Data protection information

5.1    Candidate profile
When you submit your application, we create a candidate profile for you, or you can create one yourself via our website under “View Profile” In your profile, you can manage your data and set up a job alert. To register, enter your email address in the designated registration field. You will then receive a one-time access link to your candidate profile at your email address. Alternatively, your email address, together with registration via one of our registration service providers (Google, LinkedIn, Microsoft, and Apple), serves as your login and identification for your candidate profile. In the case of applications submitted via email or mail, or if your application is sent to us by a third party, we will create a candidate profile for you, as we will transfer your application documents into our online application system. Provided you have provided us with a valid email address, you will automatically receive access via the login methods mentioned above. The legal basis for the data processing described is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

5.2    Job ticker
You can also create a Job ticker to receive notifications about open positions at REWE Group companies that match your interests. Creating a candidate profile is not required to set up a Job ticker. You can change, update, or delete this information and your Job tickers at any time, or deactivate your Job tickers. The legal basis for the data processing described is Article 6(1)(a) of the GDPR (consent).

5.3    Information about the company and invitations to events
You can receive current information about the company as well as invitations to events. The companies of the REWE Group (a list of companies can be found at https://hr.rewe-group.com/PRIMUS/Recruiting/Dokumente/datenschutzhinweise_firmierungen.pdf) will send you content via email on current career topics (e.g., information on departments/topics, entry-level opportunities within the Group, as well as announcements and invitations to events). Based on your candidate profile, the email notifications are tailored to you personally. You can revoke your consent to receive personalized career information at any time in your candidate profile under the “Personal Data” tab in the “Consents” section. The legal basis for the described data processing is Art. 6(1)(a) GDPR (consent).

5.4    Conduct of application procedures
You have the option to apply for a posted job or submit a speculative application through various channels. The online application system is available for this purpose. Your data and any attached files are transmitted via an encrypted connection. Your data is received by the Human Resources department and forwarded to the relevant department responsible for the advertised job or to the individuals entrusted with handling the application process. The same applies if you send us an application via email or mail. All parties involved will treat your application documents with the necessary care and confidentiality.

For selected jobs, we offer you the option to apply via WhatsApp (WhatsApp Ireland Limited) or chat. In these cases, we enter the information you provide there into our applicant tracking system and create a candidate profile and an application. We also use WhatsApp to communicate with you regarding your application, e.g., to provide information about your application status, send interim notifications and invitations, or request additional application documents. If you apply via WhatsApp or chat, we save the information provided during the chat in text logs, which we attach to your application.

If you apply in person directly at one of our stores or in logistics (so-called direct hiring), the aforementioned responsible parties will, in the event of direct hiring, collect personal information from you such as your name, address, date of birth, and contact details, as well as, if applicable, additional information such as bank details, tax and social security numbers, health insurance, number of children, details regarding secondary employment, work permit, and residence permit.

If you applied via WhatsApp or chat or were hired directly and provided us with your email address, we will send you a corresponding message with access to your candidate profile so that you can provide additional personal information (not related to the application you have already submitted). For more information about data processing by WhatsApp as a telecommunications service, over which we have no further influence, please visit https://www.whatsapp.com/legal/privacy-policy-eea.

We process the data you send us in connection with an application to assess your suitability for the job (or, if applicable, other open positions within the REWE Group company to which you are applying or submitting a speculative application) and to conduct the application process. The legal basis for the described data processing is Art. 6(1)(b) GDPR and § 26(1) BDSG (decision regarding the establishment of an employment relationship).

The legal basis for applying via WhatsApp and the transfer of data to WhatsApp and companies affiliated with WhatsApp in a third country is Art. 6(1)(a) in conjunction with Art. 49(1)(a) of the GDPR (your consent to participate in messenger communication and use the WhatsApp service, as well as the transfer to a third country).

If we enter into an employment contract with you, we will continue to process your data for the purposes of the employment relationship if this is necessary for its performance or termination. The legal bases for the described data processing are Art. 6(1)(b) GDPR and § 26(1) BDSG (performance of the employment relationship).

5.5    Conducting aptitude or hiring tests
As part of your application, we may invite you to undergo an aptitude assessment or participate in an assessment center to determine your suitability for the target position. For this process, we process the following data from you: Last name, first name, date of birth, email address, competency-based evaluations by observers relevant to the position, a report on observed behavior including a recommendation for hiring, as well as results from digital self-assessments and performance tests. The legal basis for conducting these procedures is Article 6(1)(b) (pre-contractual measures).

If we enter into an employment contract with you, we will continue to process your data for the purposes of the employment relationship if this is necessary for its establishment, performance, or termination. The legal bases for the described data processing are Article 6(1)(b) of the GDPR and Section 26(1) of the BDSG (execution of the employment relationship).

5.6    Application via an external platform
You have the option to apply for jobs at REWE Group companies via external platforms. The operator of the respective platform is responsible for data protection. As soon as your application documents have been transmitted from there to the relevant REWE Group company where the job you applied for is advertised, your application documents and data will be processed as part of our standard application processes. The processing serves exclusively the purpose of reviewing the application documents for the specific advertised job as part of our application process. The relevant REWE Group company, possibly in conjunction with the recruiting department of REWE Deutscher Supermarkt AG & Co. KGaA, is solely responsible for this process.

For some apprenticeship and dual study programs, we offer you the option to apply via the DEIN ERSTER TAG JobApp (Studio2B GmbH) or the external platform of Jobflow GmbH.

Otherwise, these are external platforms operated by HeyJobs GmbH, The Stepstone Group Deutschland GmbH, and Indeed Deutschland GmbH.

The legal basis for this data processing is Art. 6(1)(b) GDPR (implementation of pre-contractual measures regarding a potential employment relationship).

As part of the application process via the external platform of The Stepstone Group Deutschland GmbH, the application documents you submit are automatically matched against our requirements for the respective job posting. Based on this, a match score is determined, which describes the extent to which your application profile meets the job requirements. The processing serves exclusively to support and structure the application process. There is no exclusively automated decision-making in the sense of profiling pursuant to Art. 22 GDPR. The review and management of the application process is always carried out by our recruiters.

The legal basis for this data processing is Article 6(1)(b) of the GDPR (implementation of pre-contractual measures regarding a potential employment relationship).

We automatically notify Indeed Deutschland GmbH of the current processing status of applications submitted to us via the Indeed Deutschland GmbH platform. This transmission is carried out solely for the purpose of enabling Indeed to provide aggregated feedback on the effectiveness and quality of the application processes on the platform.

The legal basis for this data processing is Article 6(1)(f) of the GDPR (our legitimate interest in continuously optimizing and further developing the application process to make it more efficient and effective for applicants who apply via external platforms and for our recruiting, and to improve hiring rates).

To the extent that your application documents and data have been transmitted via the platforms of HeyJobs GmbH or The Stepstone Group Deutschland GmbH, we provide HeyJobs GmbH or The Stepstone Group Deutschland GmbH with daily updates on the status of the respective application. We are jointly responsible with HeyJobs GmbH or The Stepstone Group Deutschland GmbH for this transmitted information and the objectives pursued thereby. The key agreements and division of data protection obligations can be found here:

• https://hr.rewe-group.com/PRIMUS/Recruiting/Dokumente/datenschutzhinweise_verantwortlichkeit_heyjobs.pdf 
• https://hr.rewe-group.com/PRIMUS/Recruiting/Dokumente/datenschutzhinweise_verantwortlichkeit_stepstone.pdf

Our goal is to make the application process more efficient and effective. We intend to use insights from application statuses to adapt and further develop the application process on external platforms and within REWE Recruiting, in order to create increasingly relevant job postings and application questions that lead to higher hiring rates. The legal basis for this data processing is Art. 6(1)(f) GDPR (our legitimate interest in making the application process more efficient to achieve higher hiring rates for applicants and recruiters).

5.7    Defense against legal claims
We process your data from the application process, as well as from your candidate profile settings and consent forms, to the extent and for as long as this is necessary to defend against legal claims arising from the application process. The legal basis for this is Art. 6(1)(f) GDPR (balancing of interests, based on the interest of the REWE Group company to which you are applying for a job or submitting a speculative application in being able to defend against claims in proceedings under the General Equal Treatment Act).

5.8    Candidate pool
If your application does not match the job’s required profile but appears suitable for other jobs, you may consent to being included in our candidate pool.

If you consent to being included in our candidate pool, your data from the candidate profile (5.1) and from specific application processes (5.4) will also be processed by other REWE Group companies for their recruitment processes. The storage period will not be extended. The REWE Group companies are those listed at https://hr.rewe-group.com/PRIMUS/Recruiting/Dokumente/datenschutzhinweise_firmierungen.pdf.

This allows recruiters, as long as the data is stored with us, to contact you with new job openings from REWE Group companies that match your personal qualifications and interests. You will only be considered for such a new application process with your consent. You can edit, change, or delete the information you have provided at any time. Your consent to be included in the candidate pool remains valid as long as your candidate profile (see 5.1) exists. However, you have the option to withdraw your consent at any time by unchecking the box labeled “Accept entry into the candidate pool” under “Consents” in the “Personal data” tab of your candidate profile in our online application system. The legal basis for the data processing described is Art. 6(1)(a) GDPR (consent).

5.9    Candidate Survey
To ensure the quality of our application process in the long term and to improve it, we contact selected applicants after the application process has concluded to survey them about the application process. Applicants will be contacted by us shortly after the application process has concluded. The results of the survey are stored without personal references.

We automatically survey candidates using the contact information in their candidate profiles based on the consent they have provided. The legal basis for this survey is Article 6(1)(a) of the GDPR (consent).

You may revoke your consent to the surveys regarding the application process at any time in your candidate profile under “Privacy Policy”.

In addition, we manually send invitations to selected candidates via external portals to evaluate the application process of REWE Group companies; these invitations are sent by the individuals involved in the application process. The legal basis for this survey is Article 6(1)(f) of the GDPR (legitimate interests). We consider our legitimate interests to be the desire to continuously improve the application process and enhance our public image on business and job application platforms. Since we send out these surveys only in close temporal connection with the application process and only once per process, without any obligation to respond , we do not see any interests on the part of the respective applicant that would conflict with our surveys.

5.10    Contact
If you contact us via our application hotline or by email at bewerbung@rewe-group.com, we process the data you provide to us when making contact (name, address, email address, and/or phone number, information regarding the specific inquiry, including the job ID if you are contacting us about a specific job posting). We process this data to handle and respond to your inquiry and, if necessary, forward the inquiry to the appropriate department within our company. If you have questions regarding a specific application or a job posting, we may forward your inquiry to the relevant departments within the respective companies of the REWE Group. The legal basis for the described data processing is Art. 6(1)(b) GDPR (pre-contractual measures and/or performance of a contract) and/or Art. 6(1) sentence 1(f) GDPR (balancing of interests, based on our legitimate interest in reviewing inquiries from applicants and other individuals, forwarding them to the relevant internal department for clarification, and, if this is not done by the relevant internal department, responding to them).

If you contact us by phone, you will be informed before the call that we would like to record the conversation for training purposes. We will only record the call if you consent to such recording. The legal basis for recording our phone call is your consent pursuant to Art. 6(1)(a) GDPR.

5.11    Web server logs
When you visit our websites, we process the connection data of the requesting computer—including the IP address, the pages you visit on our site, the date and duration of the visit, the identification data of the browser and operating system type used, and the website from which you visit us—as a standard measure to ensure the security of our IT systems. The legal basis for the described data processing is Art. 6(1)(f) GDPR (balancing of interests, based on our interest in ensuring the security of IT systems).

We also convert the IP address transmitted by your computer into geocoordinates and determine your approximate location. Your exact location is not determined. We process this data to compile statistics on how our website is used and to measure the success of our employer advertising campaigns in specific regions. The legal basis for the data processing described is Article 6(1)(f) of the GDPR (balancing of interests, based on our interest in measuring the success of employer advertising campaigns).

5.12    Cookies and other technologies (website analysis/tracking)
We use cookies and other technologies in certain areas of our website, e.g., to identify visitors’ preferences and optimize the website accordingly. This facilitates navigation and ensures a high level of user-friendliness. Cookies and other technologies help us identify particularly popular sections of our website.

Cookies are small text files that are stored on the hard drive of your device. They allow us to retain information over a certain period of time and to identify your device. We use persistent cookies to improve user guidance and provide personalized content. We also use so-called session cookies, which are automatically deleted when you close your browser. You can configure your browser to notify you when cookies are placed. This makes the use of cookies on transparent to you. Important: If you completely disable cookies, you may not be able to use certain features of our website.

We distinguish between necessary, statistical, and marketing cookies depending on the purpose of the cookies and other technologies.

Essential cookies and other technologies are necessary to ensure core website functions as well as the fulfillment of contractual obligations toward customers and partners. Their use is based on the legal grounds of Section 25(2)(2) TDDDG in conjunction with Article 6(1)(b) (contract initiation or fulfillment) and letter f) of the General Data Protection Regulation (overriding legitimate interests). The latter interests include, in particular, monitoring the technical performance of the website. Therefore, they cannot be deactivated by you as a website user via our Consent Management System.

All cookies and other technologies are described in detail in the cookie banner under “Services”. You can view this at any time in the “Privacy Settings” in the website footer or click here.

Statistical cookies and other technologies are necessary to understand how our visitors use our portal, to identify errors, and to continuously improve the portal. They are used on the legal basis of § 25(1) TDDDG (consent for setting or reading cookies) in conjunction with Art. 6(1)(a) GDPR (consent for the subsequent data processing). Data processing begins only after you have provided the corresponding opt-in (consent). You may revoke your consent to data processing at any time with future effect. The revocation does not affect the lawfulness of the data processing carried out prior to the revocation.

All cookies and other technologies are described in detail in the so-called cookie banner under the Services. You can view these at any time in the “Privacy Settings” in the footer of the website or click directly here.

You can also withdraw your consent at any time in the “Privacy Settings”.

Marketing cookies and other technologies are used to understand your interests and to be able to display personalized content that is relevant to you. Their use is based on the legal grounds of § 25(1) TDDDG (consent for the setting or reading of cookies) in conjunction with Art. 6(1)(a) GDPR (consent for the subsequent data processing). Data processing only begins once you have provided the corresponding opt-in. You may revoke your consent to data processing at any time with future effect. The revocation does not affect the lawfulness of the data processing carried out prior to the revocation.

All cookies and other technologies are described in detail in the so-called cookie banner under the Services. You can view these at any time in the “Privacy Settings” in the footer of the website or click directly here.

You can also withdraw your consent at any time in the “Privacy Settings”.

5.13    Redirection to social media services
On our website, you will find links to the social media services of Facebook, Twitter, Xing, LinkedIn, YouTube, and Instagram. You can recognize links to the websites of these social media services by the respective company logo. If you follow these links, you will be directed to the REWE Group’s page on the respective social media service. When you click a link to a social media service, a connection is established with the servers of that social media service. This transmits information to the social media service’s servers indicating that you have visited our website. No further information is transmitted to the servers of the social media services.

If you are already logged in to the relevant social media service when you activate the link, the provider of the social media service may be able to determine your username and, in some cases, even your real name from the transmitted data and associate this information with your personal user account on the social media service. You can prevent this association with your personal user account by logging out of your user account beforehand.

The servers of the social media services may be located in the United States and other countries outside the European Union. The data may therefore also be processed by the social media service provider in countries outside the European Union. Please note that companies in these countries are subject to data protection laws that generally do not protect personal data to the same extent as is the case in the member states of the European Union.

We have no influence over the scope, nature, or purpose of data processing by the social media service provider. For more information on how your data is used by the social media services integrated into our website, please refer to the privacy policy of the respective social media service.

5.14    Social sharing function
We use plugins from the Pentos service (Pentos AG, Landsberger Str. 110, 80339 Munich) on our website. The social sharing function is intended to make it easier for website visitors to share the job postings on our website with other internet users via email or on social networks. The legal basis is Art. 6(1)(f) GDPR (our interest in optimizing the use of our website and increasing its reach). No cookies or similar technologies are set when using the social sharing buttons.

The plugins establish a connection to Pentos servers. You can recognize the plugins by the integrated buttons for sharing via “Email”, “WhatsApp”, “LinkedIn”, “Xing” and “Facebook”. When you use the social sharing buttons, your web browser establishes a direct connection to the selected social network. If you share content from our website on social networks, a connection may be established between your visit to the website and your user profile on the respective social network. No personal data is processed or stored at any time in connection with the Pentos servers or on the Pentos servers.

5.15    YouTube, Vimeo and whatchado
Our website uses plugins from the video platforms YouTube and Vimeo. The providers are YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA and Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.

Data processing by us:
The data you enter on YouTube, such as comments, likes, and the share function, etc., is published by YouTube and is never used or processed by us for any other purpose. We reserve the right to delete content only if necessary. We may share your content on our site if this is a feature of the social media platform and communicate with you via the social media platform. The legal basis is Art. 6(1)(a) GDPR (consent). Further information on the privacy policies applicable to YouTube/Google can be found at https://policies.google.com/privacy?hl=de.

When you visit one of our pages equipped with a Vimeo plugin, a connection is established to the Vimeo servers. In doing so, the Vimeo server is informed which of our pages you have visited. Additionally, Vimeo obtains your IP address. This applies even if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the United States after you have given your consent. The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR (consent). If you are logged into your Vimeo account, you allow Vimeo to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your Vimeo account. You have the right to object at any time for reasons arising from your particular situation. Further information on the handling of user data can be found in Vimeo’s privacy policy at: https://vimeo.com/privacy. Vimeo Inc. is also certified under the EU-US and Swiss-US Privacy Shield frameworks. Further information can be found at https://vimeo.com/de.

If you submit a request to us via a social media platform, we may, depending on the nature of the response required, also direct you to other secure communication channels that guarantee confidentiality. You always have the option of sending confidential inquiries to the address listed under “Data Controller”.

You can configure your browser to notify you of the use of cookies and, if necessary, prevent cookies from being set.

Data processing by "YouTube":
It cannot be ruled out that web tracking methods are used on YouTube. Web tracking may occur regardless of whether you are logged in or registered with YouTube. Unfortunately, we have no influence over YouTube’s web tracking methods. Please be aware: It cannot be ruled out that your profile and behavioral data may be used on YouTube, for example to analyze your habits, personal relationships, preferences, etc. We have no influence whatsoever on the processing of your data by YouTube. For more information on data processing by YouTube, please refer to their privacy policy at https://policies.google.com/privacy?hl=de.

Our website also uses plugins from the career guidance platform whatchado GmbH, Möllwaldplatz 4/39, 1040 Vienna, Austria. We do not process any personal data in this context. For more information on data processing by whatchado, please refer to their privacy policy at https://www.whatchado.com/de/terms/users/.

5.16    Use of Google Maps
For the job search, we also use map data from Google Maps (Google Inc.) to display job openings on an interactive map. As a result, information about the use of our job search, including your IP address, is transmitted to Google servers in the United States and stored there. This means that Google may store cookies on your computer as soon as you use the job search.

When you visit a page on our website that contains Google Maps, your browser may establish a direct connection to Google’s servers after you have given your consent. The map content is then transmitted directly from Google to your browser and integrated into the webpage. We have no influence over the data transmitted in this way or the scope determined by Google. You can find more information about this in Google’s Privacy policy: https://policies.google.com/privacy?hl=de.

In your browser settings, you can specify whether the described cookies may be set by Google or not. Therefore, as a user, you also have full control over the use of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically.

We process the data provided to us on the basis of Article 6(1)(a) of the GDPR (consent). If you leave the job search page and delete the cookies, the collection of information will cease immediately.

5.17    Campaign performance measurement
To measure the success of our campaigns on the job portals we use (e.g., StepStone), we collect, on a one-time basis, information regarding which job portal applicants accessed the online application system from by clicking on a specific job posting. For this purpose, we include the so-called “source” in the specific URL of the job posting.

The legal basis for measuring campaign success is Article 6(1)(f) of the General Data Protection Regulation (overriding legitimate interest in measuring the effectiveness of campaigns on job portals).