General Privacy Notice

This Privacy Notice is intended for Members of the Outletcity Club (“Outletcity Club”) and unregistered visitors to the website (“Website”) of OUTLETCITY AG (“we” or “OUTLETCITY”) accessible at https://www.outletcity.com.

In this Privacy Notice, we will inform you about the personal data we process from you and under what circumstances, in connection with your membership of the Outletcity Club, when placing orders in our Online Shop (“Online Shop”) (including the reward shop) and orders placed with our partner company Global-e NL B.V., Krijn Taconiskade 430, 1087 HW Amsterdam, The Netherlands, (“Global-e”), and in connection with the Website.

A. Overview

To give you an overview of our data processing activities, we present them to you in this overview.

1. Website

When you visit our Website, we store information about you using log files for the purpose of optimising our online offering in the future, as well as for data protection monitoring and data security. To ensure we can reliably deliver the Website’s content, we also use a so-called content delivery network.

If you contact us via our Website or submit a press enquiry, we process the personal data provided in your enquiry so that we can respond to your satisfaction.

For certain forms, we seek to ensure that they can only be used by humans and not by software. For this purpose, we use so-called captcha services.

2. Outletcity Club and Online Shop

Use of the OUTLETCITY Online Shop requires membership to the Outletcity Club. The Outletcity Club is OUTLETCITY’s customer loyalty programme. In order to offer you membership to the Outletcity Club and to provide you with offers that are as relevant as possible, we process the personal data you provide when registering for the Outletcity Club, as well as details of your use of the Outletcity Club offers. Detailed information on these processing operations can be found below under section C.3.

For orders placed via the Online Shop, we process, amongst other things, the details you provide when registering for the Outletcity Club and during the ordering process, as well as data relating to orders you have previously placed via the Online Shop (order history). In addition, credit reference agencies assist us in regularly verifying address details and, in some cases – depending on the chosen payment method – in obtaining creditworthiness information. Detailed information on these processing operations can be found below under section C.4.

In order to provide you with the Online Shop and to market our products and services, we work with various data processors, other service providers and partner companies, who may also have access to your relevant personal data in this context. We also process personal data about you that we receive from these partner companies and service providers.

If, when placing an order in the Online Shop, you specify a delivery address outside Germany, Austria or Switzerland, your contractual partner for this order is our partner company Global-e, which processes your personal data in connection with your order. Further details on this data processing and the corresponding data exchange between us and Global-e can be found below under section C.4.8.

3. Cookies and Tracking

We use certain cookies, cookie-like and cookie-based technologies (collectively also referred to as “Cookies”) on our Website and in the Online Shop. Cookies are small text files that are stored on your computer and saved by your browser. They do not cause any harm, rather they serve, for example, to make our service more user-friendly, effective and secure for you. We also use Cookies that enable us to carry out retargeting, fingerprinting, conversion tracking, cross-device tracking or the use of customer audiences.

Detailed information on the use of Cookies, including options to withdraw consent and object, can be found below (section C.10) and in the cookie settings at https://www.outletcity.com/de-de/shop/datenschutzeinstellungen/.

B. Controller and Data Protection Officer

The data controller is:

OUTLETCITY AG

Hugo-Boss-Platz 4

72555 Metzingen

Tel.: +49 (0)7123 92340

Email: service@outletcity.com

You can contact our data protection officer by email at datenschutz@outletcity.com.

C. Our Data Processing Activities

To help you understand what types of personal data we process, for what purposes and on what legal basis, we provide detailed information on this below.

1. Data Processing just visiting the Website

When you visit our Website, we process your personal data as described in this section C.1.

1.1 Log Files

When you visit our Website, your browser automatically transmits certain personal data to our servers, for the operation of which we may use hosting providers as data processors. This is done through the use of so-called log files, in which your IP address is stored. In addition to your IP address, we receive the following personal data from you via the log files:

Referrer URL (information about which website you came from to access our Website)
Date and time of your visit to our Website, time zone difference from GMT
The access method/function requested by the requesting computer
The input values transmitted by the requesting computer (file name)
Subpage accessed, or name of the requested file
Access status/HTTP status code (file transferred, file not found, command not executed, etc.)
Amount of data transferred
Your browser and operating system version
the language you have selected for the Website

The processing of this personal data is carried out both to optimise our online offering in future and for data protection monitoring and data security purposes and is based on Art. 6 para. 1 lit. f GDPR.

1.2 Content Delivery Network

To deliver content from our Website, we use a content delivery network (“CDN”), which is operated on our behalf by a service provider acting as a data processor.

The CDN makes website content available on various servers distributed worldwide so that it can be accessed as quickly as possible by visitors to our Website from anywhere. The content embedded on our Website, such as images and videos, is retrieved from the CDN when the Website is accessed. When you access the Website, the following personal data is transferred from you to the CDN service provider’s servers and stored there:

IP address
Your browser and operating system version
Origin (name of the domain from which the request to the CDN originates; this is usually https://www.outletcity.com)
Referrer (name of the domain, including the path, from which the request to the CDN originates)
Timestamp

This processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in being able to offer greater reliability, enhanced protection against data loss and improved website loading speeds.

1.3 Captcha Services

We use captcha services to ensure that forms on our Website can only be used by humans and not by automated malware. For this purpose, the captcha tool provided by a service provider operates in the background when you access certain forms on our Website. This tool analyses your behaviour to verify that you are a human. For this analysis, the following personal data relating to you is processed:

IP address
Browser and device information
Cookies and identifiers
User interactions (mouse movements, clicks, behaviour)
Information about the webpage visited and the form.

Our legitimate interest in the processing of your personal data via captchas is that we wish to protect our Website from spam and attacks by automated malware. The processing is therefore based on Art. 6 para. 1 lit. f GDPR.

2. Actively Contacting us via our Website

You have various options for actively contacting us via our Website. When you do so, we process your personal data as described in this section C.2.

2.1 Making Contact (via the contact form or by email)

If you use the contact form on our Website to get in touch with us or send us an enquiry by email, we process the following personal data in order to respond to your enquiry as effectively as possible:

Your salutation
Your first name and surname
Your email address
Your message, including the subject line you have chosen and any further personal data that may be contained in the content of your message
The date and time of your enquiry

If you contact us as a visitor to our Website, we use this personal data to respond to your enquiry. If your enquiry does not relate to a past, present or potential contractual relationship with us, our processing of your personal data is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in responding to your enquiry.

If you contact us as a Member of the Outletcity Club (see section C.3 ) and/or your enquiry relates to a past, present or potential contractual relationship with us, our processing of your personal data to respond to your enquiry is carried out for the purposes of initiating or performing this contractual relationship with you and is therefore based on Art. 6 para.1 lit. b GDPR.

Furthermore, for each of your enquiries, we process your personal data for the purpose of analysing, managing and optimising our internal business processes. This includes, in particular the continuous improvement of how we handle enquiries, for which we analyse your enquiry to the extent necessary. In this case, our processing of your personal data is based on Art. 6 para. 1 lit. f GDPR, and our legitimate interest lies in optimising our business processes.

2.2 Press Enquiry

If you contact us via the press enquiry form on our Website, we process the following personal data in order to respond to your enquiry as effectively as possible:

Your salutation
Your first name and surname
Your email address
Your message, including the subject line you have chosen and any other personal data that may be contained in the content of your message
The date and time of your enquiry

We process this personal data solely for the purpose of responding to your enquiry on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest in doing so lies in maintaining accessible press relations.

3. Registration with the Outletcity Club

You have various options for registering for membership in our Outletcity Club. The personal data we process from you in this context depends on which of these options you use. We refer to all this personal data as “Master Data”.

3.1 Registration by Name

You can sign up for membership of the Outletcity Club by creating a customer account (registration) on our Website or in our Outletcity App (see section C.6).

To become a Member of the Outletcity Club, you will need to provide certain necessary details at the time of registration. We collect these details directly via the Outletcity Club membership registration form and process them accordingly:

Your email address (which we may verify as part of your registration)
A password for identification purposes (stored only in encrypted form and without us having access to it)
Your preferred delivery country (based on your place of residence)
Your preferred salutation

This processing of your personal data takes place for the purposes of entering into and fulfilling the Outletcity Club membership contract concluded between you and us (Art. 6 para. 1 lit. b GDPR).

3.2 Registration via Facebook

If you are a Facebook user, you can also register via the ”Facebook Connect” social plugin provided by the social network Facebook. “Facebook Connect” is provided by Meta Platforms Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, or, if you are a Facebook user based in the EU, by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”).

To log in, after clicking on the “Facebook Connect” social plugin, you will be redirected to the Facebook website, where you can log in using your account details. This links your Facebook profile to our service. Depending on your personal privacy settings on Facebook – i. e. whether you have consented to the transfer of data – and the information stored there, when you use the Facebook login, we receive from Facebook the general and publicly accessible information stored in your profile:

Your email address
Your Facebook ID
Your first name and surname (which we do not store, however)
Your profile picture (which we do not store, however)

We use this information provided by Facebook to identify you in connection with your Outletcity Club membership. The legal basis for this data processing is Art. 6 para. 1 lit. a GDPR or Art. 6 para. 1 lit. b GDPR.

Further information from the data controller regarding Facebook Connect itself and the privacy settings can be found here: Facebook’s privacy notice.

3.3 Registration with Google

If you are a Google user, you can also register using the “Google Sign In” social plugin provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

To log in, after clicking on the Google social plugin you will be redirected to the Google website, where you can log in using your account details. This links your Google profile to our service. Depending on your personal privacy settings with Google – i. e. whether you have consented to the transfer of data – we receive the following information from Google when you use Google Login:

Your email address
Your Google ID
Your first name and surname (which we do not store, however)
Your profile picture (which we do not store, however)

We use this information provided by Google to identify you in connection with your Outletcity Club membership. The legal basis for this data processing is Art. 6 para. 1 lit.a GDPR or Art. 6 para. 1 lit. b GDPR.

Further information from the data controller regarding Google Sign-In itself and the privacy settings can be found here: Google’s privacy notice.

3.4 Registration with Apple

If you are an Apple user, you can also register using the “Sign in with Apple” social plugin provided by Apple Inc., Infinite Loop, Cupertino, CA 95014, USA, or Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (“Apple”).

To log in, after clicking on the Apple social plugin, you will be redirected to Apple’s website, where you can log in using your account details. This links your Apple profile to our service. Depending on your personal privacy settings with Apple – i. e. whether you have consented to the transfer of data – we receive the following information from Apple when you use the Apple login:

Your Apple ID
Your email address (including information on whether it is a private email address generated by “Hide My Email” feature)
Your first name and surname (which we do not, however, store)

We use this information provided by Apple to identify you in connection with your membership of the Outletcity Club. The legal basis for this data processing is Art. 6 para. 1 lit.a GDPR or Art. 6 para. 1 lit. b GDPR.

Further information on the Apple login itself – for which Apple Distribution International Limited is the data controller – and the privacy settings can be found here: Apple’s privacy notice.

3.5 Outletcity Club Code and Identification Number

Once you have completed your registration, you will initially receive only your Outletcity Club code. This serves to uniquely identify you as a Member of the Outletcity Club.

As the Outletcity Club code may change during the course of your membership – for example, if you lose your customer card or temporarily uninstall the Outletcity App (see section C.6) – we also use a unique identification number (“Customer ID”). By using this Customer ID in the background, we can ensure that Points (see sections C. 11) are credited to your account and that reward points can be redeemed, even if the Outletcity Club Code changes. This Customer ID is generated exclusively by the system and is used in all identification processes. Should you lose your customer card, this procedure enables us to block the corresponding Outletcity Club code, so that you can continue to use the Outletcity Club without having to re-register.

We process your personal data as set out in this section C.3.5 in order to identify you in connection with your Outletcity Club membership. The legal basis for this data processing is Art. 6 para. 1 lit. b GDPR.

3.6 Additional information

When you register for the Outletcity Club, we also store the following personal data about you:

The date of your registration
The relevant languages (language of the Website and the Online Shop), including a language suggestion based on your IP address
The channel through which you registered for the Outletcity Club (Website, Outletcity App, Facebook, Google or Apple)
The method you used to register for the Outletcity Club (email address, Facebook Connect, Google Sign In or Apple Login)

We process this personal data on the basis of Art.6 para. 1 lit. f GDPR. Our legitimate interest lies in optimising the Website and the Online Shop, analysing the uptake of registration channels and methods, and personalising advertising (section C.5).

3.7 Voluntary Information

In addition, you may at any time provide further personal data to complete your customer profile during registration, later via your customer account, or when placing an order in the Online Shop:

Your first name and surname
Your date of birth
Your address
Your other interests or preferences

We collect this personal data in order to be able to identify you precisely within the Outletcity Club, to personalise advertising (section C.5) and, where applicable, to process orders in the Online Shop. We use your date of birth to send you a birthday surprise, insofar as this is provided for under your Outletcity Club membership.

You can access your customer account either via the Website or the Outletcity App (see section C.6).

The legal basis for this data processing is Art. 6 para. 1 lit. a GDPR or Art. 6 para.1 lit. b GDPR, insofar as the data processing is necessary for your membership of the Outletcity Club or for the fulfilment of your orders in the Online Shop (see section C.4).

3.8 Right of Withdrawal or Termination

Should you exercise your right of withdrawal in relation to your Outletcity Club membership or terminate your Outletcity Club membership, we will process the following personal data:

Your first name and surname, email address and postal address
Your Customer ID
Information on whether the membership ends due to withdrawal, ordinary or extraordinary termination, including any details you may have provided in this regard

We process this personal data in order to be able to manage your Outletcity Club membership or its termination (Art. 6 para. 1 lit. b GDPR).

4. Data Processing in Connection with the Online Shop

When you use our Online Shop, we process further personal data in addition to your Master Data in order to process your order, its payment and any returns. Furthermore, we also process personal data relating to your order in order to carry out address or credit checks and to offer you a tracking service. The circumstances and extent to which this takes place in each case are described in the following sections under this section C.4.

The provisions in sections C.4.1 to C.4.7 do not apply if your contractual partner for orders placed via the Online Shop is our partner company Global-e.

4.1 Processing your Order

In order to process your order, we require the following personal data in addition to your Master Data:

Your first name and surname, unless you have already provided these at an earlier stage
Your billing address, if it is not already stored in your customer account or if it differs from the address stored in your customer account
Your delivery address, if different from the billing address, including delivery to a post office or Packstation
Your preferred payment method and, depending on the payment method, the necessary payment details (see section C.4.3)

We also store this personal data ourselves or pass it on to the logistics service provider acting on our behalf to process and dispatch orders, who handles this technically on our behalf – where applicable, in conjunction with a parcel delivery service – and returns the data relating to the consignment to us.

The parcel service provider may inform you of the status of your parcel and its delivery by email. You can view tracking information in your customer account (“My Account”).

If, during the ordering process, you have chosen to have your order delivered to a post office or Packstation, we will pass on your post office number to the parcel delivery service provider.

The processing of your personal data as set out above in this section C.4.1 is carried out for the purpose of fulfilling the contracts concluded between you and us regarding the goods you order from our Online Shop (Art. 6 para. 1 lit. b GDPR).

The personal data relating to you mentioned above in this section C.4.1 is also processed together with the following personal data relating to you – some of which is relevant to your order and some of which relates to your order history – including your Master Data:

Information about items you have previously ordered
Date of the order
Payment details (amounts paid, time details received from you or our bank)
Picking data (location, ID numbers, time details)
Dispatch and delivery details (courier service, parcel number, parcel timestamps)
Communication details (e.g. telephone, email)
Contract master data (contractual relationship, product or contract subject)
Customer history

This personal data is processed in order to provide you with an order history and to enable us to analyse and improve customer satisfaction (Art.6 para. 1 lit. f GDPR) and, to the extent necessary for the fulfilment of such purposes, to process and execute your individual sales contracts (Art. 6 para. 1 lit. b GDPR).

4.2 Address Verification during the Ordering Process

Each time you enter a new address during the ordering process, we will validate it once and, where necessary, have any minor obvious errors corrected. For this purpose, we transmit German addresses – without names – to CRIF GmbH, Leopoldstraße 244, 80807 Munich; Austrian addresses to CRIF GmbH, Rothschildplatz 3/Top 3.06.B, 1020 Vienna, Austria; and Swiss addresses to CRIF AG, 8034 Zurich, Switzerland. For Switzerland, there is an adequacy decision by the European Commission, which you can request from the address given above.

Detailed information on the processing of personal data by CRIF GmbH can be found at https://www.crif.de/datenschutz, by CRIF GmbH at www.crif.at/datenschutz, and by CRIF AG at www.mycrifdata.ch/#/dsg.

This processing of your personal data is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest in this regard is to ensure smooth dispatch, to prevent the fraudulent shipment of goods to incorrect or unauthorized addresses, and, where a delivery address is unknown, to refuse payment by credit card, SEPA direct debit or purchase on account in order to safeguard our payment claims.

4.3 Payment Process

As part of the payment process, we process various personal data relating to you.

4.3.1 Credit Check

In order to offer you the widest possible range of payment methods, we wish to protect both you and us from fraud and reduce our risk of non-payment.

For every order you place where you choose to pay by SEPA direct debit or on account, we assess whether we can offer you these payment methods. To do this, we consult blacklists, maintain our own lists of approved customers and analyse your returns history. We do this to prevent payment defaults. The legal basis for this is Art. 6 para. 1 lit. f GDPR. We store the result of our assessment until the next assessment is carried out. If your name appears on a blacklist, you cannot pay us by SEPA direct debit or on account. If you are on a list of approved customers, you can use all payment methods.

If our own analysis does not provide a clear result, we will transmit your name, address and, where applicable, your date of birth to the relevant credit reference agencies listed under section C.4.2 for the purpose of carrying out a creditworthiness check. The legal basis for these transmissions is Art. 6 para. 1 lit. f GDPR. The result of the credit check is processed immediately solely to display your personalised choice of payment methods and is not stored for any other purpose.

The relevant credit reference agencies process the data received and also use it for profiling (scoring) purposes, in order to provide your respective contractual partners with information for assessing the creditworthiness of natural persons. Further information on their processing of your personal data can be found at the respective credit reference agencies (see above). If you have any questions regarding the calculation of credit scores by the individual credit reference agencies, please contact the relevant agency directly.

4.3.2 Frictionless Flow

To enhance user-friendliness, we transmit certain categories of data that identify you (such as your address) and categories of data relating to your order to the selected payment service provider. Specifically, this involves the following personal data relating to you:

Total amount of your shopping basket, including the currency and shopping basket code (for reference); merchant account
Your order channel (internet) and IP address
Your Customer ID and email address
The billing address, delivery address and ISO code of the country of delivery
Information about your browser (for the 3DS risk assessment): user agent, colour depth, Java-enabled flag, JavaScript-enabled flag, language, screen height and width, time zone offset and Accept header
For credit card payments: card number, expiry month and year, credit card security code and cardholder’s name
Authentication data: 3DS request data and authentication attempt flag

Under certain conditions, this allows us to save you from having to complete a time-consuming authentication process during which you would be required to enter additional data on further websites of the payment service provider. (known as a “frictionless flow”). This is based on your interest in being able to make your payment without being redirected wherever possible, and our interest in being able to offer you this user-friendly and secure payment process (Art. 6 para. 1 lit. f GDPR).

4.3.3 Payment

Depending on the payment method you have chosen, we process the payment details requested from you and, where necessary, forward them to the integrated payment service provider. In some cases, however, we have outsourced the entire payment process, meaning that we do not process any further personal data from you ourselves.

This processing of your personal data is carried out for the purpose of fulfilling your contract of sale for the goods ordered and is therefore based on Art. 6 para. 1 lit. b GDPR.

4.4 Sovendus

Once you have placed an order in the Online Shop, we display voucher offers from Sovendus GmbH, Moltkestraße 11, 76133 Karlsruhe (“Sovendus”). During this process, we transmit your IP address to Sovendus, which uses it exclusively for data security purposes and, as a rule, anonymises it after seven days.

In addition, for the purposes of processing redeemed vouchers, we transmit the order number, order value (including currency), voucher code and timestamp to Sovendus.

This processing of your personal data is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in improving your shopping experience in our Online Shop and in processing the redemption of vouchers.

For further information on the processing of your personal data by Sovendus, please refer to their privacy notice at www.sovendus.de/datenschutz (or, for Austria: https://web.sovendus.com/privacy/at and for Switzerland: https://web.sovendus.com/ch/privacy).

4.5 Returns

Should you exercise your right of withdrawal with regard of goods purchased from the Online Shop or corresponding relevant warranty rights, we process the following personal data:

Your first name and surname, email address and postal address
Information relating to your return (courier service, parcel number, details of when the parcel was dispatched)
Information regarding receipt by us (location, ID numbers, time)
Information regarding the condition of the returned goods
Type, category, brand and description of the returned goods
Your Customer ID
Date of purchase of the goods
The payment method used to pay for the goods
Order number
Reason for return (cancellation, warranty or goodwill), including any details you may have provided

We process this personal data in order to rescind the relevant sales contract with you, to process or fulfil warranty claims (Art. 6 para. 1 lit. b GDPR), to retain evidence of the steps leading to the reversal of the contract, to provide you with an order history, and to offer you a personalised user experience optimised to your needs (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in preserving evidence, increasing customer satisfaction, optimising our offerings and promoting sales.

4.6 Orders via the Marketplace with our Marketplace Partners

If you order a product from one of our marketplace partners via our marketplace, we process your personal data to the same extent, for the same purposes and on the same legal basis - as described in section C.4.

However, we engage the relevant marketplace partner as a data processor to process your order, the shipment and the handling of any returns.

4.7 Ordering Deliveries to Switzerland

If you place an order for delivery to a Swiss address, we will process your personal data as described in section C.4. Notwithstanding this, however, we will, where necessary, transfer the data to logistics and parcel delivery providers, as well as payment service providers, in Switzerland. For Switzerland, the legal basis for such transfers is the EU Commission’s adequacy decision.

4.8 Orders Placed via Global-e

The processing of your personal data described in this section C.4.8 applies only if your contractual partner for an order placed in the Online Shop is our partner company Global-e (see section A.2). The provisions in sections C.4.1 to C.4.7 do not apply in this case.

We transfer the following personal data, insofar as we are aware of it, to Global-e after you have clicked the “Go to Checkout” button as part of the ordering process:

The contents of your shopping basket, including any vouchers and discounts
Your salutation, first name and surname
Your email address
Your Customer ID
Your telephone number
Your billing and delivery addresses

This transfer takes place in the course of establishing the contractual relationship between you and Global-e and is therefore based on Art. 6 para. 1 lit. b GDPR.

Once you have completed your order with Global-e, Global-e will provide us with the following personal data about you:

The contents of your shopping basket, including the purchase price and any vouchers and discounts
Your billing address
Your delivery address, if different from the billing address, including delivery to a post office or Packstation
Your payment method, the payment provider and the payment status
Information on whether Global-e has accepted your order
Information regarding returns

We process this personal data to the same extent, for the same purposes and on the same legal basis as part of your Outletcity Club membership (Art. 6 para. 1 lit. b GDPR), and for the performance or fulfilment of your contract of sale with Global-e. In this regard, the processing of your personal data is carried out in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the fact that we act as a processor on behalf of Global-e in relation to the orders concluded between you and Global-e.

Details regarding the processing of your personal data by Global-e can be found here: Global-e’s Privacy Notice.

5. Personalisation of Advertising in Connection with your Customer Account

We organise your Master Data, the additional information (section C.3.6) and the voluntary information you provide (sections C.3.7 and C.11.2), your interactions with our online services (Website and Outletcity App, e. g. clicks, search queries, shopping baskets, wish lists, likes), with customer benefits (e.g. coupons, vouchers, discount codes, club), with our email services (e.g. newsletters), as well as all aspects of your purchases at the brick-and-mortar Outletcity Metzingen (“Outletcity Metzingen”) and your online purchases, the information listed in section C.5.1, and the preferences and settings you have specified via the cookie and data protection consent management system, to your customer account, insofar as we are able to do so. This is usually done by also storing date and time details.

We do this so that we can present and offer you advertising that is as relevant to you as possible – such as category and product lists, brands, offers, specific products, coupons, vouchers or discount codes, as well as restaurants at Outletcity Metzingen – or to limit our advertising activities towards you or exclude you from them. Time stamps are also used to calculate data retention periods.

For these purposes, we use various methods to derive categorised information, affinity lists and probability values from individual pieces of information relating to your product interests and your anticipated use of our offers at, which we store alongside your data record with us (profile information). The profiles are updated whenever new information is added or, in other cases, on a regular basis.

We use the calculated profile information to decide which advertising to present to you, how frequently and via which channels (e. g. our own and third-party websites of our advertising partners as data recipients, retargeting (see section C.10.1.2.1.), our email newsletters, our own and third-party apps operated by our advertising partners as data recipients, and in-store promotions). The advertising may also be optimised to product categories, trend affinities, brands and items calculated individually for you, taking into account, where applicable, available sizes, coupons, vouchers, discount codes and similar, as we calculate personalised profiles in advance. These advertising measures may be distributed by us directly or by our advertising partners, to whom we provide profile information as data recipients for this purpose.

This analysis may also determine which coupons, vouchers and discount codes we send out. We also use redeemed coupons, vouchers and discount codes to measure the success of an associated advertising campaign – which we may also carry out via third parties – to identify your preferences and, where relevant, to calculate the amount of sales-based remuneration claims for our promoters or sales-based commissions for other intermediaries, as you may also receive such coupons, vouchers and discount codes may also be provided to you from time to time by third parties with whom we collaborate.

We also aim to be able to target individual customers, in particular identified top customers, and to estimate the total value of our customer base.

Depending on your place of residence and its proximity to Outletcity Metzingen, you will primarily receive advertising featuring offers from Outletcity Metzingen, omnichannel offers or purely online offers. For this purpose, your place of residence is analysed at the level of the first digit of your postcode.

5.1 Individual Information

In this context, we process your transaction history with us (individual details):

Your shopping baskets, purchases and returns, in order to calculate purchase and return rates for
Information on whether you have spent more in our Online Shop or more at our Outletcity Metzingen
Information about which brands and product categories you view (including the length of time spent on them), what you search for, which brands and product categories you add to or remove from your shopping basket, add to or remove from your wishlist, and which brands and product categories you purchase
Information about whether and which sale offers you view (including how long you spend on them), what you search for, which offers you add to or remove from your shopping basket, add to or remove from your wishlist, and which offers you purchase
Information about whether and which items you view (including the duration of your visit), what you search for, which items you add to or remove from your shopping basket, add to or remove from your wishlist, and which items you purchase, as well as how these items are described by us
Information about whether and which coupons, vouchers or discount codes you use and the value of these, in particular whether you have ever activated and/or used a coupon, voucher or discount code (e.g. a Shopping Pass) and via which advertising channel you received them
Information about which sizes, styles and/or colours, as well as the number of products from a specific brand (including the total number of products and styles from that brand) you view (including the time spent on the page), what you search for, which sizes, styles and/or colours you add to or remove from your shopping basket, add to or remove from your wishlist, purchase and/or return
Information about which payment methods you use
Information about which rewards you select
Information about your preferences (e.g. favourite brands, favourite shops) that you provide to us yourself, in particular the duration
Your subscriptions to email reminders (e.g. for sold-out items), the items and brands to which the requested email reminder relates, and the number of email reminders
Details of your initial registration, your activities on our Website and in the Outletcity App, and your purchases, as well as your age

5.2 Algorithms

We use both rule-based models and machine learning models to carry out the aforementioned calculations of your profile information.

In rule-based models, for example, we count and weight how often you have clicked on a category or added items to your shopping basket, and combine this with the products you have purchased, which we also categorise. Purchases are generally weighted significantly more heavily than individual clicks. The categories with the highest scores are classified as those most likely to be relevant to you in the future. As part of rule-based models, we also compare your history with that of all other customers, for example, and use this to form customer groups.

In machine learning, software analyses a large volume of historical behavioural and outcome data from all customers and compares this with data about you in order to infer your likely future preferences based on weightings that the software has established itself.

We use automated data analysis techniques, including machine learning methods, to personalise content and optimise our offerings. This processing is carried out to display content, products or brands that are as relevant to you as possible. In doing so, we process, in particular, usage and interaction data.

The processing takes place in several stages: first, patterns and correlations are derived from existing data to identify preferences. These results are then weighted and refined, taking further relevant factors into account, to determine the likelihood of certain content or brands being relevant. The aim is to display content that is likely to be of interest to you.

5.3 Legal Basis and Legitimate Interests

This processing of your personal data is carried out in our legitimate interest (Art. 6 para. 1 lit. f GDPR) in presenting our customers with advertising that is as relevant as possible and in running successful advertising campaigns, so that we can improve your shopping experience with us and encourage you to shop with us again in our Online Shop or at Outletcity Metzingen. We also have a legitimate interest in making things easier for you, so that you can find the offers you need more quickly at the right time, and so that you can also be reminded – via email or on third-party platforms – of what has interested you in our shop. We ourselves have a legitimate interest in ensuring that you reduce expensive impulse purchases that you later regret and end up returning. We aim to avoid unnecessary advertising by ensuring you receive offers that are as relevant to you as possible. In doing so, we aim to provide you with targeted advice, whilst also inspiring you with relevant trends so that you stay up to date. Overall, we pursue our legitimate interest in optimising the shopping experience, so that you can quickly find an overview of the offers relevant to you and thereby waste less time searching or looking at irrelevant adverts and offers. It may also be the case that our systems conclude that you are not interested in receiving advertising from us, in which case we will reduce or suspend our advertising activities. For this purpose, we have a legitimate interest in creating appropriate profiles and carrying out personalisation.

5.4 Storage Periods

We store profile information that we have calculated for you using algorithms only until the next time we recalculate the profile information. If no individual data is available for the calculation, the profile information will be deleted when the next recalculation takes place.

Furthermore, we store the individual data – which we store solely for the aforementioned purposes and not for any other reasons – only for as long as this individual data may still be relevant to predicting future behaviour. For example, in the context of our Outletcity Metzingen, data that we categorise according to specified rules remains relevant for up to 900 days after the individual data was generated, whilst in the context of the more frequent online transactions, we only use individual data for up to 730 days (2 years) after it was generated.

For information on retention periods for other reasons, please refer to the other sections of this privacy notice.

6. Using the Outletcity App

Information on the processing of your personal data in the Outletcity App can be found at https://www.outletcity.com/en/metzingen/app-data-protection/.

7. Newsletter

To send you our newsletter, we process the following personal data about you:

Your salutation
Your email address

When deciding which newsletters to send you, what content they should contain and how often, we also take into account the personal data described in section C.5, as well as the personal data set out in section C.7.1 below.

You will receive our newsletter either as part of your Outletcity Club membership (§ 7 para. 3 German Act against Unfair Competition (UWG)) or because you have explicitly given us your consent to do so (§ 7 para. 1 UWG and Art. 6 para. 1 lit. a GDPR).

7.1 Evaluation

We evaluate your behaviour in connection with the newsletter. For the purposes of this evaluation, the newsletters we send contain so-called web beacons or tracking pixels. These are single-pixel image files stored on our Website. For the purposes of this evaluation, we link your personal data and the web beacons to your email address and a unique ID. Links contained in the newsletter also include this ID. We use the data obtained in this way to supplement your profile information on our system, so that we can tailor the newsletter to your individual interests. In doing so, we record when you read our newsletters, which links you click on within them, and use this information to deduce your personal interests. We link this data to the actions you take on our Website. This processing is based on Art. 6 para. 1 lit. f of the GDPR and is carried out in our legitimate interest in providing you with a better shopping experience.

7.2 A/B Tests

In order to optimise the user experience for all Outletcity Club Members and to continuously improve our services, we carry out A/B tests in which different newsletters are sent to different comparison groups. In doing so, we analyse key metrics throughout the usage and purchasing process (such as the sending and delivery of emails, open and click-through rates, website visits, product views, shopping basket interactions, the checkout process, as well as purchases and repeat orders). This processing is based on Art. 6 para. 1 lit. f GDPR and is carried out in our legitimate interest in providing you with a better shopping experience and in ensuring that our advertising is as effective as possible for all parties involved.

8. Surveys

In our Online Shop and our email newsletters, you will find the option to take part in surveys, for the conduct of which we engage a service provider as a data processor. If you take part in a survey, we process the following personal data about you for the purpose of conducting the survey:

Your Customer ID, where applicable; if we are conducting the survey on a personalised basis, we will inform you of this on a case-by-case basis
Your IP address
Your device, browser type and operating system
The date and time of your participation in the survey
The information you provided as part of the survey
Information on whether you have answered all the questions in full

However, we do not analyse the surveys on a personal basis, but solely on the basis of pseudonymised customer segment information and other anonymous criteria.

This data processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in enabling the continuous improvement of our range of products and services.

9. Postal Mailings

Where we send you postal mailings containing information about Outletcity Metzingen, the Outletcity Club and the Online Shop based on the details you have provided, we process the following personal data relating to you for this purpose:

Salutation
First name and surname
Address

When deciding which informative direct mail items to send you and how often, we also take into account the personal data described in section C.5.

This data processing takes place either in the context of the performance of our Outletcity Club membership contract with you and is therefore based on Art. 6 para. 1 lit. b GDPR. If you are not a Member of our Outletcity Club, we process your personal data referred to in this section C.9 in our legitimate interest in displaying promotional advertising, on the basis of Art. 6 para. 1 lit. f GDPR.

10. Cookies and Tracking

Cookies are used on our Website for the following general purposes on the following legal basis:

Session cookies, which are used in particular to enable the customer account or shopping basket functions to work (§ 25 para. 2 of the German Telemedia Act (TDDDG) in conjunction with the legal basis specified in the cookie settings)
Web analytics cookies, which are used to analyse your usage behaviour on our Website (§ 25 para. 1 of the TDDDG in conjunction with the legal basis specified in the cookie settings)
Advertising cookies, which enable us to collaborate with advertising partners (§ 25 para. 1 of the TDDDG in conjunction with the legal basis specified in the cookie settings)

We use certain cookie-based or cookie-like technologies only within the section of our Online Shop that is accessible exclusively to Members of our Outletcity Club; we use other Cookies for all visitors to our Website. Our use of cookie-based or cookie-like technologies to process your personal data is carried out with the assistance of various service providers acting as data processors or under joint responsibility.

Where the data processing described above is carried out under joint control, our service providers will also use the data collected, in whole or in part, for their own business purposes, as regularly described in the service providers’ product and data protection notices. This may be based on a contractual relationship (Art. 6 para. 1 lit. b GDPR), on consent (Art. 6 para. 1 lit. a GDPR) or on the legitimate interests of the service providers (Art. 6 para. 1 lit. f GDPR).

In each of these cases, we have entered into a joint controller agreement to set out compliance with the obligations under the GDPR regarding joint processing. We will be happy to provide you with a copy of these upon request.

Where we have a legitimate interest in data processing under joint responsibility with our service providers – for example, because the data processing serves the purposes of conversion tracking, retargeting or the display of relevant advertising – data subjects should regard us as the point of contact for exercising their rights under Art. 15–20 GDPR. With regard to data processing for the service providers’ own business purposes, data subjects should contact the service provider directly, as listed at https://www.outletcity.com/de-de/shop/datenschutzeinstellungen/, or Global-e at https://connect.global-e.com/consumer-privacy-policy. Data subjects are not obliged to contact any particular party.

Information on the specific Cookies we use, their functions and purposes, the relevant legal bases, options for consent, withdrawal of consent and objection, as well as information on processing for our own purposes by joint controllers (personal data concerned, purposes, duration of storage and further information in accordance with Art. 13 GDPR) can be found in the cookie settings at https://www.outletcity.com/de-de/shop/datenschutzeinstellungen/ or in the documents linked there.

To help you better understand the purposes for which we use the Cookies listed there, we describe individual cookie-based or cookie-like processing activities in more detail below.

10.1 Website Traffic and Customisation of Adverts

To help us better understand which sub-pages and category pages – or which sections of a sub-page – are particularly relevant to our customers, we analyse user activity on our Website as described below. We also use tools that enable us to display products that are genuinely of interest to you.

10.1.1 Evaluation of the Use of Sub-Pages and Category Pages, Heatmaps

When you browse our Website or log in to your customer account, we collect the following personal data from you using Cookies:

Your activity on the Website and in the Online Shop (which sub-page or category page you are on, which sub-page or category page you came from, how long you stay there, what you click on)
Information on whether or not you make a purchase
Information from your web browser, in particular HTTP header information such as user agent, IP address, country, language and details of the web browser used, as well as information about the previously visited website

In addition, we use a web analytics tool provided by a service provider on our Website to record randomly selected individual visits to the Website. This generates a log of mouse movements, clicks and keyboard interactions, with the aim of reproducing individual website visits on a random basis as so-called “session replays” and analysing them in the form of heatmaps. When this tracking is used, Cookies are stored locally.

10.1.2 Displaying Relevant Advertising

We aim to provide you with personalised offers and to show you only adverts that are relevant to you, both on our Website and in our Online Shop, as well as on third-party websites and apps. These offers may also be contextually optimised based on the content of the website or app you are visiting. Accordingly, we use Cookies to collect personal data in areas of our Online Shop that you access after logging in, recording which sections you have visited, which items you have viewed, added to your shopping basket and ordered. This may also involve a cookie-based analysis of your past and current clicking and purchasing behaviour. In these cases, a cookie is stored on your computer or mobile device to collect pseudonymised data about your interests and thus tailor the advertising to the information stored. As a result, you will be shown adverts that are highly likely to match your product and information interests.

Subject to your consent to the use of the Cookies required for this purpose, we engage various service providers and affiliate network providers for these purposes. In order to be able to attribute advertising success to specific service providers with whom we collaborate, we also use what is known as a “cookie switch”. This is provided by a service provider whom we engage as a data processor.

At https://www.outletcity.com/de-de/shop/datenschutzeinstellungen/, you can see which service providers are involved in each case and decide for yourself which Cookies we are permitted to set for advertising purposes.

10.1.2.1 Retargeting

When you visit other websites after visiting our Online Shop, we display adverts there as a reminder of the products you have viewed on our site (retargeting). These adverts are displayed on third-party websites using cookie technology and an analysis of your previous browsing behaviour. We are not aware of any communication between your browser and the retargeting providers’ servers. When you visit our Online Shop and other websites, your browser communicates directly with the retargeting providers’ servers. The retargeting providers therefore obtain your IP address, the cookie stored on your device, and details of what you viewed on our site whilst visiting our Online Shop. The retargeting provider will again receive your IP address and the cookie stored on your device when you visit other websites that cooperate with the same retargeting provider. Our adverts may then be displayed there on our behalf, e. g. adverts for the products you viewed on our site.

10.1.2.2 Fingerprinting and Cross-Device Tracking

In order to be able to display adverts optimised to your needs across different devices, we also use fingerprinting and cross-device tracking technologies. The use of such tracking methods involves the local storage of Cookies. In the case of cross-device tracking, a cross-device token may be assigned to your stored login details and stored locally and temporarily in encrypted form in a cookie on your computer, provided you successfully log in to our Website. Full IP addresses are not stored during this process and are processed only in anonymised form. To improve tracking accuracy, we use the “first-party tracking” method. This involves setting a first-party cookie on the customer’s domain. Full IP addresses are not stored in this process either and are processed only in anonymised form.

10.2 Customer Audiences

In addition, we use the personal data we hold about you and other customers to create and utilise so-called custom audiences. A custom audience is a target group that we identify from our customer base by defining specific criteria, to whom specific adverts are to be displayed. In this way, we aim to ensure that we only show you adverts that match your interests. To enable us to use such technologies, we obtain your consent in advance for the use of the relevant Cookies.

In this respect, unless otherwise stated in the cookie settings, only hashed email addresses and the cookie ID are generally shared. With regard to this personal data, the information on processing (data processed and purposes) and the legal basis set out in sections C.3 and C.5 applies, together with the information in this section C.10.2 and the further details in the cookie settings at https://www.outletcity.com/de-de/shop/datenschutzeinstellungen/ or in the documents linked there.

10.3 Conversion Tracking

We also use conversion tracking technologies on our Website. If you have seen one of our adverts and later visit certain landing pages on our Online Shop, we would like to be able to evaluate this as a success of our advert or advertising campaign. For this purpose, the relevant service provider with whom we collaborate on conversion tracking cross-references information about the adverts with details of which pages you have visited on our Website. We subsequently receive statistical information from the service provider regarding the success of our adverts, without it being possible for us to identify the specific individual for whom our adverts were successful.

The service providers used are able to measure the success of the adverts across different devices, so that, for example, an advert viewed on a smartphone can be linked to a subsequent order placed in our Online Shop via a laptop.

10.4 Global-e

Global-e is the data controller for all Cookies used by Global-e and for the personal data collected and processed via these Cookies. Global-e only sets Cookies once you have clicked the “Go to Checkout” button as part of the ordering process. Further information on Global-e’s use of Cookies is available here: https://connect.global-e.com/consumer-privacy-policy.

10.5 Google Consent Mode

To record and process your consent status regarding Cookies, we use Google Consent Mode on our Website, which is operated on our behalf by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Consent Mode works in conjunction with the cookie settings we use. In Google Consent Mode, your Google tags and scripts are adjusted based on your consent status in the cookie settings. Tags are loaded on our Website before the consent dialogue box appears, so that tag behaviour is dynamically adjusted depending on the cookie consent you have selected in the cookie settings. Your consent status is then transmitted by Google Consent Mode to Google for further processing. No personal data is sent to Google.

This processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in tracking your consent status in our cookie settings and implementing your choices on our Website accordingly.

11. Status Points and Reward Points

If you are a Member of our Outletcity Club, you can collect status points and reward points (collectively: “Points”). For this purpose, we process your personal data as set out below. Unless a different legal basis is explicitly specified for this data processing below, it is carried out for the purposes of entering into or performing your membership contract with the Outletcity Club and is therefore based on Art.6 para. 1 lit. b GDPR.

11.1 Points

When you collect Points as part of the Outletcity Club, we process the following personal data relating to you in this context:

Information about which Points you have collected when making purchases in our Online Shop and which when making purchases at one of the affiliated partner companies at Outletcity Metzingen, including the respective date of purchase
For purchases at Outletcity Metzingen, also information about which partner you collected the Points from
Information on the goods purchased, the price and the number of Points earned for each purchase
Information regarding any returns relating to purchases made in the Online Shop
Information on whether you have received Points from a special promotion, such as a quest (Section C.11.2)
Information about your current status and, where applicable, any previous status you may have held (relevant only for status points)
Information on which Outletcity Club benefits you have taken advantage of

11.2 Quests

You have the opportunity to earn status points by taking part in certain promotions, known as “Quest”. As part of these Quests, we will ask you for personal data, which we will then store and process together with other personal data for the purpose of personalising advertising (section C.5). For certain Quests, we may need to collect and process your location at Outletcity Metzingen via the Outletcity App. This processing of your personal data for the quests is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to carry out the respective quest and to provide you with more targeted and relevant advertisements.

Furthermore, we process the status points assigned to a quest in order to determine your status level in the Outletcity Club. This processing serves to fulfil your membership contract with the Outletcity Club and is therefore based on Art. 6 para. 1 lit. b GDPR.

11.3 Rewards Shop

When you redeem reward points, we process the following personal data about you for this purpose:

Information on the selected and redeemed rewards
Information on the number of reward points redeemed
The delivery address for the rewards

Rewards may be dispatched directly by the service provider acting as our data processor, whose goods or services we offer as rewards. For this purpose, we pass on your name and delivery address to the relevant service provider.

D. Automated Decision-Making

We do not use automated decision-making beyond the scope described in section C.4.3.1.

E. Transfers to Third Countries

We only transfer personal data to third countries insofar as service providers operate in third countries as data processors or under joint control. Where there is no adequacy decision by the European Commission for the third country in question, the data transfer takes place with your consent and/or subject to suitable or appropriate safeguards (Art. 46 and 49 GDPR). You may obtain a copy of the relevant safeguards used by contacting the controller at the address provided above. For companies based in the USA, the adequacy decision adopted by the European Commission on 10th July 2023 (EU-US Privacy Framework) applies, provided that the relevant company is certified under the EU-US Privacy Framework.

F. Retention Period

Unless otherwise stated in this privacy notice, we will retain your personal data until the respective processing purposes have been fulfilled. Furthermore, we will only retain it if and to the extent that commercial, tax or other legal requirements give rise to a longer retention obligation or a right to retain it for a longer period.

G. Data Subjects’ Rights

Under the law, you have the following rights:

Right of access (Art. 15 GDPR);
Right to rectification (Art. 16 GDPR);
Right to erasure (Art. 17 GDPR);
Right to restriction of processing (Art. 18 GDPR);
Right to data portability (Art. 20 GDPR) and
Right to object to processing (Art. 21 GDPR).

Where processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR, you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

You have the right to lodge a complaint with a supervisory authority.

Right to object under Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Art. 6 para. 1 lit. f GDPR; this also applies to any profiling based on these provisions and to processing carried out using artificial intelligence (AI) techniques.

We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where the processing is carried out for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to the processing, the personal data concerning you will no longer be processed for these purposes.

To exercise your rights, please contact our data protection officer (section B).

Last updated: August 2026