Data protection notice of Strauss Deutschland GmbH and Co. KG

1 | Controller

The controller responsible for the processing of your personal data (hereinafter: data) is

Strauss Deutschland GmbH & Co. KG (hereinafter „we“)
Frankfurter Straße 98-108
63599 Biebergemünd

Further contact details can be found in the legal notice.

2 | Contact details of the Data Protection Officer

If you have any questions, complaints or requests for information regarding data protection, please contact us by e-mail at datenschutz@strauss.de or by post with the additional reference “Datenschutz” (data protection) at the address mentioned above.

You can reach our Data Protection Officer at the following address

Dr. Florian Modlinger
Mitterweg 36a
83233 Bernau a. Chiemsee
Phone: 0176-32572896
Fax: +4932121434755
E-mail: modlinger@strauss.de

3 | General information on our data processing

3.1 | Website

When you access our website, our system automatically collects data and information from the device used to access the site. This includes, among other things, the browser type, the operating system, the IP address, date and time of access, the pages accessed, the previously visited website (referrer) as well as similar technical information. This data is processed in order to deliver the website, to ensure system security and stability and for the purpose of hazard prevention – for example in the event of a cyberattack. No personal evaluation takes place; the data is analysed statistically in anonymised form. The legal basis for this is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in achieving the purposes mentioned above. 

The data is deleted after no more than 30 days; longer storage only takes place in anonymised form. As the collection of this data is absolutely necessary for the operation of the website, there is no possibility to object.

3.2 | CDN und Web Application Firewall

In addition to the general processing activities, we use a content delivery network (CDN) of the service provider “Fastly” (Fastly Inc., 475 Brannan St., Suite 300, San Francisco, CA 94107, USA) on our website. With the help of the CDN, contents of the online offering, such as large media files, graphics or program scripts, can be delivered more quickly and securely via regionally distributed servers connected to the internet. We also use a so-called web application firewall (WAF) from Fastly in order to identify and prevent attacks on our website as quickly as possible. The processing of your personal data in this context is based on our legitimate interest in ensuring and improving the stability and functionality of our website. 

When using Fastly, we are aware of the potential transfer of your personal data to the USA as an insecure third country. In this case, we have ensured by means of appropriate measures that compliance with the European level of data protection is guaranteed. 

Further information on data protection at Fastly can be found at https://www.fastly.com/privacy.

3.3 | Barrier-reduced access

Furthermore, we use the software Eye-Able® of Web Inclusion GmbH on our website in order to ensure barrier-reduced access to information on the internet. The files required for this, such as JavaScript, stylesheets and images, are loaded locally from this website. Eye-Able® uses the browser’s local storage when functions are activated, in order to store the settings. All settings are only stored locally and are not transmitted any further. 

The legal basis for the processing of your personal data in this context is Art. 6 (1) lit. f GDPR. We have a legitimate interest in being able to implement accessibility requirements in the best possible way. The legal basis for accessing your end device and storing data in your browser is § 25 (2) TDDDG, as the provision of a barrier-reduced access is required for the provision of our website under the applicable statutory provisions. 

Further information on Eye-Able® can be found in the following privacy policy: https://eye-able.com/datenschutz/.

3.4 | Optimisation of business processes

We generally process the data transmitted and collected from you in the course of the processes described below in this data protection notice for the optimisation of our business processes and corporate planning. Where possible, we anonymise the data before further processing. 

In particular, for example, we may process data that we have collected from you in the context of contact and marketing activities for the purpose of optimising our marketing measures and customer service, e.g. to supplement our FAQ page, to optimise our chatbot or to otherwise adapt our customer service to the needs of our customers and prospects. 

Another example of this type of data processing is the processing of data received from our customers in the context of order processes in order to optimise our production and inventory levels in line with the needs of our customers or, in general, to carry out fact-based corporate planning. 

Our legal basis is our legitimate interest in optimising our business processes, in particular our customer services and marketing efforts. You may object to this processing at any time. 

We process your data for these purposes for as long as is necessary to achieve these purposes.

3.5 | General note on the use of AI

In order to carry out internal company processes and achieve the purposes communicated to you, we use AI-based systems in addition to conventional IT systems. In no case does any prohibited automated decision-making within the meaning of Art. 22 GDPR take place. The use of such AI systems is carried out in compliance with the applicable legal requirements.

4 | Customer data processing

4.1 | Registration of a customer account

If you register with us as a customer (in the webshop or on site in one of our workwear stores, popup stores or at trade fairs), we process the data provided by you in order to set up a personal customer account and to provide you with the functions and services associated with it. Via your customer account you can, among other things, control and manage processes relating to your use of our webshop (e.g. view and manage orders, store address and contact data) and use additional convenience functions (e.g. wish lists). Some information is strictly necessary in order to be able to create a customer account and use the basic functions (e.g. login data, contact information, delivery and payment details). In addition, you may provide us with voluntary information that we process in order to make it easier for you to use your customer account and to optimise our services. 

Processing is based on your consent pursuant to Art. 6 (1) lit. a GDPR, which you give when registering. You can revoke this consent at any time with effect for the future by deleting your customer account or adjusting your consent in the account settings. 

We will delete your customer account as soon as you request the deletion and no statutory retention obligations exist any longer. 

4.2 | Orders and contract processing

If you order or purchase services via our website or in any other way, we process the data you provide (e.g. name, address, e-mail address, payment details) in order to fulfil or prepare the contract concluded with you. This includes, in particular, taking orders, shipping, invoicing and payment processing as well as potential subsequent measures such as returns, revocations, exchanges, complaints and warranty cases. The legal basis for this is the performance of a contract pursuant to Art. 6 (1) lit. b GDPR.

In connection with orders and contract processing, various technical services may be used in order to enable an optimised shopping experience (e.g. via the webshop). If this involves access to your end device, the legal basis is additionally § 25 (2) No. 2 TDDDG and processing is carried out in order to provide you with the desired shop functions. The legal basis for this processing is our legitimate interest in providing you with an optimised shopping experience (e.g. as part of an optimised and technically functional webshop). 

For the processing of orders, we use service providers, for example for the transport and delivery of your order. If you order goods from third-party providers from us, we also transfer your data to them insofar as this is necessary for shipping. The legal basis is in each case Art. 6 (1) lit. b GDPR. 

In order to ensure that the ordered goods are properly delivered, we may use service providers for shipment control and for the provision of shipment notifications. For this purpose, the data required (e.g. delivery address, order or consignment number, e-mail address) is transmitted. Processing is based on our legitimate interest in ensuring reliable delivery and transparent information about the shipping status (Art. 6 (1) lit. f GDPR). The data collected for shipment notifications is stored by the provider used by us for a maximum of three months and then anonymised. 

If invoices remain unpaid despite repeated reminders, we may transfer data to debt collection agencies. Furthermore, we may process your data in order to enforce our legal claims. The legal basis is our legitimate interest in the enforcement of legal claims pursuant to Art. 6 (1) lit. f GDPR. 

If you choose an insecure method of payment, such as purchase on account, we may obtain a credit report from credit agencies. For this purpose, we transmit the data required for this (e.g. name, address, date of birth) and receive information on the statistical probability of a payment default (score value). We use this information to decide on the granting of the payment method. The legal basis is our legitimate interest in protecting ourselves against payment defaults (Art. 6 (1) lit. f GDPR). 

We store your data for as long as it is necessary for the fulfilment of the contract. In addition, we store data within the framework of statutory commercial and tax retention periods (Art. 6 (1) lit. c GDPR), which may be up to 10 years. Data that is processed exclusively for the enforcement or defence of legal claims is stored until the expiry of the statutory limitation periods. 

If you have given your consent, information on your orders can be assigned to your profile and processed for personalised product recommendations. You can find more information in the following section. 

4.3 | Customer profile

To improve our customer communication and further develop our offers, we combine existing data of our customers in a profile in order to process the data centrally and consistently so that all necessary data is available at every stage of the customer relationship. 

On this basis, we can understand which contents, products or services are particularly relevant for our customers overall and for the respective individual customer in particular, which interaction has already taken place and adjust our communication and recommendations accordingly.

AI-based systems may also be used in this context, the use of which is, of course, in accordance with applicable laws. 

The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the analysis and targeted design of our customer communication – both individually and in general – as well as in the optimisation of service, marketing and internal business processes. The data is processed for as long as there is a legitimate interest in this processing and then deleted. 

You may object to this processing at any time.

4.4 | Fraud prevention

To secure orders that are placed, we check whether there are any irregularities on the basis of the data arising in the context of an order. In this way we aim to avoid payment defaults and protect our customers from misuse of their personal data. Moreover, we may use data relating to suspicious orders or payments to optimise our systems for detecting fraud cases. The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in fraud prevention as well as in improving this. 

In this context, in particular contract and order data (e.g. purchased item, names, addresses, contact details, payment information) as well as, where available, usage data from your visits to our website (e.g. duration, scope and technical information on the end device) are processed. Cookies or visitor IDs may also be used to recognise end devices with a certain probability on further visits. 

The verification is usually carried out automatically. In the event of suspicion of fraud or misuse, the assessment is reviewed by an employee. If the conclusion of a contract is subsequently refused, we will inform you accordingly. Upon request, we will inform you of the essential reasons for the decision and reconsider your position as part of a renewed human assessment. 

We carry out these measures ourselves or with the support of selected service providers. The data processed in this context is automatically deleted after five months. 

You may object to this processing at any time, for example by e-mail to datenschutz@strauss.de or by post with the additional reference “Datenschutz” (data protection) to:

Strauss Deutschland GmbH & Co. KG
Frankfurter Straße 98-108
63599 Biebergemünd

4.5 | Use of general services and functions

If you use functions and services on our website, we process the personal data required for this purpose in order to provide and enable the respective service (e.g. the use of an individualisation/refinement service which enables products to be provided with a company logo). The specific data processed depends on the relevant function and may include, in particular, contact and communication data, order and product data as well as content/information you transmit in the course of use. The legal basis is our legitimate interest in the provision, implementation and safeguarding of our website services (Art. 6 (1) lit. f GDPR). The data is deleted or anonymised as soon as it is no longer required for the provision of the respective service and there are no statutory retention obligations to the contrary.

4.6 | Additional data processing in the Strauss App

The processing activities described in this data protection notice (e.g. relating to orders or fraud prevention; personalised advertising, use of general services and functions) apply equally when you use the STRAUSS app. 

Moreover, upon installation and use of the app we use the software Google Firebase of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Firebase supports us, on the one hand, in improving the use of the app, for example by analysing crash reports. On the other hand, Firebase determines to what extent and by which user groups certain contents in the app are retrieved. On this basis, we can make the app and its contents more attractive and user-friendly for users. 

For this purpose, Firebase processes technical information on your end device as well as device-specific identifiers (“IDs”), which make it possible to match usage events to a device. The evaluations are carried out in anonymised form, so that no direct conclusions can be drawn about your person. Further information on Google Firebase can be found at: https://firebase.google.com/support/privacy/.

We use this data for the purposes of market research as well as for the user-friendly and needs-based design of the app. The legal basis is Art. 6 (1) lit. f GDPR. 

You may object to the collection and processing at any time by selecting the “Legal” section under the “Settings” menu item, selecting the “Data protection” section and deactivating the “Data processing” switch and thus objecting to the processing of your data by Firebase. 

The data collected in this context is stored for a maximum of 14 months.

5 | Contact

5.1 | Contact enquiries

On our website you have the opportunity to contact us – for example via a contact form provided, by e-mail, telephone, messenger service or via live chat. We process the data transmitted in this context for the purpose of processing your enquiry and optimising our customer service. The legal basis is our legitimate interest in answering enquiries as well as in optimising our customer service pursuant to Art. 6 (1) lit. f GDPR. 

The data is deleted as soon as it is no longer required for communication purposes, unless statutory retention obligations preclude deletion. 

We use various IT systems and providers to process enquiries. In this context, your personal data may potentially be transferred to insecure third countries (e.g. the USA). Such a transfer always takes place on the basis of appropriate agreements and/or measures ensuring an adequate level of data protection. This can be achieved, for example, by an adequacy decision of the EU Commission (e.g. the EU-U.S. Data Privacy Framework) or by the conclusion of standard contractual clauses.

5.2 | Live chat

In addition to conventional contact options, you also have the option of contacting us via a live chat on our website. In order to be able to use this chat, cookies are placed in your browser as soon as you access the chat. The legal basis for placing the cookies is § 25 (2) TDDDG, as the cookies are required for a service or function on the website which you have explicitly requested by clicking. 

Within the framework of the live chat, you are initially connected to a chatbot provided by us which can independently answer general and simple enquiries. To this end, we use an AI-based chatbot. 

If the chatbot cannot resolve your query satisfactorily, you can connect to one of our employees via live chat, who will then process your query. 

The legal basis for the processing of your data via the live chat is our legitimate interest in answering enquiries as well as in optimising our customer service pursuant to Art. 6 (1) lit. f GDPR. 

The data transmitted by you in the framework of the chatbot is stored for as long as is necessary for fulfilling the purposes mentioned above and then deleted or anonymised. 

The live chat and chatbot are operated with the help of the service provider Zendesk (Zendesk Inc., 1019 Market Street in San Francisco, CA 94103 USA). We are aware of the potential transfer of your personal data to the USA. This transfer always takes place on the basis of appropriate safeguards which ensure an adequate level of data protection. This can be achieved, for example, by an adequacy decision of the EU Commission (e.g. the EU-U.S. Data Privacy Framework) or by the conclusion of standard contractual clauses. 

We delete the data collected from you in the course of the live chat as soon as further processing is no longer necessary for the purposes mentioned above. This is usually carried out by anonymising the chat histories. If you place orders or carry out other actions via the live chat which are stored in our customer profiles, the data will be processed in accordance with the usual retention periods for customer data.

5.3 | Applications

If you apply to us, our data protection provisions for applicant data apply.

6 | Marketing

6.1 | Personalisation and optimisation of our marketing experience

We process data relating to your use of our services and your response to marketing activities (e.g. opening/clicks, purchases, feedback) in order to personalise our customers’ marketing experience and continuously optimise our marketing measures. For this purpose, we may use – also by means of data-driven or AI-supported procedures – target group formation, align contents and offers to presumed interests and further develop and improve measures on the basis of results/feedback. The primary goal is to present you with marketing that is actually relevant to you. 

The legal basis for this processing is our legitimate interest in needs-based, efficient marketing and the continuous optimisation of our marketing activities (Art. 6 (1) lit. f GDPR). You may object to this processing at any time.

6.2 | Newsletter

You can subscribe to a free e-mail newsletter on our website. In this case, we use your e-mail address to send you regular information about our offers and services. If you reach our online shop via our newsletter and make a purchase, we process this data in pseudonymised form to optimise our marketing activities. Registration is carried out using the double opt-in procedure. The legal basis for the dispatch is your consent pursuant to Art. 6 (1) lit. a GDPR. You can revoke your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter or via our unsubscribe form in the online shop under “Newsletter”. After you unsubscribe, your e-mail address will be deleted from our newsletter distribution list.

After you have subscribed to the newsletter, you have the option of providing further details about yourself in order to personalise your newsletter and enable us to provide you with a newsletter tailored to your interests. 

Moreover, we may analyse the data you provide and use it to optimise our business processes and newsletter. This processing is based on our legitimate interest in the aforementioned purposes pursuant to Art. 6 (1) lit. f GDPR.

6.3 | Marketing communication

If you have given us the corresponding consent, we will use your contact details to inform you about our products, services or events and to send you satisfaction surveys. Processing is based on your consent pursuant to Art. 6 (1) lit. a GDPR. 

This also includes sending you a link for submitting a rating via the rating platform Trustpilot (Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark). After you have given your consent, we will send you a link to the rating platform and pass on your data (name, e-mail address and reference number) to Trustpilot so that your customer rating can be verified. The terms of use and data protection information of Trustpilot apply.

You can revoke your consent to receiving marketing e-mails at any time with effect for the future, e.g. by notifying us using the contact details mentioned above or via the unsubscribe link in the e-mails.

6.4 | Marketing to customers

We reserve the right to use e-mail addresses which we have received in connection with the sale of goods or services for direct marketing of goods and services that are similar to those that you have already obtained from us. The legal basis in this case is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in conjunction with § 7 (3) UWG (German Act Against Unfair Competition) in carrying out marketing activities towards our existing customers. 

If you make a purchase from us, we use your address data to send you printed marketing materials with information about our products. The legal basis for this is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in carrying out marketing activities towards our existing customers. 

You may object to the use of your data for marketing mailings at any time without incurring any costs other than the transmission costs in accordance with the basic rates. An objection can be made, for example, via the unsubscribe link in every e-mail or by sending an e-mail to datenschutz@strauss.de or by post with the additional reference “Datenschutz” (data protection) to the following address:

Strauss Deutschland GmbH & Co. KG
Frankfurter Straße 98-108
63599 Biebergemünd

If you object, your data will be blocked for marketing purposes in order to prevent us from contacting you again for marketing purposes in the future, e.g. as part of our printed advertising to potential new customers. If you insist on deletion of your data, it is possible that you may be contacted again in the course of our marketing activities towards potential new customers. 

We would like to point out that, in the case of printed advertising, there may be a temporary dispatch of marketing material even after receipt of your objection in exceptional cases. This is technically due to the necessary lead time for selection and printing, and does not mean that we have not implemented your objection.

6.5 | Printed advertising to potential new customers

As part of our marketing activities, we send flyers to potential customers. If you are affected by this, your address data will be processed by us or our service providers. 

For this purpose, we use address data obtained from specialised address dealers, from public directories or from other data providers acting lawfully. In some cases we do not receive any data and your data is processed exclusively by our service provider. Processing serves the purpose of marketing communication to potential new customers. Our legitimate interest lies in carrying out direct marketing. 

You may object to the use of your address data for marketing mailings at any time without incurring any costs other than the transmission costs in accordance with the basic rates. An objection can be made, for example, by sending an e-mail to datenschutz@strauss.de, by telephone or by post with the additional reference “Datenschutz” (data protection) to the following address:

Strauss Deutschland GmbH & Co. KG
Frankfurter Straße 98-108
63599 Biebergemünd

If you object, your data will be blocked for marketing purposes in order to prevent us from contacting you again in the future. If you insist on deletion of your data, it is possible that you may be contacted again in the course of our marketing activities towards potential new customers. 

We would like to point out that, in the case of printed advertising, there may be a temporary dispatch of marketing material even after receipt of your objection in exceptional cases. This is technically due to the necessary lead time for selection and printing, and does not mean that we have not implemented your objection.

6.6 | Promotions, prize draws and events

We regularly carry out promotions, prize draws and events in which you as a customer or prospect can participate. For this purpose, we process the personal data collected from you in the context of registration or participation in order to carry out the respective promotion, prize draw or event. We process your data for performance in accordance with the respective applicable provisions which are communicated to you prior to participation. As a rule, the legal basis for processing your personal data for participation is the performance of the contract concluded with you in this regard in the form of the accepted participation conditions (Art. 6 (1) lit. b GDPR). 

If no contract is concluded with you, we process the data on the basis of our legitimate interest in enabling prospects or customers to participate in the promotion, prize draw or event in accordance with their wishes. Our legitimate interest pursuant to Art. 6 (1) lit. f GDPR consists specifically in carrying out measures for customer retention and increasing our reach. 

If, in the context of implementation, we are required by law to process participants’ personal data, our legal basis is compliance with legal obligations pursuant to Art. 6 (1) lit. c GDPR. 

As a rule, we process your data collected in the context of promotions, prize draws and events for as long as is necessary for implementation and delete the data thereafter, provided that no statutory retention periods preclude deletion. This is generally the case three months after implementation. 

If you have registered for the prize draw using your customer account, we store the associated information under your customer account and customer profile (see in this regard sections 4.1 and 4.3). 

In some cases we may make participation dependent on consent to our newsletter or marketing communication. In this case, please refer to the information on processing your personal data given in sections 6.2 and 6.3 as well as the additional information provided to you in connection with the consent. 

Should we pass on your data to additional third parties in connection with implementation (excluding our service providers that process the data solely on our instructions), we will inform you of this separately prior to registration/participation.