrieval.

Furthermore, we receive your personal data if you contact us via job or franchising application form or e-mail. Personal data here are, for example, name, e-mail, telephone number and, if applicable, any data and files contained in the message that you send us (hereinafter referred to as "contact data").

 

3. What do we process your data for (purpose of processing) and on what legal basis?

We process personal data in accordance with the provisions of the European Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the following purposes and on the basis of the following legal grounds:

 

Purposes	Legal basis
When contacting us (via mail, chat or e-mail), your data will be processed for the purpose of handling the contact request and its processing.	Performance of a contract or execution of pre-contractual measures upon request of the person, Art. 6 para 1 lit b GDPR
When you visit our website for the first time, you will be asked whether you wish to consent to the use of technically unnecessary cookies and similar technologies. If you consent to the data processing, this allows us to analyze the use of our website. Furthermore, we may carry out various marketing activities based on your interactions with the website, other marketing channels and other third parties, such as social networks. To learn more about the cookies and similar technologies we use, including in particular how to manage and delete them, see below in section 10 “Data processing by cookies and similar technologies”.	Consent, § 25 (1) TDDDG, Art. 6 para 1 lit. a GDPR
Job or Franchising applications : When you contact us (via contact form or e-mail) in connection with your application, we process your data in order to check your suitability for the position (or other open positions in our companies, if applicable) or franchising and to carry out the application process. Your application data will be screened by the HR and franchise department after receipt of your application. Suitable applications will then be forwarded internally to the department responsible for the respective open position or our franchising team. There a decision will be made on the further procedure. In principle, only those persons in the company have access to your data who require this for the proper conduct of our application procedure.	Establishment of an employment relationship,  after completion of the application procedure in case of rejection to protect legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR (defense against claims). Performance of a contract or execution of pre-contractual measures in case of franchising application, Art. 6 para 1 lit b GDPR and if consent has been given, Art. 6 para. 1 lit. a GDPR
We process your access data (see data specified under item 2 above) to safeguard our legitimate interests or those of third parties. In particular, we pursue the following legitimate interests : • Ensuring IT security, in particular the security of the Website; we also store the IP address in the event that someone leaves behind illegal, content using the comment function (insults, prohibited propaganda, etc.) and we must be able to determine the author's identity for our own legal protection. • Asserting legal claims and conducting our defense in case of legal disputes.	As part of the balancing of interests for the safeguarding of legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR

 

Consent, Art. 6 para. 1 lit. a GDPR –where we process your personal data based on consent, you may withdraw your consent at any time by contacting us at the above contact details. Please note that the withdrawal is only effective from the date on which you notify us of such withdrawal. Processing that took place before the withdrawal is therefore not affected, but you are entitled to request that we provide you with details of, or that we delete, the personal data that we hold about you.

 

4. Who can access my data?

Within the organization, departments that need to know your data to fulfill our contractual and regulatory obligations can access your data.

In addition, processors (Art. 28 GDPR) engaged by us may also obtain access to data for the above-mentioned purposes. These are companies in the categories IT services, telecommunications, sales and marketing. If we use processors to provide our services, we will take appropriate legal precautions as well as the relevant technical and organizational measures to protect personal data in accordance with applicable law.

Any transfer of data to third parties will be made only within the scope of legal requirements. We will disclose your data to third parties only if this is required, for example, under Art. 6 para. 1 sentence 1 lit. b GDPR for contractual purposes or based on legitimate interests pursuant to Art. 6 para 1 sentence 1 lit. f GDPR in the economic and effective operation of our business or if you have consented to the transfer of data. In the case of purely informational use of the website, we do not pass on any data to third parties.

 

5. How long will my data be retained?

For security reasons (e.g. to clarify acts of abuse or fraud), log file information is stored for a maximum of seven days and then deleted (see point 2 above). Data whose further storage is necessary for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.

As far as necessary, we process and store your personal data for the duration of our business relationship, which also includes, for example, the initiation of a contract via contact form or by e-mail.

Applicant data will be deleted after 6 months in the event of a rejection. If you have agreed to further storage of your personal data, we will transfer your data to our applicant pool. There, the data will be deleted if you revoke your consent or after 2 years at the latest. Should we fill the advertised position with you, your data will be stored in our personnel management system.

In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified there are six and ten years respectively.

Finally, the storage period is also assessed according to the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are usually 3 years, but in certain cases can be up to thirty years, whereby the regular limitation period is three years.

If you exercise your rights as a data subject, we will store the information provided to you in this regard until the expiry of the statutory limitation period pursuant to Section 31 para 2 no 1 OWiG, Section 41 para 1 BDSG, Article 83 para 5 lit b GDPR for 3 years. This period may be extended if the statutory limitation period is extended due to interruptions of the limitation period (e.g. in the context of inquiries by the supervisory authorities).

 

6. Are data transferred to a third country or to an international organization

The data provided will be processed within the European Union and in the USA. For countries without an adequacy decision by the Commission according to Article 45 GDPR, as is the case with the USA, we generally agree on EU standard contractual clauses with the recipients of your data or obtain your consent for the data transfer.

Note: The protection of personal data in the USA does not correspond to the level of data protection required by the EU. In particular, there are no enforceable rights to protect your data against access by government authorities. Therefore, there is a risk that these government agencies can access the personal data without the data transmitter or the recipient being able to effectively prevent this.

 

7. What are my data subject rights?

In accordance with Art. 15 GDPR, you have the right of access as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data. In this case, we will provide you with the stored personal data. You also have the right to the information specified in detail in Art. 15 para 1 GDPR. However, the aforementioned right is not unlimited; the limitations of the right can be found in particular in Art. 15 para 4 GDPR.

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and to completion of incomplete personal data in accordance with Art. 16 GDPR.

You have the right to obtain the erasure of personal data concerning you without undue delay acc. Art. 17 GDPR. The right to erasure (“right to be forgotten”) is not unrestricted. In particular, erasure cannot be demanded, if we need to process your personal data further in order to perform our contract, to fulfil a legal obligation or to assert, exercise or defend legal claims. The requirements and restrictions of the right to deletion are set out in detail in Art. 17 GDPR.

You have the right, in accordance with Art. 18 GDPR, to request that the processing of your personal data be restricted if one of the conditions of Art. 18 para 1 GDPR is met. In this case, we may continue to store this data, but may process it only under strict conditions. The conditions and restrictions of the right to restrict processing are set out in detail in Art. 18 GDPR.

Pursuant to Art. 20 GDPR, you have a right to data portability. You may request to receive the personal data provided by you, which we process in an automated process on the basis of the contract existing between us or your consent, in a structured, common and machine-readable format. In addition, you may request us to transmit this data directly to another responsible party, insofar as this is technically feasible. The requirements and restrictions of the aforementioned rights in detail can be found in Art. 20 para 3 and 4 GDPR.

You can withdraw your consent to the processing of your personal data at any time. Veuillez noter que le retrait ne prend effet que pour l'avenir et n'affecte pas la légalité du traitement effectué sur la base du consentement jusqu'au retrait.

Information about your right to object according to Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 para 1 lit e GDPR (data processing in the public interest) and Art. 6 para 1 lit f GDPR (data processing based on balancing of interests); this also includes profiling under these provisions within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing serves the purposes of asserting, exercising or defending legal claims.

In individual cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is associated with such direct marketing. If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes. If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Objections do not require a particular form and no costs are incurred, other than the transmission costs according to the basic tariffs. If possible, any objection should be addressed to the above-mentioned address or email.

The above notifications and measures requested by you will be made available to you free of charge in accordance with Art. 12 para 5 GDPR.

You have a right to complain to a data protection supervisory authority if you are of the opinion that the processing of your personal data violates the GDPR, without prejudice to any other administrative or judicial remedy.

 

8. To what extent do you apply automated individual decision-making, including profiling?

In the context of accessing our website or in the context of contacting us by form or e-mail, we do not use any fully automated decision-making pursuant to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately if this is required by law. We do not process your data automatically with the aim of evaluating certain personal aspects (profiling).

 

9. Is there an obligation for me to provide data?

You must provide the personal data that is required for the use of our website for technical or IT security reasons. If you do not provide this data, you will not be able to use our website.

When contacting us by form or e-mail, you only need to provide the personal data that is required to process your request. Otherwise we will not be able to process your request.

 

10.Data processing by cookies and similar technologies

We use cookies and similar technologies on our websites. A cookie consists of a key and a value and is managed by your browser and often stored in a database and on your terminal device when you visit a website.

Cookies may be technically necessary for the provision of a website. For these cookies, consent is not required. Other cookies may, in turn, increase the functionality of a website, or are used for marketing or collecting statistics to improve the website. These cookies usually require consent.

Some cookies are deleted when you end your browser session, i.e. after you close your browser ("session cookies"). Other cookies remain on your terminal device for the specified lifetime of the cookie; unless you delete these cookies manually beforehand.

In addition, we and any services we may use use web storage. Here, information is stored locally in the cache of your browser. The stored information is either automatically deleted again after closing the browser window ("session storage") or continues to exist so that it can be read again when you visit the website again ("local storage"), unless you delete your browser cache ("browser data").

We store information on your terminal device if this is absolutely necessary to provide you with our website, § 25 para. 2 n^o. 2 TDDDG. Otherwise, in accordance with § 25 para. 1 TDDDG, the collection of data is generally only based on your express consent.

Click here for information on the cookies and similar technologies we use: