Data protection notice of Strauss France SAS

1 | Controller

The controller responsible for the processing of your personal data (hereinafter: data) is

Strauss France SAS
5 rue de Turbigo
75001 Paris

Further contact details can be found in the legal notice.

2 | Contact details of the Data Protection Officer

If you have any questions, complaints or requests for information regarding data protection, please contact us by e-mail at protectiondonnees@strauss.fr or by post with the additional reference “Datenschutz” (data protection) at the address mentioned above.

You can reach our Data Protection Officer at the following address

Dr. Florian Modlinger
Mitterweg 36a
83233 Bernau a. Chiemsee
Phone: 0176-32572896
Fax: +4932121434755
E-mail: modlinger@strauss.de

3 | General information on our data processing

3.1 | Website

When you access our website, our system automatically collects data and information from the device used to access the site. This includes, among other things, the browser type, the operating system, the IP address, date and time of access, the pages accessed, the previously visited website (referrer) as well as similar technical information. This data is processed in order to deliver the website, to ensure system security and stability and for the purpose of hazard prevention – for example in the event of a cyberattack. No personal evaluation takes place; the data is analysed statistically in anonymised form. The legal basis for this is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in achieving the purposes mentioned above. 

The data is deleted after no more than 30 days; longer storage only takes place in anonymised form. As the collection of this data is absolutely necessary for the operation of the website, there is no possibility to object.

3.2 | CDN und Web Application Firewall

In addition to the general processing activities, we use a content delivery network (CDN) of the service provider “Fastly” (Fastly Inc., 475 Brannan St., Suite 300, San Francisco, CA 94107, USA) on our website. With the help of the CDN, contents of the online offering, such as large media files, graphics or program scripts, can be delivered more quickly and securely via regionally distributed servers connected to the internet. We also use a so-called web application firewall (WAF) from Fastly in order to identify and prevent attacks on our website as quickly as possible. The processing of your personal data in this context is based on our legitimate interest in ensuring and improving the stability and functionality of our website. 

When using Fastly, we are aware of the potential transfer of your personal data to the USA as an insecure third country. In this case, we have ensured by means of appropriate measures that compliance with the European level of data protection is guaranteed. 

Further information on data protection at Fastly can be found at https://www.fastly.com/privacy.

3.3 | Barrier-reduced access

Furthermore, we use the software Eye-Able® of Web Inclusion GmbH on our website in order to ensure barrier-reduced access to information on the internet. The files required for this, such as JavaScript, stylesheets and images, are loaded locally from this website. Eye-Able® uses the browser’s local storage when functions are activated, in order to store the settings. All settings are only stored locally and are not transmitted any further. 

The legal basis for the processing of your personal data in this context is Article 6(1)(f) of the GDPR. We have a legitimate interest in implementing accessibility requirements to the best of our ability. The legal basis for accessing your device and storing data in your browser is Article 82 of the French Data Protection Act of January 6, 1978, No. 78-17, as providing barrier-free access is necessary for the provision of our website in accordance with legal requirements.

Further information on Eye-Able® can be found in the following privacy policy: https://eye-able.com/datenschutz/.

3.4 | Optimisation of business processes

We generally process the data transmitted and collected from you in the course of the processes described below in this data protection notice for the optimisation of our business processes and corporate planning. Where possible, we anonymise the data before further processing. 

In particular, for example, we may process data that we have collected from you in the context of contact and marketing activities for the purpose of optimising our marketing measures and customer service, e.g. to supplement our FAQ page, to optimise our chatbot or to otherwise adapt our customer service to the needs of our customers and prospects. 

Another example of this type of data processing is the processing of data received from our customers in the context of order processes in order to optimise our production and inventory levels in line with the needs of our customers or, in general, to carry out fact-based corporate planning. 

Our legal basis is our legitimate interest in optimising our business processes, in particular our customer services and marketing efforts. You may object to this processing at any time. 

We process your data for these purposes for as long as is necessary to achieve these purposes.

3.5 | General note on the use of AI

In order to carry out internal company processes and achieve the purposes communicated to you, we use AI-based systems in addition to conventional IT systems. In no case does any prohibited automated decision-making within the meaning of Art. 22 GDPR take place. The use of such AI systems is carried out in compliance with the applicable legal requirements.

4 | Customer data processing

4.1 | Registration of a customer account

When you register with us as a customer (via the online store or in person at one of our Workwearstores, pop-up stores, or at trade shows), we process the data you provide (last name, first name, address, shipping and billing addresses, email address, bank details) to create a personal customer account and provide you with the associated features and services. Through your customer account, you can manage and control transactions related to using our online store (for example, view and manage your orders, save your addresses and contact information) as well as take advantage of additional convenience features (such as favorites lists). Certain information is essential for creating a customer account and using basic functions (e.g., login credentials, contact details, delivery and payment information). You may also provide us with optional information, which we process to make using your account more convenient and to optimize our services.

This processing is based on your consent in accordance with Art. 6(1)(a) of the GDPR, which you provide upon registration. You may withdraw this consent at any time with future effect by deleting your customer account or by adjusting your consent in the account settings.

We will delete your customer account as soon as you request its deletion and provided that no legal retention obligations prevent us from doing so. 

4.2 | Orders and contract processing

When you order or purchase products via our website or by any other means, we process the data you provide to us (e.g., name, address, email address, payment details) in order to fulfill or prepare the contract concluded with you. This includes, in particular, order processing, shipping, billing, and payment processing, as well as any subsequent transactions, such as returns, cancellations, exchanges, complaints, and warranty claims. The legal basis for this processing is the performance of the contract pursuant to Article 6(1)(b) of the GDPR.

In connection with orders and the performance of the contract, various technical services may be used to provide you with the best possible shopping experience (e.g., via the online store). To the extent that access to your device is necessary for this purpose, the legal basis is also Article 82(3)(2) of the French Data Protection Act of January 6, 1978, No. 78-17, as this processing is carried out to provide you with the store features you desire. The legal basis for this processing is our legitimate interest in providing you with an optimized shopping experience (for example, through a technically functional and high-performance online store). For order processing, we use service providers, particularly for the transport and delivery of your orders. If you order goods from third-party suppliers through us, we also transfer your data to them to the extent necessary for shipping. The legal basis in each case is Article 6(1)(b) of the GDPR. To ensure the proper delivery of the ordered goods, we may use service providers to monitor shipping and provide delivery notifications. The data necessary for this purpose (e.g., delivery address, order or package number, email address) is then transmitted.

If you order products from third-party suppliers, we also transfer your data to them to the extent necessary for shipping. The legal basis in each case is Article 6(1)(b) of the GDPR. To ensure the proper delivery of the ordered goods, we may engage service providers to monitor the shipment and provide delivery notifications. The data required for this purpose (e.g., delivery address, order or package number, email address) is then transmitted. This processing is based on our legitimate interest in ensuring reliable delivery and transparent information regarding the shipment’s status (Art. 6(1)(f) of the GDPR). The data collected for delivery notifications is retained by the service provider for a maximum of three months and then anonymized.

If invoices remain unpaid despite multiple reminders, we may transfer data to collection agencies. Furthermore, we may process your data to assert our legal rights. The legal basis is our legitimate interest in defending and exercising our rights in accordance with Art. 6(1)(f) of the GDPR.

If you choose a payment method that involves a risk, such as purchase on account, we may request a credit check from credit reporting agencies. For this purpose, we transmit the necessary data (e.g., name, address, date of birth) and receive information regarding the statistical likelihood of default (credit score). We use this information to decide whether to grant the payment method in question. The legal basis is our legitimate interest in protecting ourselves against payment defaults (Art. 6(1)(f) of the GDPR).

We retain your data for as long as necessary to fulfill the contract. Beyond that, we retain the data in accordance with the legal retention obligations under civil, commercial, and tax law (Art. 6(1)(c) of the GDPR), which may extend up to 10 years. Data required solely for the establishment, exercise, or defense of legal claims is retained until the expiration of the statutory limitation periods.

If you have given your consent, information regarding your orders may be linked to your profile and processed to provide you with personalized product recommendations. For more information, please see the following section.

4.3 | Customer profile

To improve our communication with customers and develop our offerings, we consolidate our customers’ existing data into a profile so that we can process this data centrally and uniformly and have all the necessary information at every stage of the customer relationship.

Based on this, we can determine which content, products, or services are particularly relevant to our customers as a whole and to each individual customer, identify which interactions have already taken place, and adapt our communication and recommendations accordingly.

AI-based systems may also be used for this purpose, with their use, of course, in compliance with applicable laws.

The legal basis for this processing is our legitimate interest, within the meaning of Article 6(1)(f) of the GDPR, in the analysis and targeted design of our customer communication - both individual and general - as well as in the optimization of our services, marketing, and internal processes. Your data will be retained for the duration of the business relationship and for a period of 3 years following the end of the business relationship (for example, from the date of a purchase, the expiration date of a warranty, or your last contact with us), after which we will delete or anonymize it. You may object to this processing at any time.

4.4 | Fraud prevention

To secure orders placed, we use the data provided during the order process to check for anomalies. We do this to prevent payment defaults and protect our customers from any misuse of their personal data. Additionally, we may use data related to suspicious orders or payments to optimize our fraud detection systems. The legal basis is our legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in preventing fraud and improving our detection systems.

In this context, we process, in particular, contractual and order data (e.g., the subject of the purchase, names, addresses, contact details, payment information) as well as, where applicable, usage data from your visits to our website (e.g., duration, scope, and technical information about the device). In addition, cookies or visitor identifiers may be used to recognize devices during subsequent visits with a certain degree of probability.

Verification is generally automated. In cases of suspected fraud or abuse, the assessment is reviewed by an employee. If the conclusion of a contract is then refused, we will inform you. Upon request, we will provide you with the essential reasons for this decision and reconsider your perspective as part of a new human review.

We implement these measures ourselves or with the help of selected service providers. The data processed in this context is automatically deleted after five months.

You may object to this processing at any time, for example by sending an email to protectiondonnees@strauss.fr or by including the note “Data Protection” in a letter sent by mail to: Strauss France SAS, 5 rue de Turbigo, 75001 Paris, France.

4.5 | Use of general services and functions

If you use functions and services on our website, we process the personal data required for this purpose in order to provide and enable the respective service (e.g. the use of an individualisation/refinement service which enables products to be provided with a company logo). The specific data processed depends on the relevant function and may include, in particular, contact and communication data, order and product data as well as content/information you transmit in the course of use. The legal basis is our legitimate interest in the provision, implementation and safeguarding of our website services (Art. 6 (1) lit. f GDPR). The data is deleted or anonymised as soon as it is no longer required for the provision of the respective service and there are no statutory retention obligations to the contrary.

5 | Contact

5.1 | Contact enquiries

On our website you have the opportunity to contact us – for example via a contact form provided, by e-mail, telephone, messenger service or via live chat. We process the data transmitted in this context for the purpose of processing your enquiry and optimising our customer service. The legal basis is our legitimate interest in answering enquiries as well as in optimising our customer service pursuant to Art. 6 (1) lit. f GDPR. 

The data is deleted as soon as it is no longer required for communication purposes, unless statutory retention obligations preclude deletion. 

We use various IT systems and providers to process enquiries. In this context, your personal data may potentially be transferred to insecure third countries (e.g. the USA). Such a transfer always takes place on the basis of appropriate agreements and/or measures ensuring an adequate level of data protection. This can be achieved, for example, by an adequacy decision of the EU Commission (e.g. the EU-U.S. Data Privacy Framework) or by the conclusion of standard contractual clauses.

5.2 | Live chat

In addition to the usual contact methods, you also have the option on our website to contact us via live chat. To use this chat feature, cookies are placed in your browser as soon as you start the chat. The legal basis for this placement of cookies is Article 82, Paragraph 3, Item 2 of the French Data Protection Act of January 6, 1978, No. 78-17, as cookies are necessary for the provision of a service or functionality on the website that you have explicitly requested by clicking.

When using the live chat, you are first connected to a chatbot that we provide, which can autonomously respond to general and simple inquiries. We use an AI-based chatbot for this purpose.

If the chatbot is unable to resolve your request to your satisfaction, you can be connected via live chat to one of our employees, who will then handle your request.

The legal basis for processing your data via live chat is our legitimate interest in responding to inquiries and optimizing our customer service in accordance with Art. 6(1)(f) of the GDPR. The data you provide via the chatbot is retained for as long as necessary to fulfill the aforementioned purposes and is then deleted or anonymized. In the event of prolonged inactivity on your part (exceeding 6 months), the conversation is automatically closed and the data is deleted or anonymized.

The live chat and chatbot are implemented with the assistance of the service provider Zendesk (Zendesk Inc., 1019 Market Street, San Francisco, CA 94103, USA). We are aware of the possibility of transferring your personal data to the United States. This transfer is always carried out on the basis of appropriate safeguards ensuring an adequate level of data protection. This may result, in particular, from an adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework) or the conclusion of standard contractual clauses.

We delete the data collected from you via the live chat as soon as it is no longer necessary for the aforementioned purposes. This is generally done by anonymizing the chat histories. If you place orders or perform other actions via the live chat at that are stored in our customer profiles, this data is processed in accordance with the standard retention periods for customer data.

6 | Marketing

6.1 | Personalisation and optimisation of our marketing experience

We process data relating to your use of our services and your response to marketing activities (e.g. opening/clicks, purchases, feedback) in order to personalise our customers’ marketing experience and continuously optimise our marketing measures. For this purpose, we may use – also by means of data-driven or AI-supported procedures – target group formation, align contents and offers to presumed interests and further develop and improve measures on the basis of results/feedback. The primary goal is to present you with marketing that is actually relevant to you. 

The legal basis for this processing is our legitimate interest in needs-based, efficient marketing and the continuous optimisation of our marketing activities (Art. 6 (1) lit. f GDPR). You may object to this processing at any time.

6.2 | Newsletter

You can subscribe to a free e-mail newsletter on our website. In this case, we use your e-mail address to send you regular information about our offers and services. If you reach our online shop via our newsletter and make a purchase, we process this data in pseudonymised form to optimise our marketing activities. Registration is carried out using the double opt-in procedure. The legal basis for the dispatch is your consent pursuant to Art. 6 (1) lit. a GDPR. You can revoke your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter or via our unsubscribe form in the online shop under “Newsletter”. After you unsubscribe, your e-mail address will be deleted from our newsletter distribution list.

After you have subscribed to the newsletter, you have the option of providing further details about yourself in order to personalise your newsletter and enable us to provide you with a newsletter tailored to your interests. 

Moreover, we may analyse the data you provide and use it to optimise our business processes and newsletter. This processing is based on our legitimate interest in the aforementioned purposes pursuant to Art. 6 (1) lit. f GDPR.

6.3 | Marketing communication

If you have given us the corresponding consent, we will use your contact details to inform you about our products, services or events and to send you satisfaction surveys. Processing is based on your consent pursuant to Art. 6 (1) lit. a GDPR. 

This also includes sending you a link for submitting a rating via the rating platform Trustpilot (Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark). After you have given your consent, we will send you a link to the rating platform and pass on your data (name, e-mail address and reference number) to Trustpilot so that your customer rating can be verified. The terms of use and data protection information of Trustpilot apply.

You can revoke your consent to receiving marketing e-mails at any time with effect for the future, e.g. by notifying us using the contact details mentioned above or via the unsubscribe link in the e-mails.

6.4 | Marketing to customers

We reserve the right to use e-mail addresses which we have received in connection with the sale of goods or services for direct marketing of goods and services that are similar to those that you have already obtained from us. The legal basis in this case is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in conjunction with § 7 (3) UWG (German Act Against Unfair Competition) in carrying out marketing activities towards our existing customers. 

If you make a purchase from us, we use your address data to send you printed marketing materials with information about our products. The legal basis for this is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in carrying out marketing activities towards our existing customers. 

You may object to the use of your data for marketing mailings at any time without incurring any costs other than the transmission costs in accordance with the basic rates. An objection can be made, for example, via the unsubscribe link in every e-mail or by sending an e-mail to datenschutz@strauss.de or by post with the additional reference “Datenschutz” (data protection) to the following address:

Strauss France SAS
5 rue de Turbigo
75001 Paris

If you object, your data will be blocked for marketing purposes in order to prevent us from contacting you again for marketing purposes in the future, e.g. as part of our printed advertising to potential new customers. If you insist on deletion of your data, it is possible that you may be contacted again in the course of our marketing activities towards potential new customers. 

We would like to point out that, in the case of printed advertising, there may be a temporary dispatch of marketing material even after receipt of your objection in exceptional cases. This is technically due to the necessary lead time for selection and printing, and does not mean that we have not implemented your objection.

6.5 | Printed advertising to potential new customers

As part of our marketing activities, we send flyers to potential customers. If you are affected by this, your address data will be processed by us or our service providers. 

For this purpose, we use address data obtained from specialised address dealers, from public directories or from other data providers acting lawfully. In some cases we do not receive any data and your data is processed exclusively by our service provider. Processing serves the purpose of marketing communication to potential new customers. Our legitimate interest lies in carrying out direct marketing. 

You may object to the use of your address data for marketing mailings at any time without incurring any costs other than the transmission costs in accordance with the basic rates. An objection can be made, for example, by sending an e-mail to datenschutz@strauss.de, by telephone or by post with the additional reference “Datenschutz” (data protection) to the following address:

Strauss France SAS
5 rue de Turbigo
75001 Paris

If you object, your data will be blocked for marketing purposes in order to prevent us from contacting you again in the future. If you insist on deletion of your data, it is possible that you may be contacted again in the course of our marketing activities towards potential new customers. 

We would like to point out that, in the case of printed advertising, there may be a temporary dispatch of marketing material even after receipt of your objection in exceptional cases. This is technically due to the necessary lead time for selection and printing, and does not mean that we have not implemented your objection.

6.6 | Promotions, prize draws and events

We regularly carry out promotions, prize draws and events in which you as a customer or prospect can participate. For this purpose, we process the personal data collected from you in the context of registration or participation in order to carry out the respective promotion, prize draw or event. We process your data for performance in accordance with the respective applicable provisions which are communicated to you prior to participation. As a rule, the legal basis for processing your personal data for participation is the performance of the contract concluded with you in this regard in the form of the accepted participation conditions (Art. 6 (1) lit. b GDPR). 

If no contract is concluded with you, we process the data on the basis of our legitimate interest in enabling prospects or customers to participate in the promotion, prize draw or event in accordance with their wishes. Our legitimate interest pursuant to Art. 6 (1) lit. f GDPR consists specifically in carrying out measures for customer retention and increasing our reach. 

If, in the context of implementation, we are required by law to process participants’ personal data, our legal basis is compliance with legal obligations pursuant to Art. 6 (1) lit. c GDPR. 

As a rule, we process your data collected in the context of promotions, prize draws and events for as long as is necessary for implementation and delete the data thereafter, provided that no statutory retention periods preclude deletion. This is generally the case three months after implementation. 

If you have registered for the prize draw using your customer account, we store the associated information under your customer account and customer profile (see in this regard sections 4.1 and 4.3). 

In some cases we may make participation dependent on consent to our newsletter or marketing communication. In this case, please refer to the information on processing your personal data given in sections 6.2 and 6.3 as well as the additional information provided to you in connection with the consent. 

Should we pass on your data to additional third parties in connection with implementation (excluding our service providers that process the data solely on our instructions), we will inform you of this separately prior to registration/participation.