Zalando Privacy Notice

Profile information is personal and demographic information on your person (so-called master data), along with your individual interests, which you share with us when registering for Brand Hub. Your profile data includes, for example:

• Your first and last names
• Your contact details

Mandatory information is usually your name, your email address and a password you choose yourself.  Your user name and the password will later constitute your login details.

Tip
If you are logged into Brand Hub, you can view your personal data there and can usually edit it directly there, e.g. in order to update your email address after a move.

If you contact us, we collect your data. Depending on how you contact us (e.g. by phone or by email), your contact details may include your name, postal addresses, telephone numbers, fax numbers, email addresses, detail on your social network profiles (for example we receive your Facebook ID if you contact us via Facebook), user names and similar contact details.

If you communicate with us or other users regarding products (e.g. product evaluations) and other topics by phone, post, social media, contact forms or any other medium, we collect the content of your messages.

We may forward your messages to the office responsible for your concerns, perhaps to partner companies or manufacturers. If your messages are forwarded to another company (e.g. if you provide us with feedback on the manufacturer of a product), you of course have the option to tell us that the data should only be used by Zalando. If so, we will not forward your information to the responsible office, or will only do so without your personal information, provided that your concerns can be processed in this way.

If you transmit messages to us for other users via functions provided for this purpose (e.g. product evaluations), we may publish these within the scope of our services.

Zalando also uses social network services such as Facebook, Instagram and Twitter to communicate with customers and users. We use these popular platforms to offer you further contact and information options beyond our in-house communication channels. Please bear in mind, however, that we do not have any influence on the terms of use for social networks and the services they offer, and only limited influence on their data processing. We therefore ask you to carefully check which personal data you share with us via social networks. We cannot influence the behaviour of social media operators, other users or third parties who may work with the operators of the social networks or also use these services.

Zalando maintains profile pages (also called "fan pages") on various social networks. Additionally, Zalando services may incorporate social networking features. These can be social links.

Please also refer to the notes on the processing of social network data related to social network features under 3. Info on websites and 4. Information about Social Media Fan Pages.

Zalando currently uses the Facebook messenger service and social links for the following social networks:

• Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, IrelandFacebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). The link to Facebook's privacy policy is available here: Facebook's Data Policy.
• Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (“Twitter”). The link to the Twitter's privacy policy is available here: Twitter’s privacy policy.
• LinkedIn Corp., 1000 W. Maude Ave., Sunnyvale, California 94085, USA (“LinkedIn”). The link to LinkedIn’s privacy policy is available here: LinkedIn’s Privacy Policy.
• Pinterest Inc., 635 High Street, Palo Alto, CA, USA (“Pinterest”). The link to Pinterest's privacy policy is available here: Pinterest’s Privacy Policy. 
• Instagram by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Instagram”). The link to Instagram’s privacy policy is available here: Instagram’s Privacy Policy. 
• YouTube by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The link to Google’s privacy policy is available here: Google’s Privacy Policy

When using online and mobile services, it is inevitable that technical data will be generated and processed in order to provide the features and content offered and to display them on your device. We refer to this data as "Device and Access Data". Device and Access Data are created whenever online and mobile services are used. It does not matter who the provider is. Device and Access Data are therefore created, for example, when using:

• Websites
• Apps
• Social media fan pages
• Email newsletters (i.e. if your newsletter interaction is recorded)
• Location-based services

Zalando collects device and access data for online and mobile services offered by Zalando itself (e.g. Zalando Shop). Additional information is available under 4. Information about Social Media Fan Pages.

Device and access data includes the following categories:

• General device information, such as information on the device type, operating system version, configuration settings (e.g. language settings, system authorisations), information on internet connection (e.g. name of the mobile data network, connection speed) and on the app used (e.g. name and version of the app).
• Identification data (IDs), such as session IDs, cookie IDs, unambiguous device ID numbers (e.g. Google advertising ID, Apple Ad ID), third party account IDs (if you use social plug-ins or social logins or pay by PayPal) and other common internet technologies, to facilitate recognition of your web browser, your device or a particular app installation.
• Access data automatically transmitted by apps and web browsers whenever you access web servers and databases (within the framework of so-called HTTP requests). This is standardised information on the required content (such as the name and file type of a retrieved file) as well as further information on server access (such as amount of data transferred and error codes), on your device (e.g. device type, operating system, software versions, device identifications, IP address, the site previously visited and the time of access).

We process your data in the necessary scope to fulfil contracts and to provide and execute further services requested by you, as described in this Privacy Notice. The purposes of the necessary data processing therefore depend on the purpose of the contract agreed with you (including our General Terms and Conditions and any service-specific terms and conditions or terms of use) or services requested by you. The most important purposes are:

• The provision of messages, reports, newsletters and other direct communication, insofar as these are an integral component of our contractual services or the services requested by you. The guarantee of the general security, operability and stability of our service including defence from attacks.
• Non-promotional communication with you on technical, security-related and contractually relevant subjects (e.g. fraud warnings or account blocking).

Legal Basis:
Insofar as the purpose relates to the execution of a contract agreed with you or the provision of a service requested by you, the legal basis is Article 6 (1) b GDPR. Otherwise, the legal basis is Article 6 (1) f GDPR, whereby we may use your personal data for the above purposes if we deem it necessary to do so for our legitimate interests.

In order to combat the risk of data security breaches, data pertaining to users of our services is encrypted in transmission. This applies both to ordering and to registering for a customer account. For this we use the coding system SSL (Secure Socket Layer). Encryption prevents third parties from viewing the data. To provide additional protection from external attacks, we rely on special security technologies which constantly check our systems and identify and report anomalies. We also use technical and organisational measures to secure our systems against loss, destruction, unauthorised access or distribution of customer data by unauthorised persons. In this manner we wish to keep the risk of unauthorised access as low as possible, because protecting your data is our top priority. However, we - like other companies - cannot guarantee absolute protection.

Legal basis:
If your data is processed to prevent fraud at your expense, the legal basis is Article 6 (1) b GDPR. This processing of your data otherwise occurs on the basis of Article 6 (1) f GDPR, based on our legitimate interest and that of other users in the identification and prevention of fraud and clarification of criminal offences.

We transmit and process your data where necessary for administrative and logistical processes and to optimise business processes within Zalando Group in order to design these in a more efficient and legally secure way and to fulfil our contractual and legal obligations (e.g. retention obligations under commercial and tax law). Many systems and technologies are shared within Zalando Group. This allows us to offer a more economical, secure, unified and personalised service. Therefore, various companies within the Zalando Group have access to your data in so far as this is necessary for the fulfilment of the purposes named in this Privacy Notice.

Example
If you contact Zalando customer service, your request is forwarded to Zalando Customer Care DACH SE & Co. KG and processed there. Zalando Customer Care DACH SE & Co. KG is responsible for customer service in the German-speaking area within the Zalando Group. If this is necessary for the processing of your concern, a customer service employee from Zalando Customer Care DACH SE & Co. KG may access the data stored on you by other Zalando companies, for example your order data (e.g. in order to clarify your questions regarding a return).

Data processing for business management and business optimisation also includes, for example, the following purposes:

• The execution and improvement of customer service.
• The prevention and clarification of criminal offences.
• Guaranteeing the security and operability of our IT systems.

Legal basis:
The legal basis for the processing of your data for business management and optimisation is Article 6 (1) f GDPR, whereby our legitimate interests are in the above purposes. Where we process your data on the basis of legal specifications, e.g. retention obligations and money laundering tests under tax law, the legal basis is Article 6 (1) c GDPR.

If you have given us your consent for the processing of personal data, your consent is the primary basis of our data processing. Which of your data we process on the basis of your consent depends on the purpose of your consent. Typical purposes include:

• Subscription to a newsletter.
• Participation in surveys.
• The processing of particularly sensitive data, containing e.g. your political opinions, religious or ideological convictions or state of health.
• The recording of telephone conversations which you have e.g. with our hotline.
• The transmission of your data to third parties or to a country outside the European Union.
   

Notices of withdrawal
You can withdraw consent at any time with effect for the future, e.g. by email, letter or fax.
If the relevant service supports this function, you can adjust and withdraw consent to receive newsletters and other notifications in the preference centre. You can find the link to the preference centre in each newsletter. Each newsletter also contains a corresponding unsubscribe link.

You can find further instructions under 7. Which data protection rights do I have?

If data protection law allows it, we can use your data for new purposes such as carrying out data analyses and developing our services and content without your consent. It is a prerequisite for this that these new purposes which the data is to be used for were not fixed or foreseeable when the relevant data was collected and the new purposes are compatible with the purposes for which the relevant data was originally collected. For example, new developments in the legal or technical sphere and new business models and services may lead to new processing purposes.

You can find the responsible service provider in the imprint of the relevant website.

We generally collect all the data which you directly share with us via our services.

Device and Access Data

Whenever you access our services and databases, we collect device and access data and record it in so-called server log files. The IP address it contains is anonymised shortly after the end of the relevant session, as soon as storage is no longer required to maintain the functionality of the relevant website.

If it is available and activated on your device, we also collect a device-specific ID number (e.g. a so-called “promo ID” if you are using an Android device or an “ad ID” if you are using an Apple device). This device ID is issued by the manufacturer of your operating system and can be read by websites and apps and used to present content on the basis of your usage habits. If you do not want this, you can deactivate it at any time in your device’s browser settings or system settings.

Login

We set up password-protected personal access for users who register for a customer account or another service. If you do not log out again after logging in with your login details, most services automatically keep you logged in. Depending on the type of service, a cookie or similar technology is used for this. This function allows you to use part of our services without having to log in again every time. For security reasons, however, you will be asked to enter your password again if, for example, you want to change your profile information. 

Social Links

Our services may include social links from various social networks. With the help of these hyperlinks you can, for example, share content or recommend products. By clicking on the link, the social network receives the information that you have visited the corresponding website and collects your access and device data. If you are logged in to the social network, this can also assign the visit to your account in the respective social network. The purpose and scope of the data collection, and the further processing and use of the data by the particular social networks and your rights and configuration options concerning this to protect your privacy, can be found in the privacy notices of the respective social networks and websites. You can find the links to these below.

Facebook Social Links

We use social links by the social network facebook.com, operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”), on several websites. You can find the link to Facebook’s Data Protection Declaration here: Facebook’s privacy policy. 

Twitter Social Links

We use social links by the social network Twitter, operated by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (“Twitter”), on several websites. You can find the link to Twitter’s privacy policy here: Twitter’s privacy policy.

LinkedIn Social Links

We use social links by the social network LinkedIn Corp., 1000 W. Maude Ave., Sunnyvale, California 94085, USA (“LinkedIn”), on several websites. You can find the link to LinkedIn’s privacy policy here: LinkedIn’s Privacy Policy. 

Pinterest social links 

We use social links by the social network Pinterest, operated Pinterest Inc., 635 High Street, Palo Alto, CA, USA (“Pinterest”), on several websites. You can find the link to Pinterest’s privacy policy here: Pinterest’s Privacy Policy. 

Instagram social links

We use social links by the social network Instagram by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Instagram”), on several websites. You can find the link to privacy policy here: Instagram’s Privacy Policy. 

YouTube social links

We use social links by YouTube by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“YouTube”). You can find the link to Google’s privacy policy here: Google’s Privacy Policy.

Info on website cookies and similar technologies

Our websites use cookies and comparable technologies, which are provided either by Zalando or by third-party service providers.

What are cookies and similar technologies?

Cookies are small text files which are saved by your web browser and which save particular settings and data for exchange with our web server. Similar technologies are in particular web storage (local / session storage) fingerprints, tags or pixel. 

Cookies are not used to execute programs or load viruses onto your computer. The primary purpose of cookies is to provide an offer tailored to you and to make our services as time-efficient as possible. Most browsers are set by default to accept cookies and similar technologies. However, you can usually adjust your browser settings so that cookies or similar technologies are rejected or only stored with your prior consent. If you reject cookies or similar technologies, it is possible that not all of our offers will function properly for you.

This website uses the following cookies and similar technologies:

• Necessary cookies: These cookies are required for optimal navigation and operation of the website. The necessary cookies also serve to save particular inputs and settings which you have made so that you don’t have to constantly repeat them, and to adapt Zalando content to your individual interests. Only limited use of the website is possible without necessary cookies.
  You can find more information about the necessary cookies in the Data Preferences. 
  Legal basis: The legal basis for the processing of your data is Article 6 (1) f GDPR, to enable comfortable and personalized use of our website. In certain cases, these tools may also be required for the fulfilment of a contract or for the execution of pre-contractual measures, in which case processing is carried out in accordance with Art. 6 (1) b GDPR.
   
• Web Performance and Analytics: In order to improve our website, we use tools for the statistical collection and analysis of general user behaviour based on access data ("Analytics Tools"). We also use Analytics Tools to evaluate the use of our various marketing channels.
  You can find more information about the Analytics Tools in the Data Preferences.
  Legal basis: The legal basis for the Web Performance and Analytics cookies is - unless otherwise stated - your consent according to Art. 6 (1) a GDPR. In the event that personal data is transferred to the USA or other third countries, your consent expressly extends to the data transfer (Art. 49 (1) a GDPR). If personal data is transferred to these third countries, there is a risk that personal data may be collected and analysed by authorities and that data subjects' rights guaranteed under EU law may not be enforced. If you consent to the use of cookies, your consent also extends to these data transfers to third countries and the processing there.

The responsible Zalando company, which acts as the content provider responsible of a fan page, is visible in the Legal Info of the respective fan page.

The Facebook and Instagram social networks are both provided by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook").

Insofar as you communicate directly with us via our fan pages or share personal content with us, Zalando shall be responsible for processing your data. An exception applies to the data processing for usage analysis (Page Insights) which is described in the following; in this case, we are jointly responsible with Facebook.

Processing of Your Data by Facebook
Please note that Facebook also processes your data when you use our fan pages for their own purposes, which are not covered in the Privacy Policy. We have no influence over these data processing operations of Facebook. In this regard, we refer you to the privacy policy of the respective social networks:

• Facebook’s Data Policy
• Instagram’s Privacy Policy

When you visit our fan pages, Zalando collects all communications, content and other information that you provide us directly, e.g. when you post something on a fan page or send us a private message. Of course, if you have an account on the social network, we can also see your public information, such as your username, information in your public profile, and content that you share with a public audience. For more information, see 1. Which data does Zalando process?

Usage Analysis (Page Insights)

Whenever you interact with fan pages, Facebook uses cookies and similar technologies to track the usage behaviour of fan page visits. On this basis, fan page operators receive so-called "Page Insights". Page insights contain only statistical, depersonalised (anonymised) information about visitors to the fan page, which can therefore not be assigned to a specific person. We do not have access to the personal information Facebook uses to create Page Insights ("Page Insights data"). Selection and processing of Page Insights data is performed exclusively by Facebook.

Page insights offer us information about how our fan pages are used, what interests visitors to our fan pages have, and what topics and content are particularly popular. This allows us to optimise our fan page activities, e.g. by better tailoring to the interests and usage habits of our audience when planning and selecting content.

Zalando and Facebook share responsibility for processing your data for providing Page Insights. For this purpose, we and Facebook have defined an agreement about which company fulfils the data protection obligations under the GDPR with regard to Page Insights data processing.

More about Page Insights
You can view the agreement with Facebook here: 
https://www.facebook.com/legal/terms/page_controller_addendum

Facebook has summarised the important parts of this agreement (including a list of Page Insights data) for you here:
https://www.facebook.com/legal/terms/information_about_page_insights_data

Legal bases:
If you have given consent to the creation of Page Insights data to Facebook, the legal basis is Article 6 (1) a GDPR (Consent). Otherwise, the legal basis is Article 6 (1) f GDPR, whereby our legitimate interests are in the above purposes.

Of course, your privacy rights described in 7. Which data protection rights do I have? also apply to the processing of your data in connection with our fan pages.

For the purposes of processing your Page Insights data with Facebook, we have agreed with Facebook that Facebook is primarily responsible for providing you with information about the processing of your Page Insights data and for enabling you to exercise your privacy rights under the GDPR (e.g. right to object). You can find more information about your data protection rights in connection with Page Insights and how you can exercise them directly with regard to Facebook:

https://www.facebook.com/legal/terms/information_about_page_insights_data 

Tip
You can also address your enquiry to Zalando; we will then forward your enquiry to Facebook.

When sending out our notifiable newsletters (such as the Zalando shop newsletter), we use the so-called double opt-in procedure or single opt-in procedure (country-dependent), i.e. we will only send you the newsletter if you have given explicit prior consent to us activating the newsletter. If a double opt-in is required in your country, you must also have confirmed that the email address you have shared with us belongs to you. For this purpose we will send you a notification email and ask you to confirm by clicking on one of the links in this email that you are the owner of the email address you have shared with us. We may waive this measure if you have already confirmed to us in this way for another purpose that you are the owner of this email address.

If you no longer wish to receive emails from us, you can withdraw your consent at any time without incurring any costs other than the transmission costs according to basic tariffs. A notification in text form (e.g. email, fax, letter) to the Zalando company responsible for the relevant newsletter is sufficient for this. Of course, you will also find an unsubscribe link in every newsletter.

If you subscribe to a newsletter, we automatically save your IP address and the time of your subscription and confirmation. This way we can prove that you actually subscribed and identify any unauthorised use of your email address.

We collect device and access data which arise when you interact with a newsletter. However, this data will not be evaluated.

Many systems and technologies are shared within the Zalando Group. This allows us to offer you a more economical, secure, unified and personalised service. Therefore, companies within the Zalando Group which require access to your data to fulfil our contractual and legal obligations, or to fulfil their respective functions within the Zalando Group, receive this access.

Examples
When you contact Zalando customer service, your request is forwarded to Zalando Customer Care DACH SE & Co. KG or Zalando Customer Care International SE & Co. KG and processed there. Both these Zalando companies are responsible for customer service within the Zalando Group. Where this is necessary to process your concerns, these two Zalando companies may access your data stored by other Zalando companies, for example your order data.

We work with technical service providers in order to be able to provide our services. These service providers include, for example, Telekom Deutschland GmbH, Salesforce.com EMEA Ltd. and Amazon Web Services, Inc. If they process your data outside the European Union, this may mean that your data is transmitted to a country with a lower data protection standard than the European Union. In such cases Zalando will ensure that the relevant service providers contractually or otherwise guarantee an equivalent data protection level.

If we are obliged by an official or court decision or it is for prosecution purposes, we will if necessary forward your data to prosecution authorities or other third parties.

• In order to ensure that your data is not disclosed to third parties in the course of requests for information, please attach sufficient proof of identity to your request by email or post.

Tip
It is generally sufficient for this if you send your request to us using the email address saved to your account.

• You can change most of your information yourself in your customer account. For other cases please contact customer service.
• The responsibilities of the data protection authorities depend on the seat of the competent authorities. You may, however, contact the data protection authority, which will then forward your complaint to the responsible authority. The authority responsible for Zalando is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
• If you have given consent for the processing of your data, you may withdraw it at any time. Withdrawal has no effect on the admissibility of the processing of your data which took place before the withdrawal.
• You may object to the processing of your data for advertising purposes, including direct marketing (including in the form of data analysis) at any time without giving reasons.
• If we are processing your data on the basis of balancing of interests according to Article 6 (1) f GDPR (e.g. the reporting of creditworthiness to an external credit agency), you may object to the processing. When asserting your objection, we ask you to give the reasons why you do not wish us to continue processing your data. In the event of a justified objection, we will check the state of affairs and either stop or adjust the processing, or inform you of the urgent reasons worthy of protection why we are entitled to continue the processing.