This notice provides information on the processing of personal data when participating in the OLYMP Insider loyalty programme.

6.1. Data controllers: The companies of the OLYMP Group listed in clause 1.2 of the Terms and Conditions of Participation, i.e. OLYMP Retail KG as the operator and the participating companies named therein, are joint data controllers for the OLYMP Insider loyalty programme (hereinafter also referred to collectively as “OLYMP” or “we”). They have set out in an agreement which of them fulfils which data protection obligations. This notice provides information on the processing of personal data when participating in the OLYMP Insider loyalty programme.

6.2. Data provided upon registration and participation

a. Registration for the OLYMP Insider loyalty programme

To register for the OLYMP Insider loyalty programme, you must first create a customer account with OLYMP. The mandatory details required when registering a customer account are title, first name, surname, street, house number, postcode, town, country and email address. OLYMP processes this basic data for the purposes of registration and the administration of the OLYMP Insider programme.

b. Separate contact details for security purposes

As part of the registration process, separate contact details may be provided for safety purposes – see Article 35(2) of the EU Product Safety Regulation. We will only use these contact details to contact you in the event of a recall or a safety warning.

c. Collecting, managing and redeeming points

All purchases made by OLYMP Insider participants are reported by the participating companies to OLYMP Retail KG. OLYMP Retail KG manages the personal points account and awards bonus points in the form of shopping vouchers. When a participant redeems a shopping voucher at one of the participating companies, the company in turn reports this to OLYMP Retail KG.

d. Programme information

OLYMP provides participants with information on the running of the programme, e.g. notifications regarding their points balance or additional opportunities to collect and redeem points via email (contractual communications). To this end, OLYMP processes the data provided during registration as well as that arising from the collection and redemption of points.

e. Further development of the OLYMP Insider loyalty programme

In order to offer the most attractive loyalty programme possible, OLYMP analyses participants’ data for planning purposes in the form of anonymous statistics. To this end, OLYMP may anonymise copies of participants’ data in such a way that the (original) data subject cannot be identified, or can no longer be identified.

f. Misuse and breaches

OLYMP analyses participants’ data to detect misuse, e.g. breaches of the terms and conditions of participation or attempts at fraud. To this end, OLYMP monitors participants’ behaviour regarding the collection, redemption and use of points in order to identify patterns typically associated with misuse (e.g. the almost simultaneous redemption of points at two locations that are far apart). Where there is concrete suspicion, OLYMP may inform the law enforcement authorities.

g. Legal basis

The legal bases for all data processing described in sections 2.a. to 2.d. are Article 6(1)(b) of the GDPR (performance of a contract and pre-contractual measures) and, at the same time, Article 6(1)(f) of the GDPR (balancing of interests, based on OLYMP’s interest in the successful and secure operation of the programme). This balancing of interests also forms the legal basis for the data processing described in section 2.e.

6.3. Retention period: OLYMP retains participants’ data for as long as they remain members of the OLYMP Insider loyalty programme. Following termination of membership (by the participant or by OLYMP), OLYMP retains the data for a further three years after the end of the calendar year in which membership ends, in accordance with the standard limitation period set out in Section 195 of the German Civil Code (BGB). Thereafter, the data will be deleted; however, where commercial or tax law retention periods apply, deletion will only take place once these periods have expired. If OLYMP is required to retain data due to commercial or tax law retention obligations, the retention period begins at the end of the relevant calendar year. The retention period under commercial or tax law is eight years for accounting-related data and six years for other data subject to retention requirements. These periods may be extended by up to three years due to potential tax audits.

6.4. Rights: Every participant has the right to obtain confirmation as to whether personal data concerning them is being processed; if so, a participant has the right to access this data and the information specified in detail in Article 15(1) of the GDPR. Provided the legal requirements are met, there is a right to the rectification, restriction or erasure of this data, as well as the right to receive from OLYMP, in a structured, commonly used and machine-readable format, the data provided to OLYMP and processed on the basis of consent or for the performance of a contract; a participant may transmit this data to other parties or have it transmitted. Furthermore, a participant has the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, PO Box 10 29 32, 70025 Stuttgart, https://www.baden-wuerttemberg.datenschutz.de/.

6.5. Data Protection Officer and contact details: Enquiries regarding data protection at OLYMP may be sent to the Data Protection Officer: OLYMP, for the attention of the Data Protection Officer, Höpfigheimer Str. 19, 74321 Bietigheim-Bissingen. Enquiries and comments may also be sent by email to datenschutz@olymp.com.

Where OLYMP processes data on the basis of a balancing of interests, you have the right to object provided the legal requirements are met.