Data protection

ESCADA - Data protection at a glance

General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data with which you can be personally identified. For complete information on the subject of data protection, please refer to our detailed Privacy Policy.

Data collection on our website
Who is responsible for data collection on this website?
Data processing on this website is carried out by ESCADA SE. ESCADA Online GmbH is the oper-ator of the ESCADA online store integrated into the website. You can find the contact details in our detailed Privacy Policy.

How do we collect your data?
On the one hand, your data is collected by you communicating it to us. This may involve, for ex-ample, data that you enter in a contact or order form. Other data is automatically collected by our IT systems when you visit our website. Such data primarily comprises technical data (for example, Internet browser, operating system or time of viewing the page).This data is automatically collected as soon as you visit our website.

What do we use your data for?
Some of the data is collected to ensure that the website is error-free. Other data may be used to analyse your user behaviour. In addition, we use your data within the framework of contract fulfil-ment for your orders.

Analysis tools and tools of third parties
When you visit our website, your website visiting behaviour can be statistically evaluated. This is done primarily with cookies and so-called "analysis programmes". As a rule, the analysis of your website visit takes place anonymously; a website visit cannot be traced back to you. You can ob-ject to such analysis or prevent it by not using certain tools. Detailed information regarding such tools and regarding your options for objecting can be found in the detailed Privacy Policy.

What rights do you have with regard to your data?
You have the right to, at any time and free of charge, receive information regarding the origin, recip-ient and purpose of your stored personal data. You also have the right to demand the rectification, blocking or erasure of such data. For this purpose and for other questions on the subject of data protection, you can contact us at any time as follows:

ESCADA SE / ESCADA Online GmbH
Data protection officer
Einsteinring 14-18
85609 Aschheim
Germany
E-mail: [email protected]

Furthermore, you have the right to lodge a complaint with a competent supervisory authority. You also have the right, under certain circumstances, to request that your personal data be restricted. Details regarding your rights and how you can exercise them can be found in our detailed Privacy Policy under "Rights of the data subject".

This privacy notice provides you with an overview of the collection and processing of your data. The complete information results from the detailed version of our privacy notices, the Privacy Policy.

 

Datenschutzerklärung - General notes and mandatory information

Protection of your privacy, personal data and data security is important to ESCADA SE and ESCADA Online GmbH who collect, process and use your personal data only pursuant to the below principles, the EU General Data Protection Regulation and the German Federal Data Protection Act (Bundesdatenschutzgesetz), new version, applicable to ESCADA SE and ESCADA Online GmbH.

I. Name and Address of the Controller
II. Name and Address of the Data Protection Officer
III. Your Personal Data
IV. General Information on Data Processing by ESCADA SE and ESCADA Online GmbH
V. Provision of the Website and Creation of Log Files
VI. Use of Cookies
VII. Email Contact, Service Hotline and Use of the Contact Form
VIII. Newsletter
IX. Use of Google Web Fonts
X. Use of Google reCAPTCHA
XI. Web Analysis Services
XII. E-Store Usage
XIII. Advertising and Marketing Services
XIV. Use of customer feedback systems
XV. Social Media
XVI. Rights of Data Subjects
XVII. Links to other websites
XVIII. Security
XIX. Availability and Amendments

I. Name and Address of the Controller
The controller in terms of the EU General Data Protection Regulation (“GDPR”), other Member States’ data protection laws and data protection regulations applicable to ESCADA website operation (“Website”) is
ESCADA SE
Einsteinring 14-18
85609 Aschheim
Germany

represented by the Executive Directors, Iris Epple-Righi and Torsten Dühring
(“ESCADA SE”).

The controller and the operator of the ESCADA e-store on the Website (“E-Store”) is
ESCADA Online GmbH
Einsteinring 14-18
85609 Aschheim
Germany

represented by the Managing Directors, Iris Epple-Righi and Torsten Dühring
(“ESCADA Online GmbH”).

The controller is the natural person or legal entity who, alone or jointly with others, decides on the purposes and means of processing pf personal data (for example, names, e-mail addresses, etc.).

If you would like to object to us collecting, processing or using your Data as set out in this Privacy Policy, either in general or with regard to individual measures, please send your objection by email to [email protected] or by letter to the above contact details. ESCADA SE and ESCA-DA Online GmbH will be happy to assist you with queries concerning data protection and the pro-cessing of your personal data. It goes without saying that you can contact ESCADA SE and ESCADA Online GmbH also by using the contact data given in the Legal Notice. ESCADA Online GmbH is a fully owned subsidiary of ESCADA SE.

II. Name and Address of the Data Protection Officer

We have appointed a data protection officer for our company.

ESCADA Online GmbH
Data protection officer
Einsteinring 14-18
85609 Aschheim
Germany
E-mail: [email protected]

The contact details of the data protection officer have been reported to the competent data protection supervisory authority.


III. Your Personal Data
“Personal data” means any information relating to an identified or identifiable natural person. When visiting the ESCADA SE Website or E-Store, you need not provide personal data. We only collect personal data, e.g. your name, telephone number, physical/email address, date of birth and account/credit card number, which you voluntarily provided to us and/or to whose collection you consented. For data required for technical reasons, please refer to sec. V and VI.

IV. General Information on Data Processing by ESCADA SE and ESCADA Online GmbH
1. Scope of the Processing of Personal Data
ESCADA SE and ESCADA Online GmbH process the users’ personal data (“Data”) only to the ex-tent this is required for providing a functioning Website, E-Store, their contents and services. User Data on the Website/E-Store is processed only after the user previously consented to this. An ex-ception applies in cases where prior consent cannot be obtained for practical reasons, where statu-tory regulations permit Data processing or where this is required to fulfil statutory duties.
ESCADA SE collects, processes and uses Data which you voluntarily provided only to deliver information on ESCADA SE and their products and for other advertising purposes (delivery of catalogues, email marketing and off-line direct marketing). ESCADA SE will transfer to ESCADA Online GmbH any Data which they receive for marketing purposes (e.g. email and off-line direct marketing). You have the right to withdraw your consent to Data processing, that is, the delivery of information, at any time without giving reasons for this with effect for the future; for more information, please refer to sec. XIV.
ESCADA Online GmbH collects, processes and uses Data collected during the E-Store order pro-cess to establish, execute and process purchase contracts concluded with them on the E-Store. The users’ address and order Data will be collected and processed for marketing purposes if the users previously consented to this, independent of whether they purchase ESCADA products. ESCADA Online GmbH will transfer to ESCADA SE your Data which they obtained based on your consent for advertising purposes (e.g. email and off-line direct marketing). You may revoke your consent at any time without indicating a reason with effect for the future; for more information, please refer to sec. XIV. ESCADA SE and ESCADA Online GmbH will collect, process and use Data provided by you only for the purposes indicated to you and it will not be forwarded to third parties if you did not previously consent to this in writing. ESCADA group companies are excluded from this to the extent required for rendering contract services to you or for processing existing purpose contracts.

2. Legal Basis for the Processing of Personal Data
Where ESCADA SE or ESCADA Online GmbH obtain consent from the data subject for personal data processing operations, point (a) of Art. 6(1) GDPR is the legal basis for this.
If processing personal data is necessary for the performance of a contract to which the data subject is party, point (b) of Art. 6(1) GDPR is the legal basis. This also applies to processing required to take steps prior to entering into a contract.
Where personal data processing is necessary for fulfilling a legal duty to which ESCADA SE or ESCADA Online GmbH is subject, point (c) of Art. 6(1) GDPR is the legal basis.
Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, the legal basis is point (d) of Art. 6(1) GDPR.
If processing is necessary for legitimate interests pursued by ESCADA SE, ESCADA Online GmbH or a third party, except where the interests or fundamental rights and freedoms of the data subject prevail over such interests, point (f) of Art. 6(1) GDPR is the legal basis for processing.

3. Erasure of Data and Retention Period
The data subject’s personal data will be erased or blocked once the purpose of storage ceases to apply. In addition, Data can be stored if this is provided for by European or national legislators in union law regulations, laws or other legislation which apply to the controller. The Data will also be blocked or erased once a storage period specified by the above standards expires, unless further Data retention is required for the conclusion or performance of a contract.

V. Provision of the Website and Creation of Log Files
1. Description and Scope of Data Processing
When using the Website and the E-Store for mere information purposes, we collect only that Data which your browser transmits to our server and which we need to have for technical reasons to dis-play the Website and the E-Store and to guarantee their stability and security.
We commissioned root360 GmbH (Beethovenstraße 35, 04107 Leipzig, “root360”) with hosting and technically providing the Website and the E-Store. We concluded a data processing contract in terms of Art. 28 GDPR with root360 required under data protection law under which root360 under-takes to protect and process your Data only on our behalf pursuant to valid data protection provisions. For more information on root360, please refer to their website: https://www.root360.de/.
(1)    Each access to our Website and/or the E-Store and each call-off of Website files will be stored in a “log file” which contains the below Data for so long as this is technically required: information on your browser type and version;
(2)    your operating system;
(3)    the website from which you were referred to the Website/E-Store;
(4)    your IP address;
(5)    the accessing system service provider;
(6)    the access date and time. root360 stores such Data on certified Amazon Web Services servers and uses this information for the intended purpose on our behalf and for service optimisation. However, root360 will not inde-pendently use or transmit your Data to third parties and this Data will not be stored together with other Data of the user.

2.    Legal Basis for Data Processing
The legal basis for temporary data retention is point (f) of Art. 6(1) GDPR.

3. Purpose of Data Processing
It is necessary for the system to temporarily store the IP address to allow for Website and E-Store delivery to the user’s computer. To this end, the IP address of the user must be saved for the dura-tion of the session.
Other information is required to structure the company’s Website and E-Store in a secure manner, protect it from attacks, optimise the Website and guarantee Website and E-Store function.
Such purposes constitute our legitimate interest in data processing pursuant to point (f) of Art. 6(1) GDPR.

4. Retention Period
The Data will be erased as soon as it is no longer required to achieve the purpose of its collection. Regarding the collection of Data for the provision of the Website, this will be the case 30 minutes from when the session in question ends. Storage for longer periods is possible in individual cases and if legally admissible in which case the Data is anonymised in the way that the user’s IP address is erased or alienated; allocation of the accessing user is no longer possible.

5.    Objection and Elimination Option
Data collection is necessary to make the Website available, and Data storage in log files is neces-sary to operate the Website. Consequently, the user has no option to object.

VI. Use of Cookies
1. Description and Scope of Data Processing
Both the ESCADA SE Website and the ESCADA Online GmbH E-Store use cookies. Cookies are text files which are stored within or by the internet browser in the user’s computer system. Cookies cannot run programs or transmit viruses to your computer. If a user accesses a website, a cookie can be stored in the user’s operating system. This cookie contains a distinctive sequence of characters that allows for the unique identification of the browser the next time the website is accessed. Some cookies we use will be deleted again following the end of the browser session, i.e. after you close the browser (commonly known as “session cookies”). Other cookies stay on your terminal and allow us to recognise your browser when you visit our Website again.
We use cookies to make our Website more user-friendly. Certain Website elements also require the accessing browser to remain identifiable after changing to a different web page.
In this respect, the following Data is saved and transmitted in the cookies:
(1)    language settings;
(2)    permission for the use of cookies;
(3)    session information;
(4)    products in the shopping cart/on the wish list.
We also use cookies on our Website to allow us to analyse how our users surf the web. On this ba-sis, the following Data can be transmitted:
(1)    search terms entered;
(2)    frequency of page views;
(3)    use of Website functions.
User Data to be collected in this way is pseudonymised through technical measures. It is therefore no longer possible to assign such Data to the accessing user. The Data will not be saved with any other personal data of the user.
When users access the ESCADA SE Website or the ESCADA Online GmbH E-Store, they are in-formed of the use of cookies for analyses and direct advertisement and their consent to the pro-cessing of Data used for this is obtained. In this context, the user is also informed of this privacy policy.
You can additionally deactivate the saving of cookies through the appropriate settings or set your browser so that you are notified as soon as the cookies are placed. If you wish to do this, you must change the relevant settings under the “Preferences” or “Options” browser menus. We kindly remind you that this may mean that certain parts of the Website no longer function at all or do not function properly, i.e. only to a restricted extent.

2. Legal Basis for Data Processing
The legal basis for the processing of Data using technically required cookies is point (f) of Art. 6(1) GDPR.
The legal basis for the processing of Data using cookies for analysis and advertisement tracking purposes where users have given their consent is point (a) of Art. 6(1) GDPR.

3. Purpose of Data Processing
The purpose of the use of technically required cookies is to facilitate the use of websites for the us-ers. Some Website functions cannot be provided without the use of cookies. To achieve this, it must also be possible to recognise the browser after changing to a different web page.
We require cookies for the following applications:
(1)    adoption of language settings;
(2)    memorising search terms;
(3)    storing products in the shopping basket;
(4)    e-store processing.
User Data collected by technically required cookies is not used to create user profiles.
Analysis cookies are used to improve the quality of our Website and its contents. Via the analysis cookies, we find out how the Website is used, allowing us to continually optimise our contents. We refer to X. “Website Analyses Services”.
We also place numerous third-party cookies increasing the comfort when using this Website, serving direct advertisement purposes or simplification of interactions with other websites and social net-works. For a description of the cookies, their functions, purposes and the options to object, please refer to XII. and XIII.
Such purposes also constitute our legitimate interest in Data processing pursuant to point (f) of Art. 6(1) GDPR.

4. Retention Period, Objection and Elimination Option
Cookies are stored on the user’s computer, and transferred from it to our Website. Therefore, you as the user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transfer of cookies. Cookies which have already been stored can be erased at any time. This can also occur automatically. If cookies are deactivated for our Website, you may no longer have full access to the Website functions.

VII. Email Contact, Service Hotline and Use of the Contact Form
1. Description and Scope of Data Processing
On the ESCADA SE Website and E-Store, you can contact us by using the email address, service hotline or contact form provided. In all these cases, transferred user Data is stored and processed for ESCADA SE and the ESCADA Online GmbH E-Store by a central department.
In this context, Data will not be disseminated to third parties; instead, it is used only for the commu-nication process initiated by the user and to deal with service queries.

2. Legal Basis for Data Processing
The legal basis for the processing of Data in the course of sending an email or a query via the ser-vice hotline or the contact form is point (a) of Art. 6(1) GDPR. If users contact the company to con-clude a purchase contract for ESCADA products, an additional legal basis for processing is point (b) of Art. 6(1) GDPR.

3. Purpose of Data Processing
ESCADA SE and ESCADA Online GmbH process personal data received by email only to process user approaches or service queries. This is what constitutes the necessary legitimate interest in processing the Data.

4. Retention Period
The Data will be erased as soon as it is no longer required to achieve the purpose of its collection. For Data provided by email or service discussions, this is the case when the relevant conversation with the user has come to an end. The conversation is deemed terminated once it becomes clear from the circumstances that the relevant issue has been conclusively resolved.

5. Objection and Elimination Option
The user can withdraw his or her consent to personal data processing at any time. Should users contact ESCADA SE or ESCADA Online GmbH by email, the service hotline or by the contact form, they may object to their Data being stored at any time. In such case, the conversation cannot be continued. Objections can be delivered at any time by using the contact information under I. and II. and the following email address: [email protected]; see also XIV. for this. All personal data stored in the course of contact will be erased in this case.

VIII. Newsletter
1. Description and Scope of Data Processing
On the ESCADA SE Website and the ESCADA Online GmbH E-Store, users can subscribe to the ESCADA SE newsletter. ESCADA SE regularly delivers their newsletters to registered clients who consented to receiving the newsletters to obtain fashion and lifestyle news, offers and information. Regarding newsletter reception, the system provides for a double opt-in procedure (see below).
If you subscribed to the ESCADA SE newsletter, ESCADA SE collects, processes and uses any Data required for this or separately provided by you only for delivering the newsletter. For technical delivery, we transfer your email address to salesforce.com EMEA Limited, Village 9, Floor 26, Salesforce Tower, 110 Bishopsgate, London, UK (“Salesforce”) who processes the Data provided on ESCADA SE’s behalf as the processor pursuant to required data security measures. This contract relationship complies with data protection regulations.
Should you subscribe to an electronic newsletter and other electronic messages, we particularly process the below Data:
(1)    your name;
(2)    your email address;
(3)    the information whether you consented and/or objected to receiving such messages, includ-ing the date and time.
Email newsletter subscription is based on the double opt-in procedure, that is, you receive a confir-mation link by email after entering your Data. This confirmation email serves newsletter reception authorisation by the owner of the email address provided. Only after confirmation, your email ad-dress will be added to the distribution list.
To constantly improve the newsletter, we collect and process Data as to the use and the related interests of the users. This includes success evaluation by ESCADA SE with the help of the Salesforce tracking system based on an HTML email. In this context, we evaluate the following in-formation on the newsletter on an aggregated basis: email reception status; success evaluation for newsletter links on which users clicked by using a counter; and the terminal which clients use for newsletter reception.
ESCADA SE may also evaluate and connect your Data with other data. We may, for example, add statistical information or other personal data to existing Data to obtain information on your prefer-ences and attraction to certain products or services.

2. Legal Basis for Data Processing
The legal basis for the processing of Data in the course of a consent to newsletter delivery is point (a) of Art. 6(1) GDPR. Temporary Data storage for statistical success evaluations is legally based on point (f) of Art. 6(1) GDPR. ESCADA SE also has a legitimate interest in direct advertising and evaluating your reaction to newsletter contents to survive against market competition.

3. Data Contract Purpose
ESCADA SE, ESCADA Online GmbH and Salesforce, their service provider, process your Data only to deliver the newsletter and to evaluate the success of each newsletter. ESCADA SE processes Data concerning your use of and reaction to the newsletter to learn more about you and to tailor the offers delivered to you through direct advertising. This is what constitutes the necessary legitimate interest in processing the Data.

4. Retention Period
Salesforce stores your Data on certified servers and uses this Data to deliver the newsletter, evalu-ate its use on our behalf and optimise services. However, Salesforce will not independently use your Data, such as for establishing contacts, or transmit it to third parties.
The Data will be erased as soon as it is no longer required to achieve the purpose of its collection. For personal data, this is the case when you revoke your consent to processing.

5. Objection and Elimination Option
The Data is processed only if you voluntarily provided this to us. If you did not provide ESCADA SE with your personal data as described under VIII.1. above, particularly your email address, ESCA-DA SE will not be able to render the services mentioned under this section to you.
The user can withdraw his or her consent to personal data processing at any time. Following the revocation of your consent to newsletter reception in the future, we no longer process your Data for this purpose. You may terminate this at any time by clicking on the link in the newsletter or by refer-ring to the contact information under I. and II.

IX. Use of Google Web Fonts
1. Description and Scope of Data Processing
For uniform presentation of fonts, the Website and the E-Store use “web fonts” provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. When accessing the Website, your browser will load the necessary web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you use must es-tablish a connection to the Google servers. This informs Google that our Website was accessed via your IP address.

2. Legal Basis and Purposes of Data Processing
Google web fonts are used to ensure a uniform and appealing presentation of our online offers. This is a legitimate interest in terms of point (f) of Art. 6 (1) GDPR.

3. Objection and Elimination Option
If your browser does not support web fonts, one of your computer standard fonts will be used. For more information regarding Google web fonts, please refer to https://developers.google.com/fonts/faq and the Google privacy policy (https://www.google.com/policies/privacy/).

X. Use of Google reCAPTCHA
1. Description and Scope of Data Processing
For their Website and E-Store, ESCADA SE and ESCADA Online GmbH use Google reCAPTCHA to check and avoid interactions through automated accesses. This service is provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Based on a certification in terms of the EU-US Privacy Shield (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active), Google guarantees that the European Union data protection requirements are met.
Through the reCAPTCHA on-line service, Google determines which websites send queries and which IP addresses use the “reCAPTCHA entry box”. In addition to your IP address, Google might store other information required for offering and guaranteeing this service.
At https://policies.google.com/privacy, Google provides additional information on the use of your user data.
ESCADA SE and ESCADA Online GmbH point out that they have no influence on how Google processes your Data.

2. Legal Basis and Purposes of Data Processing
The legal basis for the use of Google reCAPTCHA is point (f) of Art. 6(1) GDPR. The controller’s legitimate interest consists in Website and E-Store security and in the protection from undesired automated accesses in the form of spam to prevent their own on-line presence from being damaged.

3. Objection and Elimination Option
Under the https://adssettings.google.com/authenticated link, Google provides an opt-out option to opt out of the reCAPTCHA service.

XI. Web Analysis Services
1. Description and Scope of Data Processing
For their Website and E-Store, ESCADA SE and ESCADA Online GmbH use Google Analytics, a web analysis service, and Google Conversion Tracking. The provider in both cases is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics and Google Conversion Tracking (“Web Analysis Services”) also use “cookies”, text files which are stored on your computer or terminal (tablet, smartphone, etc.) and allow for an analysis of how you use our Website and E-Store.
The Web Analysis Service functions make it possible to allocate data, sessions and interactions to anonymised user IDs and to analyse the users’ activities across several devices.
Information generated by the cookie about your use of this Website is usually transmitted to and stored on a Google server in the US. Google uses this information to analyse how you use the website, to compile reports about the website activities for the website operators and to render further services associated with the use of the website and of the Internet. This information may also be provided to third parties if legally required or if third parties process this data on behalf of Google. ESCADA SE and ESCADA Online GmbH point out that they use Google Analytics and Google Con-version Tracking including the “_anonymizeIp()” extension so that only IP address parts will be processed to exclude direct identification.
The conversion tracking reports which Google prepares for ESCADA SE and ESCADA Online GmbH include no personal user data. In this regard, we point out to the Google privacy policy concerning conversion tracking.
Please refer to the privacy policy of Google for further information about the handling of user data at Google Analytics: https://support.google.com/analytics/answer/6004245?hl=de

2. Purpose and Legal Basis for Data Processing
On behalf of ESCADA SE and ESCADA Online GmbH, Google uses cookie information to evaluate the Website use in an anonymised way, to prepare Website activity reports and to provide the web-site operator with additional services relating to Website and internet use. The above processing purposes represent a legitimate interest of ESCADA SE and ESCADA Online GmbH (point (f) of Art. 6(1) GDPR).

3. Retention Period
Generally, sessions are terminated after 30 minutes with no activities, campaigns after six months; campaign periods are limited to a maximum of two years. Regarding the storage periods of individu-al cookies, please refer to the relevant section under VI.

4. Objection and Elimination Option
You can object to the collection, storage and use of information by Google with future effect at any time by installing the deactivation add-ons that are made available by Google. For more information, please refer to https://tools.google.com/dlpage/gaoptout?hl=de. As an alternative, you can also pre-vent Google from storing cookies by accordingly setting your browser software. However, ESCA-DA SE and ESCADA Online GmbH point out that you will not be able to fully use the ESCA-DA SE Website and/or the ESCADA Online GmbH E-Store in the case of de-activation and/or an opt-out.

XII. E-Store Usage
XII.1. Data Processing During Check-Out
1. Description and Scope of Data Processing
ESCADA Online GmbH processes your personal data based on orders which you place at the E-Store, to execute the relevant purchase contract, to deliver your order and to prepare invoices.
If you use the ESCADA Online GmbH services, that is, purchase an ESCADA product on the E-Store, we process Data which you provided on the E-Store only in relation to your purchase and payment behaviour. This includes the below data:
(1)    name, address, contact data, delivery address(es);
(2)    credit standing and payment information;
(3)    information on which purchases you make on the E-Store at what time and at what frequen-cy and on which payment means you use;
(4)    information on your behaviour at the E-Store (ordered/deleted carts, wish lists, articles viewed etc.). Wish list information is stored only if you also agreed to cookies not required for technical reasons being placed.
We may also evaluate and combine with other Data we collected from you any Data on purchases and your E-Store behaviour.
In relation to purchase contracts and your means of payment, we may also check your credit stand-ing and/or transmit provided Data to the payment service provider (see also XII.3).

2. Legal Basis for Data Processing
The legal basis for processing Data provided by you is the purchase contract relationship (point (b) of Art. 6(1) GDPR); this also includes the delivery of the goods to any recipients indicated by you.
Processing also serves our legitimate interest under point (f) of Art. 6(1) GDPR to evaluate infor-mation on your purchasing behaviour, to better align our services to your needs and interests and to extend and enhance our offers.

3. Data Contract Purpose
ESCADA Online GmbH particularly processes your personal data for the below purposes:
(1)    Purchase contract initiation and execution: The above Data is processed to conclude a pur-chase contract with you, to fulfil the contractual performance duties and to supply the goods which you ordered.
(2)    Information on your purchasing behaviour: We analyse our customers’ purchasing behaviour (shopping cart/wish list) to obtain information about their preferences for certain products and other information which we consider when enhancing our services (product range, loca-tion, service etc.). This enables us to align our offer to our customers’ needs (generally and individually) and to react to deleted shopping carts. For example, ESCADA Online GmbH contacts you within 14 days if the payment process during check-out was terminated.
(3)    Statistical purposes: We process your Data for statistical purposes to evaluate general in-formation on interactions between our customers and us which makes it easier for us to re-act to their needs. We also obtain information about which products our customers prefer and how we can enhance our product range based on this information.

4. Retention Period
ESCADA Online GmbH stores your personal data only for so long as this is required for fulfilling the relevant storage purpose. After this, we delete your Data, unless we must store them for longer peri-ods in terms of point (c) of Art. 6(1) GDPR based on tax, commercial or other legal storage and doc-umentation duties.

5. Objection and Elimination Option
You need not provide your personal data when purchasing products; however, placing orders and purchasing ESCADA products is impossible without us processing your personal data. We also in-form you about your rights as a data subject (see XV.).

XII.2. Registration of Customer Accounts
1. Description and Scope of Data Processing
ESCADA Online GmbH operates the E-Store and is the exclusive contract partner for all E-Store orders. To make purchases on the E-Store, you can either create a customer account or use the guest order process without creating such an account;
customer accounts will be operated by ESCADA Online GmbH. This account is intended to make subsequent orders easier for you by Data provided when creating the customer account automati-cally being filled in when later placing other orders. In this context, Data provided for your customer account will be stored in the ESCADA Online GmbH central customer database and transferred to ESCADA SE overseeing processing, administration and accounting. ESCADA Online GmbH stores your Data only after you allow us to do so by clicking on the “Register” button when registering as a new customer. Based on the customer account, ESCADA Online GmbH offers additional services, such as the display of past purchases and the creation of personal wish lists to place them on hold for later purchases. You can access, update, supplement or erase information on your customer account at any time. Creating your personal customer account requires the below personal data:
(1)    your given and family name;
(2)    your physical and email address;
(3)    a freely selectable password.
All other Data is provided on a voluntary basis. Following successful registration, you automatically receive a confirmation by email requesting you to confirm acceptance of the Privacy Policy once again to create the customer account (double opt-in procedure).
ESCADA Online GmbH may also evaluate and combine your personal data with other Data to pre-pare statistical evaluations concerning the purchasing behaviour and the ESCADA products pur-chased on the E-Store.

2. Legal Basis for Data Processing
The legal basis for processing the Data transmitted and processed under your consent to creating and providing a customer account is point (a) of Art. 6(1) GDPR and that for statistical evaluations is point (f) of Art. 6(1) GDPR.

3. Data Contract Purpose
ESCADA Online GmbH processes your personal data to create and provide the customer account. The company processes information on your orders and wish lists to learn more about you, to tailor offers to your needs and to prepare statistical evaluations.

4. Retention Period
root360 stores your Data on certified Amazon Web Services servers and uses this information for the intended purpose on our behalf and for service optimisation. However, root360 will not inde-pendently use your Data, such as for establishing contacts, or transmit it to third parties.
The Data will be erased as soon as it is no longer required to achieve the purpose of its collection. For personal data, this is the case when you withdraw your consent to processing and/or when the customer account is deleted.

5. Objection and Elimination Option
This Data is processed for you on a voluntary basis; however, if you do not provide ESCA-DA Online GmbH with your personal data, particularly that required to create the customer account, ESCADA is prevented from offering this service to you.
The user can withdraw his or her consent to personal data processing at any time. Withdrawal of your consent means that we no longer process your Data for this purpose and that your customer account is deleted. You may terminate this at any time by clicking on the link in the newsletter or by referring to the contact information under I. and II.

XII.3. Use of Logistics and Payment Services Providers
1. Description and Scope of Data Processing
To process your order, ESCADA Online GmbH transmits personal data to Escada Logistik GmbH (Austria) required for delivering the goods which you ordered pursuant to valid data protection provisions and required security measures. We concluded an order processing agreement in terms of the GDPR with Escada Logistik GmbH as the contractor. Escada Logistik GmbH, in return, employs logistics service providers, e.g. DHL, DHL Express and UPS, to deliver the goods. We concluded agreements with the above service providers, too, pursuant to data protection law to protect your Data. To deliver your order, Escada Logistik GmbH and, consequentially, the logistics service pro-viders employed, will be provided with the email address which you indicated to ESCADA Online GmbH for the order to inform you about the time of order delivery.
Depending on the means of payment you select, Data required for payment processing will be trans-ferred to the relevant financial institution, credit card company, Pay-Pal (Europe) S.à.r.l. & Cie. S.C.A., Klarna GmbH or Amazon Pay. Adyen B.V., our Netherlands-based service provider, oversees the technical connection of the payment service providers and we concluded a data protection contract with Adyen B.V. as required under Art. 28 GDPR.
Depending on the country, the following payment service providers may be available:
(1)    Amazon Payments Europe S.C.A, pay.amazon.de
(2)    American Express
(3)    Bancontact Card
(4)    Carte Bancaire
(5)    Diners Club
(6)    Sofortüberweisung
(7)    Discover
(8)    Dotpay
(9)    Finnish E-Banking
(10)    GiroPay
(11)    iDeal
(12)    Klarna Invoice
(13)    Maestro
(14)    MasterCard
(15)    PayPal
(16)    Paysafecard
(17)    SEPA Direct Debit
(18)    VISA
Regarding the processing of your Data by these payment service providers, we refer to their terms of use and privacy policies.
Should you select the payment option of Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg (hereinafter "Amazon"), you will be referred to the Amazon website pay.amazon.de during the check-out where you log on to your customer account, accept their terms and conditions of use when using this for the first time (if you are request to do so) and complete the transaction. From the time of referral, Amazon is responsible for the entire process.

2. Legal Basis for Data Processing
The legal basis for ESCADA Online GmbH transferring the Data to logistics and other service pro-viders, based on the fulfilment of purchase contract duties, is point (b) of Art. 6(1) GDPR.

3. Data Processing Purpose and Retention Period
Transfer of your Data to different service providers exclusively serves the fulfilment of contract duties by ESCADA Online GmbH and, hence, this is subject to legal retention duties.

XII.4. Identity and Credit Checks for Certain Klarna Types of Payment
1. Description and Scope of Data Processing
The E-Store offers different payment options. If you select the payment option provided by Klar-na GmbH, Theresienhöhe 12, 80339 Munich, Germany (“Klarna”; see https://www.klarna.com/de/), a partner of ESCADA Online GmbH, the check-out process requires you to transfer to Klarna any Data necessary for payment processing, identity and credit checks and, if applicable, to consent to the factoring company co-operating with Klarna. Should you consent to this, your Data (given and family name, street, number, post code, city/town, date of birth, telephone number) and Data related to the order will be transferred to Klarna and a factoring company possibly co-operating with Klarna.
For internal identity and credit checks, Klarna or partners commissioned by them transfer the Data to credit agencies which provide them with information and, if applicable, credit standing data based on mathematical-statistical processes in relation to which calculations include, amongst other things, address data. For detailed information on this and the credit agencies involved, please refer to the Klarna GmbH Privacy Policy at https://www.klarna.com/de/datenschutz/.
Klarna might also use third-party auxiliary means to detect and prevent cases of fraud. Third parties might encrypt and store any Data obtained through these auxiliary means so that only Klarna can read them. Only if you select a payment option provided by Klarna, our co-operation partner, will this Data be used; otherwise, the system automatically deletes this Data after a 30-minute period.

2. Legal Basis for Data Processing
The legal basis for transferring Data to Klarna pursuant to your consent given during the order pro-cess and the relationship under the purchase contract is point (a) and (b) of Art. 6(1) GDPR.

3. Data Processing Purpose and Retention Period
The transfer of Data provided by you is required to process the purchase contract. Klarna processes your Data only for their internal identity and credit checks; ESCADA Online GmbH does not store this Data.

XIII. Advertising and Marketing Services
XIII.1. Use of Google DoubleClick
1. Description and Scope of Data Processing
The Website and the E-Store use the “DoubleClick” service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland to present interesting ESCADA SE products to you in the context of personalised advertising. DoubleClick uses “cookies” for this, text files stored on your computer and enabling an analysis of how you use the Website and the E-Store. The cookies which DoubleClick places contain no personal data; however, they assign a pseudonymous identification number to your browser and store this. Based on this identification number, DoubleClick checks which advertisements were displayed and called off in your browser.
DoubleClick cookies enable Google and their partner websites to display advertisements based on previous Website, E-Store or third-party website visits on the internet in an inventory of websites which you visited. The information generated by the cookie is transmitted to and stored on a Google server in the US. Google transfers Data to third parties solely based on legal requirements or in relation to the processing of an existing data processing contract which Google concluded with these third parties. According to Google, your Data is not combined with other data collected by Google; however, we are unable to check this in detail due to the different areas of responsibility.

2. Purpose and Legal Basis for Data Processing
The stated processing purposes are in our legitimate interest (point (f) of Art. 6(1) GDPR). It is im-portant to us to inform our customers about our Website and ESCADA products and to provide them with targeted, personalised and advertisements which are of interest to them.

3. Objection and Elimination Option
Google provides you with an opt-out possibility preventing your usage and surfing behaviour from being stored by cookies and processed by Google. Please download and install the browser plug-in available under the below link at “DoubleClick de-activation extension” (https://support.google.com/ads/answer/7395996?hl=de). Further information and the Google Priva-cy Policy is available at: http://www.google.com/policies/technologies/ads/ or http://www.google.de/policies/privacy/.
As an alternative, you can also prevent DoubleClick cookies from being placed by adjusting your Google settings (https://adssettings.google.com/) or cookies placed by Google from being stored by accordingly changing your browser settings. However, ESCADA SE and ESCADA Online GmbH point out that you will not be able to fully use the Website and/or the E-Store in the case of de-activation and/or an opt-out.

XIII.2. Use of Google Retargeting
1. Description and Scope of Data Processing
This Website and the E-Store use re-targeting technologies. To this end, ESCADA SE and ESCADA Online GmbH use the re-targeting service ofGoogle Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland only for marketing purposes. These re-targeting technologies enable ESCADA SE and ESCADA Online GmbH to display to you advertisements and product highlights on our partners’ websites. By displaying these personalised advertisements of interest to you, ESCADA SE and ESCADA Online GmbH try and display interesting and adequate advertisements instead of impersonal offers. These re-targeting technologies use cookies, i.e. text files stored on your computer and allowing to analyse your use of the website. These cookies store no personal data and combine no user profiles with your personal data and valid legal data protection provisions are complied with at the same time.
Further information and the Google Privacy Policy is available at: http://www.google.com/policies/technologies/ads/ or http://www.google.de/policies/privacy/.

2. Purpose and Legal Basis for Data Processing
The stated processing purposes are in our legitimate interest (point (f) of Art. 6(1) GDPR). It is im-portant to us to inform our customers about our Website and its contents.

3. Objection and Elimination Option
Most browsers are set so that they accept cookies automatically. You can deactivate the saving of cookies, however, or set your browser so that you are notified as soon as the cookies are placed. If you wish to do this, you must change the relevant settings under the “Preferences” or “Options” browser menus. Please consult the documentation and the online help of your browser to see how you can delete cookies from your computer. However, ESCADA SE and ESCADA Online GmbH would like to inform you that some Website and/or E-Store functions might not or no longer be usa-ble for you.

XIII.3. Use of Google AdWords Conversion Tracking
1. Description and Scope of Data Processing
ESCADA SE and ESCADA Online GmbH use the “Google AdWords” advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. This program uses the conversion tracking analysis service to display ESCADA SE advertisements and to measure their penetration, whereby conversion tracking is based on placing “cookies”. These are text files which are stored on your terminal (tablet, smartphone, etc.) and allow for an analysis of how you use our Website. Once you click on an ESCADA SE advertisement displayed by Google, the conversion tracking functions place a cookie on your computer. Conversion cookies are valid for 30 days and they contain no personal data which is why identification is impossible.
By placing cookies, ESCADA SE, ESCADA Online GmbH and Google recognise that you clicked on the ESCADA SE advertisement and that you were referred to the ESCADA SE Website or the ES-CADA Online GmbH E-Store. Each Google AdWords customer is provided with another cookie so that tracing cookies back through websites from other AdWords customers is prevented.
Based on existing cookies, Google prepares conversion statistics for ESCADA SE and ESCA-DA Online GmbH which contain anonymised and aggregated information, e.g. the total number of users who clicked on our advertisement prior to being referred to the Website or the E-Store.

2. Purpose and Legal Basis for Data Processing
The stated processing purposes are in our legitimate interest (point (f) of Art. 6(1) GDPR). We con-sider the attractive configuration of our Website and enhancement of the interaction with our users with the use of the service to be important. Apart from that, advertising is required to fund the Web-site.

3. Objection and Elimination Option
If you do not want to take part in the conversion tracking, you can object to its use by setting your browser accordingly, which will prevent the cookies from being installed. This means that you will not be included in the conversion tracking statistics. Further information and the Google Privacy Policy is available at: http://www.google.com/policies/technologies/ads/ or http://www.google.de/policies/privacy/.
However, ESCADA SE and ESCADA Online GmbH point out that you will not be able to fully use the Website and/or the E-Store in the case of de-activation and/or an opt-out.

XIII.4. Use of Google Remarketing
1. Description and Scope of Data Processing
ESCADA SE and ESCADA Online GmbH use the Google Remarketing and GA Audiences services provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland to analyse the customers’ behaviour and interests on the E-Store and the Website as a basis to prepare personalised advertisements which are of interest to them.
Google Remarketing and GA Audiences are based on placing “cookies”. These are text files which are stored on your terminal (tablet, smartphone, etc.) and allow for an analysis of how you use our Website. The relevant functions store anonymised information in a text file about your visit to and use of the Website and the E-Store. Should you access third-party websites inside the Google net-work, targeted advertisements for our products and offers will be displayed to you which relate to your interests.

2. Purpose and Legal Basis for Data Processing
The stated processing purposes are in our legitimate interest (point (f) of Art. 6(1) GDPR). It is im-portant to us to inform our customers about our Website and contents and to provide them with tar-geted, personalised advertisements of interest to them.

3. Objection and Elimination Option
Google offers a plug-in for download which permanently prevents the use of Google cookies (see https://support.google.com/ads/answer/7395996?hl=de). Further information and the Google Privacy Policy is available at: http://www.google.com/policies/technologies/ads/ or http://www.google.de/policies/privacy/.
As an alternative, you can also prevent DoubleClick cookies from being placed by adjusting your Google settings (https://adssettings.google.com/) or cookies placed by Google from being stored by accordingly changing your browser settings. However, ESCADA SE and ESCADA Online GmbH point out that you will not be able to fully use the Website and/or the E-Store inthe case of de-activation and/or an opt-out.

XIV. Use of customer feedback systems
XIV.1. Use of the zenloop customer feedback system
1. Description and scope of data processing
As part of our effort to measure satisfaction among our customers, we work together with zenloop GmbH, Brunnenstrasse 196, 10119 Berlin. zenloop is a business-to-business software-as-a-service platform that enables us to collect and analyse feedback from our customers via various channels. In this way, we can align our services to the needs of our customers, and thus improve our services.
When using the feedback tool, zenloop collects your public IP address, device and browser data, and the website from which you are using the feedback platform. zenloop also uses cookies and similar technologies to collect aggregated data regarding users. In addition, zenloop collects survey responses and your e-mail address on our behalf, to the extent that we make these available to zenloop (only with your express consent).

2. Purpose and legal basis for the data processing
The legal basis for data processing by zenloop is Art. 6 (1)(b) GDPR.
We have concluded an order processing agreement with zenloop pursuant to Art. 28 (3) GDPR and are convinced that zenloop has implemented suitable technical and organisational measures in such a manner that processing takes place in accordance with the requirements of the GDPR and guaran-tees the protection of your rights.

3. Option for objection and removal
The processing of data will take place only if you have voluntarily provided us with such data. If you do not provide ESCADA SE with your personal data as described above under XIV.1.1, ESCADA Online GmbH will not be able to offer you the service described in this section.

The user can revoke his consent to the processing of personal data at any time (see Section I of this Privacy Policy).

Cookies are stored on the user's computer and transmitted to our site by the user. As such, you - as a user - have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also take place automatically. If cookies are deactivated for our website, it is possible that all functions of the website can no longer be used to their full extent.

XV. Social Media
XV.1. Use of Social Media Plug-Ins and the Like Button
1. Description and Scope of Data Processing
On their Website and the E-Store, ESCADA SE and ESCADA Online GmbH use social plug-ins of the facebook.com social network operated by Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, United States (“Facebook”), Twitter, Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, United States (“Twitter”), Pinterest, Inc., Delaware, 808 Brannan Street, 94103 San Francisco, California, United States (“Pinterest”), Instagram LLC, represented by Kevin Systrom and Mike Krieger, 1601 Willow Rd., Menlo Park, CA 94025, United States (“Instagram”), YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States (“YouTube”) and LinkedIn Ireland Unlim-ited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). You can recognise the provider of social plug-ins by the first letters of its name being marked on the box or the logo.
Facebook, Twitter, Instagram, Pinterest, YouTube and LinkedIn (“Social Media Platform”) directly transfer social plug-in contents to your browser which integrates them into the Website. This means that, when you visit our Website, no personal data will be initially transferred to the social plug-in providers. However, we provide you with the possibility to communicate directly with the plug-in pro-vider by using the button. Only if you click on the highlighted box, thereby enabling it, is the plug-in provider informed that you have accessed the corresponding page on our online offer.
ESCADA SE and ESCADA Online GmbH have no influence on the extent of data which Social Media Platforms collect through the plug-ins and provide information to you based on what they know: The social plug-ins inform the Social Media Platforms about you having accessed the relevant ES-CADA SE and ESCADA Online GmbH web page. Hence, by activating the social plug-in, your per-sonal data will be transferred to and stored with the respective social plug-in provider (in the case of the US Social Media Platform providers, in the United States). As the social plug-in provider mainly collects Data by using cookies, we recommend erasing all cookies by changing your security set-tings of your browser before clicking on the disabled box. ESCADA SE or ESCADA Online GmbH have no influence on the Data collected by the above Social Media Platforms and the data processing activities and they have no information on the data collection extent, processing purposes and retention periods. Further, we do not have any information on the erasure of the data which is collected by the social plug-in providers. The Social Media Platform usage and data protection provisions apply.
If you are logged on to any of these Social Media Platforms, they can allocate this information to your account; this applies also if you use a social plug-in (e.g. clicking on the “Like” button). In this case, the relevant information is transferred to and stored with your personal Social Media Platform user account. ESCADA SE and ESCADA Online GmbH have no influence on the social plug-in con-tents or information transmission to the Platforms. For additional information on the data processing purpose and scope, your rights and the settings to protect your privacy, please refer to the Facebook and Instagram privacy policies at http://www.facebook.com/policy.php, that of LinkedIn at https://www.linkedin.com/legal/privacy-policy, that of Twitter at http://twitter.com/privacy, that of YouTube at https://policies.google.com/privacy?hl=de&gl=de and that of Pinterest at http://pinterest.com/about/privacy/.
The social plug-in provider will save the Data collected on you as a user profile and use it for the purposes of advertising, market research and/or the custom configuration of its website. Data (in-cluding data of users who are not logged in) is evaluated this way to provide custom advertising and to inform other social network users about you using our Website.

2. Purpose and Legal Basis for Data Processing
The stated processing purposes, that is, offering a social plug-in, are in our legitimate interest (point (f) of Art. 6(1) GDPR). We consider the attractive configuration of our website and to enhance the interaction with our users with the use of the plug-in to be important.

3. Objection and Elimination Option
You have a right to object to this user profile being created, whereby you must refer to the relevant social plug-in provider to exercise this right since ESCADA SE or ESCADA Online GmbH is no long-er responsible for this after you left the Website or the E-Store. It is also possible to block social plug-ins through add-ons for your browser, e.g. through the “Facebook Blocker”. We point out that you can prevent this allocation by logging off from the relevant social media profile and deleting the cookies which the social media channel uses prior to accessing our Website or the E-Store.

XV.2. Use of YouTube
1. Description and Scope of Data Processing
The Website and the E-Store use a plug-in provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States (“YouTube”) to embed videos. YouTube directly transfers the plug-in con-tents to your browser via a connection to the YouTube servers which then embed them in the Web-site. This way, YouTube is informed that you accessed the Website or the E-Store.
If you are logged on to your YouTube user account, plug-in use enables YouTube to allocate information which they obtained to your account. In this case, information is transferred to and stored with your YouTube user account. The following providers place cookies:
(1)    Doubleclick.net
(2)    Google.com
(3)    Youtube.com
Since YouTube mainly collects Data through cookies, ESCADA SE and ESCADA Online GmbH recommend erasing all cookies by changing your browser security settings.
We have no influence on the collected Data or the data processing procedures, nor are we aware of the full the data collection extent, the processing purposes, the retention periods or the storage loca-tion. Further, we have no information on the erasure of Data collected by YouTube. For more infor-mation on the data processing purpose and scope, on your rights and setting possibilities to protect your privacy, please refer to the YouTube use and data protection terms:
https://www.youtube.com/t/terms
https://policies.google.com/privacy?hl=de&gl=de

2. Purpose and Legal Basis for Data Processing
The stated processing purposes are in the legitimate interest of ESCADA (point (f) of Art. 6(1) GDPR). The controllers consider the attractive configuration of the Website and the E-Store and the enhancement of interaction with the users and customers by using the plug-in to be important.

3. Objection and Elimination Option
Under European and German law, you have a right to object to the creation of user profiles and/or allocation, whereby you need to refer to the plug-in provider and/or YouTube to exercise this right.
We also point out that you can prevent this allocation by logging off from your YouTube profile and deleting YouTube cookies prior to accessing our Website or the E-Store.

XV.3. Use of Facebook Connect
1. Description and Scope of Data Processing
ESCADA Online GmbH offers the use of Facebook Connect provided by Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, United States (“Facebook”) to directly register by using your Facebook profile and/or to create a user account. By using this function, that is, by con-necting your Facebook user account with our Website, you agree to us accessing basic user data stored on your Facebook user account to the extent required to establish, execute and process con-tracts and orders. It goes without saying that we have no access to your Facebook log-in infor-mation. When using this function, Facebook tells you which data they may transfer to us (e.g. public profiles, email addresses and current places of residence) and request you to confirm. ESCA-DA Online GmbH uses any data transferred to create your E-Store customer account. We do not permanently combine your E-Store customer account and your Facebook account. For further in-formation on the purpose and the extent of the Data collection and processing by Facebook and on your associated rights and settings options for the protection of your private sphere, please refer to the privacy policy of Facebook at https://www.facebook.com/about/privacy/

2. Purpose and Legal Basis for Data Processing
The legal basis for the transfer of Facebook data to ESCADA Online GmbH to create the user ac-count is, based on your consent, point (a) of Art. 6(1) GDPR.

XV.4. Use of Look-Alike-Audience and Facebook Custom Audience
1. Description and Scope of Data Processing
To evaluate and display advertisements on Facebook, ESCADA SE and ESCADA Online GmbH use a “Facebook pixel” provided and evaluated by Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, United States (“Facebook”).
Based on the Google Tag Manager, ESCADA embeds a pixel in the Website and the E-Store allow-ing Facebook to evaluate how customers use the Website. This pixel establishes a direct connection between your browser and a Facebook server when accessing the Website allowing Facebook to collect, in a cookie, information on your browser, your terminal, the relevant website and, for exam-ple, the effect of Facebook advertisements. Then, Facebook provides ESCADA with such infor-mation based on anonymised and aggregated statistics. Thanks to this information, internal lists and Facebook Custom Audiences, ESCADA SE and ESCADA Online GmbH advertisements can be managed and placed in re-marketing or look-alike campaigns based on the surfing behaviour and the relevant classification. Should you access third-party websites or surf inside the Facebook net-work, targeted advertisements for our products and offers will be displayed to you which relate to your interests.
If you are logged in to your Facebook profile, Facebook is able to connect information collected by the pixel with your profile. If you have no Facebook account, you will not be considered for compari-sons in the context of look-alike campaigns.
For more information on data processing, please refer to the relevant Facebook and Instagram pri-vacy policies at http://www.facebook.com/policy.php.

2. Purpose and Legal Basis for Data Processing
The legal basis for the processing of Data using a pixel is point (f) of Art. 6(1) GDPR. The legal basis for performing look-alike campaigns based on lists is point (a) of Art. 6(1) GDPR. It is important to us to inform our customers about our Website and contents and to provide them with targeted, person-alised advertisements of interest to them.

3. Objection and Elimination Option
You have the right to object to the creation of these user profiles; if you intend to exercise this right, it is necessary for you to contact Facebook. At https://www.facebook.com/ads/website_custom_audiences/, Facebook members can change their Facebook settings and object to data collection by Custom Audiences. We also point out that you can prevent this allocation by logging off from the relevant social media profile and deleting the cookies which the social media channel uses prior to accessing our Website or the E-Store.

XV.5. Reception of Personal Data by Using Social Media Profiles
1. Description and Scope of Data Processing
To evaluate the user behaviour, Facebook, that is Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, United States (“Facebook”) and Instagram, that is Instagram LLC, 1601 Willow Rd., Menlo Park, CA 94025, United States (“Instagram”) collect personal data. Face-book and Instagram provide some of this data to fan page operators in an anonymised manner. For statistical evaluations and advertising our offers, ESCADA SE collects and processes the data which we receive from our Facebook and Instagram profiles and pages.
If you are not registered with Facebook or Instagram, ESCADA SE receives no data from Facebook and Instagram concerning your visit to or the use of ESCADA profiles and pages. However, we point out that a notice of access to our profiles and pages, e.g. by reading log files (IP addresses), or of Facebook and Instagram placing cookies is possible. ESCADA SE has no influence on the collected Data or the data processing procedures, nor are we aware of the extent of the Data which is collected, the purposes of the processing or the retention periods. For this reason, data transfer via anon-ymised statistics cannot be excluded.
If you follow/subscribe to or like the ESCADA pages and profiles, Facebook and/or Instagram adds your profile to a list of all the fans and subscribers and provides us with this list. However, they only check and transfer to us any public information on your profile. In addition, we are able to allocate comments on our Facebook pages to individual users. By changing your Facebook/Instagram set-tings accordingly, you decide which information from your profile is displayed or who can see your postings and/or comments. Apart from that, the Facebook settings (https://www.facebook.com/settings?tab=privacy) make it possible to actively hide your likes and to no longer follow the fan page. If you do so, your profile is deleted from the list of fans of ESCA-DA fan pages.
Based on “Insights”, Facebook and Instagram provide us with statistics on fans, subscribers and individuals we reached. These statistics represent anonymous demographic Data, e.g. the age, gender, place of living, country or mother tongue with no relation to identifiable individuals. We re-ceive other statistics concerning the source of the access, the type of terminal used for access or the call-off of pages. ESCADA SE uses these statistics to select information relevant for our Facebook and Instagram posts and to commission Facebook with placing advertisements aimed at certain groups. You can change your Facebook settings in a way that you object to targeted advertising at any time. We use only such data provided by Facebook and Instagram which is required for the above purposes; we do not call off or process data other than that provided to us.
Apart from that, we are unable to combine statistical data with our fans’ and subscribers’ profile data.
For more information on data processing, please refer to the relevant Facebook and Instagram privacy policies at http://www.facebook.com/policy.php.

2. Legal Basis for Data Processing
The legal basis for us processing the Data is point (f) of Art. 6(1) GDPR. Concerning joint responsi-bility in terms of Art. 26 GDPR, Facebook provided the below regulations: https://www.facebook.com/legal/terms/page_controller_addendum.

3. Purpose of Data Processing
We use the statistics provided by Facebook and Instagram on the basis of “Insights” to select information relevant for our Facebook and Instagram posts and to commission Facebook with placing advertisements aimed at certain groups. The stated processing purposes are in our legitimate interest (point (f) of Art. 6(1) GDPR).

XVI. Rights of Data Subjects
If your personal data is processed, you are the data subject under the GDPR entitled to the below rights towards the controller, that is, towards ESCADA SE and/or ESCADA Online GmbH:

1. Right of Access
You can request confirmation from the controller whether we process personal data relating to you.
If such processing takes place, you can request the controller to provide you with the following in-formation:
(1)    the purposes of personal data processing;
(2)    the categories of personal data concerned;
(3)    the recipients or categories of recipients to which the personal data relating to you have been or are to be disclosed;
(4)    the envisaged period for which the personal data concerning you will be stored, or, if not possible, the criteria used to determine that period;
(5)    the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
(6)    the right to lodge a complaint with a supervisory authority;
You have the right to obtain access to information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
To exercise your free right to information, please contact us directly via the contact details that are provided in our legal notice, or make direct contact with our Data Protection Officer (refer to sections I and II).

2. Right to Rectification
You have a right to rectification and / or completion vis-à-vis the controller if the processed personal data related to you is incorrect or incomplete. The controller must perform rectification immediately.

3. Right to Restriction of Processing
You have the right to obtain restriction of processing of the personal data concerning you where one of the following applies:
(1)    if you contest the accuracy of the personal data relating to you for a period that enables the controller to verify accuracy of the personal data;
(2)    the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
(3)    if the controller no longer needs the personal data for the purposes of processing, but you need them to assert, exercise or defend legal claims, or
(4)    if you have objected to processing pursuant to Art. 21(1) GDPR, pending the verification whether the legitimate grounds of the controller override your legitimate grounds.
Where the processing of the personal data concerning you has been restricted, such data may, with the exception of its retention, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where processing has been restricted pursuant to the aforementioned conditions, you will be noti-fied by the controller before the restriction is lifted.

4. Right to Erasure
a)    Erasure Obligation
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller has the obligation to erase such data without undue delay where one of the following grounds applies:
(1)    the personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
(2)    you withdraw your consent on which processing is based according to point (a) of Art. 6(1) GDPR and there is no other legal ground for processing.
(3)    you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legiti-mate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR;
(4)    the personal data concerning you has been unlawfully processed;
(5)    the personal data concerning you has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(6)    the personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.
b)    Information to Third Parties
Where the controller made your personal data public and is obliged pursuant to Art. 17(1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of im-plementation, will take reasonable steps, including technical measures, to inform controllers who are processing the personal data that you, as a data subject, requested the erasure by such controllers of any links to, or copy or replication of, that personal data.
c)    Exceptions
The right to erasure does not apply to the extent that processing is necessary
(1)    for exercising the right of freedom of expression and information;
(2)    for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3)    for the establishment, exercise or defence of legal claims.

5. Right to be informed
If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the con-troller, the controller is obliged to communicate such rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you was disclosed, unless this turns out to be impossible or results in unreasonable burdens.
You have the right vis-à-vis the controller to be informed of such recipients.

6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided, where
(1)    the processing is based on consent in terms of point (a) of Art. 6(1) GDPR and
(2)    the processing is carried out by automated means.
In exercising such a right, you further have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adverse-ly affect the rights and freedoms of others.
The right to data portability does not apply to any personal data processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to the pro-cessing of personal data concerning you that is based on point (e) or (f) of Art. 6(1) GDPR.
In this case, the controller no longer processes your personal data, unless the controller demon-strates compelling legitimate grounds for processing which override your interests, rights and free-doms or for the establishment, exercise or defence of legal claims.

8. Right to Withdraw Consent Under Data Protection Laws
You have the right to withdraw your consent under data protection laws at any time. The withdrawal of consent does not affect the lawfulness of processing based on such consent before its withdraw-al.

9. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a com-plaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
The data protection authority responsible for our company is the Bavarian State Office for Data Protection, address, Promenade 18, 91522 Ansbach, Germany, postal address: Postfach 1349, 91504 Ansbach, Germany, further information is available in the internet at www.lda.bayern.de.

XVII. Links to other websites
This declaration regarding data protection only applies to the ESCADA SE and ESCADA Online GmbH websites. The web pages of this website can contain links to third party websites. Our privacy policy does not apply to such websites. If you leave our Website and/or the E-Store, we recommend that you carefully read the data protection provisions of each website which collects personal data.

XVIII. Security
ESCADA SE and ESCADA Online GmbH apply the necessary security measures to protect your personal data against accidental or deliberate manipulation, erasure, modification or loss, as well as unauthorised forwarding to other persons. We encrypt your data when it is transferred to our website and make use of SSL connections (Secure Socket Layer). We apply the appropriate technical and organisational measures to protect our website and other systems and personal data against, in particular, loss, destruction, unauthorised access, modification and forwarding to third parties.

XIX. Availability and Amendments
You can obtain a Privacy Policy copy at any time on the company Website and on the E-Store. You can also save or print out this Privacy Policy by using the appropriate functions of your browser.
In the case of differences between the English, French and German version, the German original prevails.
We reserve the right to amend this privacy policy from time to time and to adapt it according to the statutory requirements, and therefore request you to refer to our Privacy Policy as amended every time you visit our Website and/or the E-Store.

Version: April 2019