Data protection

I. Contact

These instructions apply to data processing by:

Dress-for-less GmbH
Mönchhofallee 1
65451 Kelsterbach
Germany
Email: info@dress-for-less.de
Phone: +49 (0) 61 42 83 54 400
https://www.dress-for-less.de

The data-protection officer of Dress-for-less is Prof. Dr. Thomas Jäschke
Data Tree AG
Heubesstraße 10
40597 Düsseldorf
Email: dsb@datatree.eu
Phone: +49 211 93190-798
Fax: +49 211 93190-799
www.datatree.eu

II. Processing of personal data; nature and purpose

1. Web hosting

We use the e-commerce solution "salesforce Commerce Cloud" for the provision and operation of our website. The provider of salesforce Commerce Cloud is salesforce.com inc., 415 Mission Street, 3rd Floor, San Francisco CA 64105, USA (hereinafter referred to as "salesforce"). In the context of this agreement, this website is hosted on salesforce's servers.

In connection with hosting and maintaining the website, salesforce processes personal information on our behalf that arises from the following actions by the user:

• visiting the website;
• ordering as a guest;
• placing an order as an existing customer;
• creating a customer account;
• registering for the newsletter;
• using the contact form.

This personal information is transferred to salesforce's servers located in the United States. Salesforce guarantees that it complies with the European Union's Privacy Shield certification for processing data in the United States (https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/privacy-shield-notice.pdf). In addition, salesforce has implemented "Binding Corporate Rules" for compliance with data protection.

With respect to the data processing that takes place in the context of the hosting of our website, we have entered into a "Data Processing Addendum (DPA)" with salesforce. This DPA includes the "EU Standard Contractual Clauses". Through this contract, salesforce assures that the data is processed at our direction and in accordance with the requirements of the GDPR.

Salesforce has been certified in accordance with reliable security standards, in particular ISO 27001/27017/27018, PCI DSS and SOC 1/2/3. Comprehensive details on how Salesforce implements data protection and data security can be found here:

• https://www.salesforce.com/privacy/regions/
• https://trust.salesforce.com/en/trust-and-compliance-documentation/commerce-cloud/

The commissioning of salesforce and the associated data processing are based on our legitimate interest (Art. 6(1)(f), GDPR) in making our offering available on this website and in entrusting a professional service provider with high security standards for this provision.

2. When visiting our website

When you visit our website https://www.dress-for-less.de, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected and stored without your intervention and deleted from the log files after 90 days:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the retrieved file,
• website from which the access takes place (referrer URL),
• operating system of the requesting computer,
• browser type and version and other information transmitted by the browser (such as your computer's operating system),
• performance and system data.

We process the data mentioned above for the following purposes:

• to ensure a smooth connection to the website,
• to ensure comfortable use of our website,
• for the evaluation of system security and stability,
• to detect and prevent attacks on our website,
• for continuous improvement of the website and
• for other statistical and administrative purposes.

The legal basis for the data processing is Art. 6(1)(f) of the GDPR. Our legitimate interest follows from the above listed purposes of data processing. In the event of an attack on our network infrastructure, we will evaluate your IP address to assert or defend legal claims. Furthermore, we use cookies and analysis services when you visit our website. You will find more detailed explanations on this under points IV and V of this data-protection statement.

3. In the context of an order in our online shop

If you wish to order products via our website as a guest or as a registered customer, we process the following mandatory information:

• salutation, first name, last name,
• a valid email address,
• invoice and delivery address
• depending on the payment method you have selected, payment data (such as bank details)

The processing of this data is carried out:

• to be able to identify you as our contractual partner;
• to check the entered data for plausibility;
• for payment processing and shipping your order;
• if necessary for the personalisation of advertising;
• for the settlement of any warranty claims that may exist and the assertion of any claims against you.

The data processing is carried out at your request and is required in accordance with Art. 6(1)(b) and (f) of the GDPR for the purposes mentioned for the fulfilment of the contract and for other pre-contractual measures as well as for our legitimate interests.

The personal data processed by us for the order will be stored until the expiry of the statutory warranty period and automatically deleted thereafter, unless we are obliged to store the data for a longer period of time in accordance with Art. 6(1)(c) of the GDPR due to storage and documentation obligations pursuant to tax and commercial law (from the German Commercial Code (HGB), German Penal Code (StGB) or German Tax Code (AO)) or you have consented to storage beyond this in accordance with Art. 6(1)(a) of the GDPR.

4. When creating a customer account

We offer you the possibility to create a customer account with us. For the registration and the creation of the customer account we need the following mandatory information:

• salutation, first name, last name,
• a valid email address,
• invoice and delivery address
• password

In addition, you can voluntarily provide further information.

The processing of this data is carried out:

• to be able to identify you as our customer;
• to check the entered data for plausibility;
• for the personalisation of advertising measures;
• for the settlement of any warranty claims that may exist and the assertion of any claims against you.

We work with

Emarsys eMarketing Systems AG Hans-Fischer-Straße 10, 80339 Munich, Germany (hereinafter referred to as "Emarsys") as a specialised service provider for Customer Relation Management for documentation, administration and marketing purposes, to whom we transfer your data (email address, first name, last name, gender, purchase history, postal address). This service provider has been selected and commissioned by us, is bound by our instructions and is regularly inspected, particularly with regard to the appropriate technical and organisational measures for data security. Data will not be transferred to non-EEA countries.

The data processing is carried out at your request and is required in accordance with Art. 6(1)(b) and (f) of the GDPR for the purposes mentioned for the fulfilment of the contract and for other pre-contractual measures as well as on the basis of our legitimate interests.

The personal data processed by us for the order will be stored until the expiry of the statutory warranty period and automatically deleted thereafter, unless we are obliged to store the data for a longer period of time in accordance with Art. 6(1)(c) of the GDPR due to storage and documentation obligations pursuant to tax and commercial law (from the German Commercial Code (HGB), German Penal Code (StGB) or German Tax Code (AO)) or you have consented to storage beyond this in accordance with Art. 6(1)(a) of the GDPR.

5. In connection with our newsletters

We would like to send you, as a customer or interested party, our newsletter. If you place an order with us as a guest or registered customer, we will send you our newsletter on the basis of Art. 6(1)(f) of the GDPR in conjunction with Section 7(3) of the German Fair Trade Practices Act (UWG) and our legitimate interest in informing you about current product recommendations for you (direct marketing). In addition, you have the opportunity to register with us as a newsletter customer and to receive our newsletter at a frequency of your choice. In order to register you as a newsletter subscriber and to send you the newsletter, we need your email address as well as title, first and last name, so that we can address you personally. We will send you the newsletter on the basis of your explicit consent (Art. 6(1)(a) of the GDPR).

The so-called Double-Opt-in procedure is used for subscription to the newsletter. This means that after your subscription, we will send you an email on the email address you have provided, in which we ask you to confirm that you wish to receive the newsletter. This confirmation is necessary in order to avoid the possibility that someone in possession of others’ email addresses can subscribe them to the newsletter. If you do not confirm your subscription within 24 hours, your information will be blocked and automatically deleted after one month. Furthermore, we store your IP address and the time of subscription and confirmation. The purpose of the procedure is to be able to prove your subscription and, if necessary, to clarify possible misuse of your personal data; the logging of the subscription procedure is our legitimate interest in accordance with Art. 6(1)(f) of the GDPR.

For personalisation of the newsletter, we use the following specialised service providers, to whom we transmit the necessary personal data (email address) as well as data concerning your orders with us:

Emarsys eMarketing Systems AG
Hans-Fischer-Straße 10
80339 Munich, Germany
(hereinafter referred to as "Emarsys")

Emarsys enables us to measure and evaluate the behaviour of our customer newsletter recipients. This includes the opening, click, bounce, delivery, unsubscribe and conversion rates. The evaluation is also carried out using cookies or pixel tags, which collect information such as the IP address, browser type/version, email client and time of retrieval. In this way it is also possible to track who opens the email and clicks on the links contained therein. The evaluation of user behaviour is carried out for the purpose of identifying reading habits and aligning content accordingly, measuring the success of email campaigns and improving ourselves, particularly to present you with relevant and targeted offers based on your interests. Data is not transferred to countries outside the EEA.

You can object to the personalisation of our newsletter at any time by sending us an email on service@dress-for-less.de. If you do so, we will no longer personalise it, but we may continue to send you our general newsletter.

In addition, it is also possible to completely unsubscribe from our newsletters at any time, e.g. via a link at the end of each newsletter. Alternatively, you are welcome to send your unsubscription request at any time by email on service@dress-for-less.de. Your personal data processed in this context and exclusively for the purpose of sending you the newsletter will be deleted immediately after unsubscription, but we will keep the fact that you have objected and your email address so that we do not send you newsletters in the future by mistake.

III. Transfer of data to third parties

Your personal data will be passed on to third parties, in particular to the extent permitted by law and in accordance with Art. 6(1)(b) of the GDPR for the processing of contractual relationships with you.

1. For payment processing

This includes the transfer of payment data to payment service providers or credit institutions in order to execute a payment transaction. Within the scope of fulfilling the contract in accordance with Art. 6(1)(b) of the GDPR, we use the following payment service providers for payment processing:

• SIX Payment Services GmbH, Langenhorner Chaussee 92-94, 22415 Hamburg
• Klarna GmbH, Theresienhöhe 12, 80339 Munich
• Sofort GmbH, Theresienhöhe 12, 80339 Munich
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
• Six Payments Services (Europe) S.A., 10, rue Gabriel Lippmann, L-5365 Munsbach
• American Express Payment Services Limited, Belgrave House, 76 Buckingham Palace Road, London, SW1W 9AX, United Kingdom
• American Express Payment Services Limited, PO Box 11 01 01, 60036 Frankfurt

For processing, it may be necessary for us to forward the personal data collected in the payment process, such as name, address, telephone number, email address, credit-card or bank-account data and transaction data to the payment service provider. In some cases, the payment service providers also collect this data themselves, and the data passed on may be used by the third party exclusively for the purposes mentioned.

You will find further information on our "Payment method" page.

2. For shipping your order

In order to be able to dispatch your order from our shop (Art. 6(1)(b) of the GDPR) as well as due to our legitimate interest in making the dispatch as uncomplicated as possible for you (Art. 6(1)(f) of the GDPR), we transmit your provided data, such as a delivery address to postal service providers who transport your consignment, exclusively for the purpose of delivering goods and announcing the delivery of goods. These service providers are subject to postal secrecy.

3. For internal administrative and promotional purposes

We are a majority-owned company of SIGNA Retail GmbH and part of the SIGNA Retail group of companies. As such, we sometimes make personal data (pseudonymised user profiles) available within the framework of a contractual relationship for

SIGNA Retail GmbH,
Freyung 3.
1010 Vienna
(hereinafter referred to as "SIGNA")

visible for evaluation and marketing purposes (mainly in the context of the use of Google Analytics). The data is transmitted on the basis of Art. 6(1)(f) of the GDPR and our justified interest in a pseudonymous evaluation of data by the SIGNA Retail Group.

You can object to the promotional use of your personal data as described under V. and VI. at any time, without giving any reasons. In this case SIGNA will also no longer be able to view the personal data relating to you.

4. For other purposes

Beyond this, we only pass on your personal data to third parties if:

• you have given your express consent in accordance with Art. 6(1)(a) of the GDPR,
• there is a legal obligation to pass on the data pursuant to Art. 6(1)(c) of the GDPR, or
• the disclosure pursuant to Art. 6(1)(f) of the GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data.

IV. Cookies and Pixel Tags

1 What are cookies and pixel tags?

We use cookies on our website. These are small files that are automatically created by your browser and stored on your device (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not cause any damage to your device and do not contain viruses, trojans or other malware.

A cookie is used to store information related to the specific device used. This does not mean, however, that we obtain direct knowledge of your identity.

We use pixel tags (also known as tracking pixels) in our online offering. Pixels are small graphics which are integrated via the HTML code of our site. The pixel tag itself does not store or change any information on your device, so pixels do not cause any damage on your device and do not contain viruses, trojans or other malware.

Pixels can send personal data, such as your IP address, the referrer URL of the visited website, the time the pixel was viewed, the browser used, and previously set cookie information to a web server. This makes it possible to carry out reach measurements and other statistical evaluations which serve to optimise our offering.

The use of cookies serves on the one hand to make the use of our offering more pleasant for you. For example, we use so-called session cookies to recognise that you have already visited individual pages of our website, that you have already logged into your user account or for shopping-cart display. These are automatically deleted when you leave our site.

In addition, we also use temporary, so-called comfort cookies, which are stored on your device for a certain fixed period of time to optimise user-friendliness. If you visit our site again in order to use our services, we automatically recognise that you have already been with us and which entries and settings you have made so that you do not have to enter them again. As a rule, these are deleted after a maximum of 30 days. Only those comfort cookies that concern language settings will be stored for 365 days.

On the other hand, we use cookies and pixel tags within the framework of third-party tools in order to record the use of our website statistically and evaluate it for the purpose of optimising our offering for you (see under V). These analysis, tracking and targeting cookies enable us to automatically recognise that you have already been with us when you visit our site again. These cookies are automatically deleted after a defined time.

2. What is the legal basis is the processing using cookies and pixel tags?

The data processed by cookies and pixel tags are required for the above-mentioned purposes to protect our legitimate interests in the analysis, optimisation and economic operation of our offering as well as the legitimate interests of third parties in accordance with Art. 6(1)(f) of the GDPR. On our website we use the cookies, tracking tools and remarketing tools described below. When you visit our site for the first time, you will be asked via our cookie banner to make a selection as to which cookies, tracking tools and remarketing tools are used as a result of your visit to our site. The use of certain cookies is necessary to ensure the functionality of our site. Furthermore, the implementation of the selection you make requires the use of a cookie which is stored on your device for a period of one year, unless you delete it in the meantime through your browser settings. The legal basis for the use of these cookies is our legitimate interest (Art. 6(1)(f) of the GDPR) to guarantee the functionality of the site, to provide proof of the cookie selection you have made, to measure the efficiency of our website and to design it to meet your needs.

If you agree via the cookie banner that further cookies, tracking tools and remarketing tools may be used, the processing of your personal data is based on your consent (Art. 6(1)(a) of the GDPR). You can revoke your consent at any time. You will find the possibility of revocation in the following descriptions of the individual tools.

3. What are your opt-out options?

Most browsers accept cookies and pixels automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a message always appears before a new cookie is created.

However, completely deactivating cookies may mean that you will not be able to use all the functions of our website. Instructions on how to disable cookies in your browser can be found in the help function of your browser or under the following links:

Mozilla Firefox
Google Chrome
Microsoft Edge
Opera
Safari
Microsoft Internet Explorer 11
Microsoft Internet Explorer 10
Microsoft Internet Explorer 9

You can also use appropriate tools or browser add-ons to prevent the use of pixels on our pages (e.g. the "AdBlock" add-on). You will find further opt-out possibilities in the following information about the tracking and targeting measures we use.

V. Tracking and targeting

With the tracking measures we use, we want to ensure that our website is designed to meet the needs of our customers and is continuously optimised. On the other hand, we use the tracking measures to record the use of our website statistically. By means of the targeting measures we use, we also want to ensure that only advertising that is oriented to your actual or supposed interests is displayed on your devices.

The respective data processing purposes and categories of data can be found in the description of the corresponding tracking tools.

1. adrox

This website uses the adrox tool of adrox GmbH, Niederstr. 1, 47829 Krefeld, Germany. For this purpose, a cookie is stored on your device which pseudonymously transmits information about purchased items. adrox does not, however, receive any information with which users can be personally identified. The information collected is used to compile conversion statistics and thus to create interest-oriented advertising on websites of adrox’s contractual partners.

If you would like to object to the use of the tool in the future, you can also refuse the necessary setting of a cookie, e.g. by changing the browser setting that generally deactivates the automatic setting of cookies. We would like to point out, however, that in this case not all functions of this website may be used to their full extent.

2. Bing conversion tracking

We use Conversion Tracking from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. This allows us to track user activity on our site when users come to our site through ads from Bing Ads.

If you enter our website via a Bing Ads display, a cookie is placed on your computer. Microsoft stores data about the use of the website (e.g. length of stay, which areas of the website were called up and through which ad you reached our website) as well as, in the case of an order resulting from this, the order value and the time of the order. Information about your identity is not recorded.

This information is transferred to Microsoft servers in the USA and stored there for a maximum of 180 days. Microsoft complies with the U.S. Privacy Shield and is registered with the U.S. Department of Commerce's Privacy Shield Program. In addition, we have concluded a contract with Microsoft for the use of Bing Ads. Through this contract, Microsoft assures that they process the data in accordance with the General Data Protection Regulation (GDPR) and ensure the protection of the rights of the data subject.

If you do not wish to participate in the tracking process, you can also refuse the necessary setting of a cookie – for example, by changing your browser settings to generally disable the automatic setting of cookies. For more information about Microsoft Bing's privacy policy and cookies, please visit the Microsoft website.

If you click on this link, an opt-out cookie will be set to prevent the collection of your information in the future when you visit our site. However, if you delete the cookies from your browser, you will need to set the cookie again.

3. Criteo

This website uses technology from Criteo SA (32 Rue Blanche, 75009 Paris, France) to collect and store data for marketing and optimisation purposes.

Criteo's technologies allow us to evaluate our advertising campaigns and advertising content. This data can be used to create usage profiles under a pseudonym. Cookies are used for this purpose. The data collected using Criteo technology will not be used to personally identify visitors to this website and will not be merged with personal data about the bearer of the pseudonym without the consent of the person concerned. Criteo uses an algorithm to analyse web-surfing behaviour and can then display targeted product recommendations as personalised advertising banners on other websites (so-called publishers). No other use or disclosure to third parties takes place. For more information about Criteo's technology, please visit Criteo’s data-protection statement.

Through the use of Criteo, additional pixels are loaded from contracted partners with whom Criteo works. An overview of all publishers and networks from which pixels are loaded can be found here.

You can object to this pseudonymous analysis of your surfing behaviour at any time. Follow this link to find instructions for deactivating Criteo’s service.

Please note that if you opt out of receiving personalised ads from Criteo and other advertisers, you will continue to receive ads from Criteo and other advertisers that are less tailored to your interests and surfing habits.

4. Einstein.

On our website we use the tool Einstein. Einstein is an AI software provided by salesforce.com inc., 415 Mission Street, 3rd Floor, San Francisco CA 64105, USA. Of the functions offered by Einstein, we have used:

• "Product Recommendations";
• "Predictive Sort";
• "Search Recommendations".

In this context, pseudonymous user profiles are created using cookies and pixel tags (see description IV.1 "What are cookies and pixel tags?"). The information generated by the cookies about your use of this website such as

• browser type/version,
• the operating system used,
• referrer URL (the previously visited page),
• host name of the accessing computer (IP address), and
• time of the server request,

are transferred to a Salesforce server in the USA and stored there. The storage period for these cookies is (to be added). In addition, data on the duration of the visit, products viewed, order behaviour/history and product data regarding articles are transmitted.

Salesforce complies with the U.S. Privacy Shield and is registered with the U.S. Department of Commerce's Privacy Shield Program. We also have an agreement with Salesforce on order processing as part of our contract. By entering into these agreements, salesforce assures that it will process the data in accordance with the GDPR and will ensure that the rights of the data subject are protected.

The processing of the above-mentioned data by AI software and the machine learning that takes place with it enables us, based on your preferences, to suggest suitable products for you during your visit to our site ("Product Recommendation"). With Einstein Predictive Sort, we can personalise the order in which products are displayed on a search or category page according to your preferences and display the most relevant products as the top search results. If you are searching for products on our Products page, Search Recommendations will personalise the type-ahead search instructions for you to display the products most relevant to your search terms.

If you do not wish to participate in the tracking process, you can also refuse the necessary setting of a cookie - for example, by changing your browser setting that generally disables the automatic setting of cookies (see IV.3 Cookies and Pixel Tags - Opt-out options).

5. Emarsys Webextend

We use the cookie / pixel tag Webextend from Emarsys eMarketing Systems AG, Hans-Fischer-Straße 10, 80339 Munich, Germany to create newsletters tailored to you and your interests. We use existing information for this purpose, such as confirmation of receipt and reading of emails, information about your computer and connection to the Internet, operating system and platform, your web-surfing history, your order history, date and time of your visit to the homepage, and products/articles you have viewed. We use this information in principle in pseudonymised form, but if necessary also to send you newsletters that correspond to your areas of interest.

You may object to the processing of your data by Emarsys Webextend by clicking here. By clicking on the box under point 6 (Opt-Out), an Opt-Out cookie is set, which means that no data on your usage behaviour on our website will be collected and stored by Emarsys in the future. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you will have to set the opt-out cookie again.

6. Facebook Custom Audiences

We use Facebook Website Custom Audiences from Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). This is a marketing service from Facebook. It enables us to display individualised and interest-based advertising on Facebook to certain groups of pseudonymised visitors to our website who also use Facebook.

A Facebook Custom Audience pixel tag is integrated on our website. This is a piece of JavaScript code that is used to store non-personal data about the use of the website. This includes your IP address, the browser used and the source and destination pages. This information is transmitted to Facebook servers in the USA. Facebook is subject to the EU-US Privacy Shield, so that an appropriate level of data protection is guaranteed.

There it is automatically checked whether you have saved a Facebook cookie. The Facebook cookie is used to automatically determine whether you belong to the target group relevant to us. If you belong to the target group, we will display the corresponding ads on Facebook. During this process, neither we nor Facebook will identify you personally by cross-referencing the data.

You may object to the use of the Custom Audiences service on the Facebook website. After logging in to your Facebook account, you will be taken to the Facebook Ads settings.

You can find more information about privacy on Facebook in the Facebook privacy policy. If you do not have a Facebook account, you can opt out of using the service here.

This sets an opt-out cookie that prevents future collection of your information when you visit this site. The opt-out cookie is unique to the browser used and to our site and is placed on your device. If you delete the cookies in this browser, you will need to set the opt-out cookie again.

7. Google Marketing Platform

We use products from the Google Marketing Platform on our website. The Google Marketing Platform is an advertising and analysis platform of the company

Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland ("Google"), which combines the services Google Analytics 360, Data Studio, Optimize 360, Surveys, Tag Manager 360, Display & Video 360, and Search Ads 360. Of these services, we use the following:

• Analytics 360
• Search Ads 360
• Optimize 360
• Tag Manager 360

In this context, pseudonymous user profiles are created using cookies and pixel tags (see description IV.1 "What are cookies and pixel tags?"). The information generated by the cookies about your use of this website, such as

• browser type/version,
• the operating system used,
• referrer URL (the previously visited page),
• host name of the accessing computer (IP address), and
• time of the server request,

are transmitted to a Google server in the USA and stored there. Our site uses the so-called anonymisation function ("anonymizeIP"), which already shortens the IP address within the EU or EEA, so that pseudonymised data is transmitted. Only in exceptional cases is the complete IP address transmitted to a Google server located in the USA. Association of the data with your person is thus no longer possible. Furthermore, Google states that the data collected in this way will not be combined with other Google data. You can find more detailed information here. A transfer of this information to third parties may take place if this is required by law or if third parties process this data on behalf of Google.

Google adheres to the privacy policy of the US Privacy Shield and is registered with the US Department of Commerce's Privacy Shield Program. We have also entered into order-processing agreements as part of the Google Marketing Platform. Through these agreements, Google assures that they process the data in accordance with the GDPR and ensure the protection of the rights of the data subject.

By using these services, we learn who uses our site, how they use it and how successful the respective (sub)pages are. This enables us to design and optimise our site according to the needs of our customers. In addition, the services we use enable us to optimise our advertising and to show you primarily offers that match your interests and user behaviour. Details of the individual services can be found in the following descriptions:

7.1. Analytics 360

By using Google Analytics, the collected data is analysed and prepared in report form. In these reports, we can see which categories of users (age, gender, etc.; demographic data, data on geographical locations) visit our site, how our site and its sub-pages are used, how often and for how long (sub) pages are used, on which pages we register abort rates, which pages lead to higher order rates ("conversion"), which channels users use to reach us, and which channels are particularly successful. This information is aggregated in reports. The storage period for these cookies is between six months and two years.

We use the findings from the reports to adapt our site and its functions to user behaviour. Furthermore, we create "target groups" on the basis of the collected user data, which we link to the Google Ads service and use there as a basis for our advertising placements via Google Ads. Through the integration, we can address you if you have already visited our website and interacted with it, e.g. if you have looked at or ordered certain products. If you visit other websites in the Google display network or search Google for terms related to our products, our ads are delivered to you based on your user behaviour ("Remarketing").

It is not possible for us to draw conclusions about your person and your individual user behaviour. If you still do not want your user behaviour to be included in the analysis and catering, you can use the following options:

You can set your browser to not store cookies or to delete existing cookies (see IV.3 Cookies and Pixel Tags - Opt-out options).

You can choose the ad settings in your Google Account (click here). If you sign out of your Google Account before visiting our site, or if you're not signed in at all, collection will be limited.

You can disable Google Analytics by installing a browser add-on (click here). As an alternative, we provide the following link. If you click on this link, an opt-out cookie will be set to prevent the collection of your information in the future when you visit our website. However, if you delete the cookies from your browser, you will need to set this cookie again.

7.2. Search Ads 360

Through the use of the Google service Search Ads 360, information is collected and evaluated on our website using floodlight tags to optimise advertising. For this purpose, cookies are used to record repeated visits from a particular browser. These technologies enable us to address you specifically with individual interest-based advertising. For example, the cookies used record information on which of our products you are interested in. Using this information, we can also display offers to you on third-party sites that are specifically geared to your interests, as they result from your previous user behaviour. The collection and evaluation of your user behaviour is exclusively pseudonymous and does not enable us to identify you. In particular, the information is not combined with personal data about you.

The cookie is automatically deleted after 30 days.

If you do not want to receive interest-based advertising, you can control this setting here.

7.3. Optimize 360

Optimize 360 is a web analytics service from Google that is integrated with Google Analytics. Google Optimize allows us to perform A/B, redirect, multivariate and other tests on our website content. This means that we define user groups in advance (e.g. according to use of mobile devices or fixed PCs, geographical location, first-time visitors to our site, etc.), to whom we provide different versions of our homepage in order to test which version is called up more frequently, leads to a longer visit duration, higher order rates, etc. These results are summarised in corresponding reports. On the basis of these reports, we find out which version of our website users like more. Thus we can optimise the design and structure of our site accordingly. You can find more information about this service here.

To object to Optimize 360's use of your information, you may click on the following link. If you click on this link, an opt-out cookie will be set to prevent your information from being collected in the future when you visit our site. However, if you delete the cookies from your browser, you will need to set this cookie again.

7.4. Tag Manager 360

We use Google Tag Manager to manage, use and control tracking technologies more efficiently. With the help of tags, scripts for web analysis and remarketing are integrated in the IT. The Google Tag Manager simplifies this integration significantly by allowing the scripts to be integrated via its user interface and no longer directly in the source code. The integration via the Tag Manager triggers data processing by the scripts. If a deactivation has been made at the domain or cookie level, it will remain effective for all tracking tags if they are implemented with the Google Tag Manager. If you do not want the Tag Manager to process your data, you can click the following link. You can find more information here.

8. Google AdWords with conversion tracking

We use Google Conversion Tracking from Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as "Google") on our website. With the help of Google Ads, we address customers who search for our company, for products we offer or for certain keywords that match our company in Google searches or on Google Maps.

We use Google Ads to measure and evaluate the success of our ads. By using Google Ads, we can also ensure that, based on your search and user behaviour, you are shown the ads that we believe correspond to your interests, thus minimising wastage.

If you have reached our website via a Google ad, Google AdWords will set a cookie (see description IV.1 "What are cookies and pixel tags?" on your computer ("Conversion Tracking"). These cookies expire after 30 days. If the user visits certain pages on the advertiser's website and the cookie has not expired, Google and the advertiser can tell that the user clicked on the ad and was redirected to that page.

The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted in to conversion tracking. We learn the total number of users who clicked on an ad and were redirected to a page using a conversion-tracking tag. However, this does not include any information that can personally identify users.

Each AdWords customer receives a different cookie. Cookies can therefore not be tracked through the websites of AdWords customers. The information generated by the cookie about your use of this website is transferred to a Google server in the USA and stored there. Google observes the data-protection regulations of the "US Privacy Shield" and is registered with the "US Privacy Shield" program of the US Department of Commerce. In addition, we have a shared-responsibility agreement with Google regarding the use of Google Ads. Through this agreement, Google assures that they will process the data in accordance with the GDPR and ensure the protection of the rights of the data subject.

If you do not wish to participate in the tracking process, you can also refuse the necessary setting of a cookie - for example, by changing your browser setting that generally disables the automatic setting of cookies (see IV.3 Cookies and Pixel Tags - Opt-out options). You can also disable cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com".

Alternatively, we provide the following link:

If you click on this link, an opt-out cookie will be set to prevent the collection of your information in the future when you visit our site. However, if you delete the cookies from your browser, you will need to set the cookie again.

Google's privacy policy can be found here.

9. Google Ad Manager

We use the Google Ad Manager of Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland ("Google"). The Google Ad Manager enables us to place ads across devices and platforms in advertising networks and on publisher sites, to improve our search discoverability, to simplify ad formats, to measure the success of our ads, and to make advertising decisions based on analytics. Due to the use of the Google Ad Manager, we can place our ads in a target-group-oriented manner and thus increase our advertising presence on the Internet.

The data processing for the Google Ad Manager is performed via the conversion tracking described under 8. Google AdWords with conversion tracking.

10. TradeDoubler

This website participates in partner programs of Tradedoubler GmbH, Herzog-Wilhelm-Str. 26, 80331 Munich, Germany ("TradeDoubler"), a service for the integration of advertisements in the form of text links, image links, advertising banners or input masks. TradeDoubler uses cookies that are stored on your computer and pixel tags that allow analysis of website usage. This allows information such as visitor traffic on these pages to be evaluated.

The information generated by cookies and pixel tags about the use of this website and delivery of advertising formats is transferred to and stored on a TradeDoubler server. This information may be shared by TradeDoubler with TradeDoubler's contractual partners. However, TradeDoubler will not combine your IP address with other data stored about you.

You may object to TradeDoubler's processing of your data by clicking on the "No tracking please" button following this link. This will set an opt-out cookie which will prevent the future collection of your data when you visit this website. The opt-out cookie is unique to the current browser and only applies to our website, and is placed on your device. If you delete the cookies in this browser, you will need to set the opt-out cookie again.

For more information on data usage, please see TradeDoubler's privacy policy.

11. RTB House

On our website we use the technology of RTB House GmbH, Kurfürstendamm 226, 10719 Berlin, an affiliated company of RTB House S.A., 61/101 Złota Street, 00-819 Warsaw, Poland. This technology enables us to refer you to further contents within our website or to websites of third parties that might be interesting for you by using pixel tags and cookies (retargeting). Pixel tags and cookies are used in this context. The recommendations integrated by RTB House are determined on the basis of your previously read contents. The contents are technologically controlled and delivered automatically by RTB House. Display is performed on a pseudonymous basis. The information stored in the cookie about your use of this website such as cookie IDs or advertiser IDs, browser type/version or device information, referrer URL (the previously visited page), time of the server request as well as data regarding your activities (such as IDs of products or product categories you have viewed) are transferred to a server of RTB House in the EEA and stored there. A transfer to third countries does not take place.

You can object to RTB House's processing of interest-based recommendations by clicking here. An opt-out cookie is set to prevent future collection of your information when you visit this site. The opt-out cookie is valid only in the current browser and only for our site, and is placed on your device. If you delete the cookies in this browser, you will have to set the opt-out cookie again. Please note that you will need to set the opt-out cookie separately on each device you use to access our website. Once you opt out, you will continue to be offered interesting additional content, but this will no longer be based on your previous usage patterns on our websites.

For further information on data protection at RTB House, please click here.

12. Use of trbo

On this website, we use the technology of trbo GmbH, Leopoldstraße 41, 80802 Munich, Germany. This technology is used to collect and store information about the web-surfing behaviour of website visitors in pseudonymised form for marketing purposes. This data is stored on your computer with the help of so-called "cookie" text files (see section IV.1 What are cookies and pixel tags?). The cookies used to record, for example, categories that you have visited, products that you have looked at, or information about which goods you have placed in the shopping basket. trbo uses an algorithm to analyse web-surfing behaviour so that product recommendations or promotions tailored to your interests and surfing behaviour can then be displayed to you as personalised advertising content on our web pages. Under no circumstances can this data be used to personally identify the visitor of this website. It will not be used for any other purpose or passed on to third parties.

You can object to the pseudonymous analysis of your surfing behaviour on this site. By clicking the following link: https://www.trbo.com/opt-out/ and pressing the "Opt-Out" button there, a new cookie (opt-out cookie) is set in your browser. This cookie signals to the trbo service that no more data about your usage behaviour may be collected and processed. You have the possibility to activate this function again. This setting must be made separately for each browser used. If you have set your browser so that no cookies can be set, this also applies to the "opt-out cookie".

For more information on trbo technology, please refer to the trbo privacy policy.

13. Use of Sovendus

For the selection of a voucher offer that is currently of interest to you, we pseudonymise and encrypt the hash value of your email address and your IP address and send it to Sovendus GmbH, Hermann-Veit-Str. 6, 76135 Karlsruhe (Sovendus) (Art. 6(1)(f) of the GDPR). The pseudonymised hash value of the email address is used to take account of a possible objection to advertising by Sovendus (Art. 21(3), Art. 6(1)(c) of the GDPR). The IP address is used by Sovendus exclusively for purposes of data security and is anonymised as a rule after seven days (Art. 6(1)(f) of the GDPR). In addition, we transmit the order number, order value with currency, session ID, coupon code and time stamp to Sovendus in pseudonymised form for billing purposes (Art. 6(1)(f) of the GDPR). If you are interested in a voucher offer from Sovendus, provided there is no objection to advertising in place for your email address and if you click on the voucher banner, which is only displayed in this case, we will transmit your title, name, postcode, country and email address to Sovendus in encrypted form so that the voucher can be prepared (Art. 6(1)(b) and (f) of the GDPR). For further information on the processing of your data by Sovendus, please refer to the online data-protection information at https://www.sovendus.de/datenschutz.

14. Use of advantageous offers via Sovendus

In order to select an advantageous offer of current regional interest to you, we will transmit your title, year of birth, country, postcode, the hash value of your email address and your IP address to Sovendus GmbH, Hermann-Veit-Str. 6, 76135 Karlsruhe (Sovendus) in a pseudonymised and encrypted form (Art. 6(1)(f) of the GDPR). The pseudonymised hash value of the email address is also used to take into account any objection to advertising by Sovendus (Art. 21(3), Art. 6(1)(c) of the GDPR). The IP address is used by Sovendus exclusively for data-security purposes and is anonymised as a rule after seven days (Art. 6(1)(f) of the GDPR). When you click an advantageous offer, to the extent required for the respective advantageous offer, your name, address data, email address and/or telephone number will be transmitted to Sovendus in encrypted form in preparation for the personalised request of the advantageous offer from the product provider (Art. 6(1)(b) and (f) of the GDPR). For further information on the processing of your data by Sovendus, please refer to the online privacy policy at https://www.sovendus.com/en/privacy_policy/.

15. use of Hotjar

We use Hotjar on our website. This is a web analytics service provided by Hotjar Limited, Level 2, St Julian's Business Centre 3, Elia Zammit Street, St Julian's STJ 1000, Malta.

Hotjar enables us to log and evaluate your user behavior on our website, especially your mouse behavior (movement, clicks). Your visit to our website is anonymous. Furthermore, only information about the operating system, your Internet browser, incoming or outgoing references (so-called links), the geographical origin and the terminal equipment you are using are evaluated and processed for statistical purposes.

You are always able to terminate the analysis of your user behaviour by means of the so-called opt-out. With the confirmation of the link

https://www.hotjar.com/privacy/do-not-track/

a cookie will be set on your used browser, which immediately prevents further analysis. Please note that you will have to confirm the above link again if you delete the cookies stored on your terminal device. Some of the cookies set by Hotjar are session cookies that are deleted when the session ends. Other cookies are stored for between 30 minutes and 365 days. (see also https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookie-Information).

Hotjar is used to analyze user behavior on our website, enabling us to analyze and optimize our operations and to make our website more in line with the interests of our users.

Hotjar offers further data protection information at https://hotjar.com/privacy.

VI. Our corporate presence on social media

1. Facebook and Instagram

A simple link will take you from our website to our pages on the social networks Facebook and Instagram. These platforms are provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. We maintain these Facebook/Instagram pages to communicate with users, interested parties and customers and to inform them about our services.

We would like to point out that user data may also be processed outside the EU, e.g. in the USA. Facebook guarantees through certification according to the EU-US data-protection shield that the data-protection regulations of the EU are adhered to when processing data in the USA. We would also like to point out that we, as operators of a Facebook/Instagram fan page, are jointly responsible with Facebook for the processing of the personal data of visitors to the page (see ECJ ruling of 5 June 2018, Case C-210/16).

However, Facebook acknowledges joint responsibility for the Insights data with the operators of the sites and assumes primary responsibility; see: https://www.facebook.com/legal/terms/page_controller_addendum.

We would like to draw your attention to the fact that the user data is generally only processed for market research and for (personalised) advertising purposes. If you have a Facebook/Instagram profile and are logged in, Facebook can, for example, analyse your usage behaviour and create a user profile corresponding to your usage behaviour. This enables Facebook to, for example, place advertisements that presumably correspond to your user profile. To make this possible, cookies are stored on the user's computer. If you do not agree that Facebook may assign the collected data directly to your Facebook/ Instagram profile, we recommend that you log out of social networks, delete your cookies in the browser settings and restart the browser.

The data are processed in accordance with Art. 6(1)(f) of the GDPR. Our legitimate interest lies in providing frequently used and up-to-date communication channels for the information of our interested parties and customers.

If you wish to request information or assert your user rights, the most effective way to assert these rights is to contact Facebook. Further information regarding the collection and use of data as well as your rights and protection options can be found at https://www.facebook.com/policy.php.

Facebook has direct access to your user data and can therefore take appropriate measures more effectively, especially by providing information.

2. Xing

If you are logged in, clicking on the Xing button on our home page will take you to our company page on this social network (provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany). This is a simple link. We assume that Xing collects your usage behaviour with the help of cookies and processes the data obtained for market research and advertising purposes. We ourselves do not use any functionalities of the social network, but only provide basic information about our company there.

For information on data processing and opt-out possibilities at Xing, please follow this link.

VII. rights of data subjects

You have the right:

• in accordance with Art. 7(3) of the GDPR to revoke your once given consent to us at any time. As a result, we may no longer continue to process the data which was based on this consent in the future;
• to request information about your personal data processed by us in accordance with Art. 15 of the GDPR. In particular, you may request information on the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right of rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on the details of such data;
• in accordance with Art. 16 of the GDPR, to demand the correction of incorrect or incomplete personal data stored by us without delay;
• in accordance with Art. 17 of the GDPR to demand the deletion of your personal data stored with us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• pursuant to Art. 18 of the GDPR, to demand the restriction of the processing of your personal data, if the accuracy of the data is disputed by you, if the processing is unlawful but you refuse to delete it and we no longer require the data, but you require it for the assertion, exercise or defence of legal claims, or if you have lodged an objection to the processing pursuant to Art. 21 of the GDPR
• in accordance with Art. 20 of the GDPR, to receive your personal data with which you have provided us in a structured, common and machine-readable format or to request that it be transferred to another responsible party, and
• to complain to a supervisory authority pursuant to Art. 77 of the GDPR. As a rule, you can turn to the supervisory authority of your usual place of residence or work or to the supervisory authority of our company headquarters.

To assert your rights against us, please contact: datenschutz@dress-for-less.de

VIII. Right of objection

If your personal data are processed on the basis of legitimate interests in accordance with Art. 6(1)(f) of the GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 of the GDPR if there are reasons for doing so arising from your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right of objection, which will be implemented by us without indicating any special situation.

If you wish to exercise your right of objection, simply send an email to: datenschutz@dress-for-less.de.

IX. Data security

All data that you personally transmit is encrypted using the common and secure TLS (Transport Layer Security) standard. TLS is a secure and proven standard that is also used, for example, in online banking. You can recognise a secure TLS connection by the added letter s following http (i.e. https://...) in the address bar of your browser or by the lock symbol in the upper area of your browser.

We also use appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

X. Up-to-dateness and amendment of this data-protection statement

This data-protection statement is currently valid as of June 2020. Due to the further development of our website and offers on it, or due to changing legal or official requirements, it may become necessary to update this data-protection statement. The current data-protection statement can be retrieved and printed out by you at any time on the website at https://www.dress-for-less.at/hilfe-rechtliches/privacy-policy.html#privacy-policy.