Privacy Notice for the Outletcity App

Last updated: August 2026

This Privacy Notice is intended for users of the Outletcity App (“App”) provided by OUTLETCITY AG (“we” or “OUTLETCITY”).

In this Privacy Notice, we explain which of your personal data we process and under what circumstances when you use the App.

Where you visit our website (https://www.outletcity.com) or are a member of our Outletcity Club (“Outletcity Club”) and we process your personal data in connection with your membership of the Outletcity Club or when placing orders in our online shop via this App (including the Reward Shop), the General Privacy Notice applies in addition.

1. Controller and Data Protection Officer

The data controller is:

OUTLETCITY AG
Hugo-Boss-Platz 4
72555 Metzingen

Tel.: +49 (0)7123 92340
Email: service@outletcity.com

You can contact our data protection officer at datenschutz@outletcity.com by email.

2. Processing of Personal Data

2.1 When you use our App, we collect the necessary personal data described below in order to enable you to use its features. If you do not provide us with this data, you will not be able to use the App or certain parts of it.

2.1.1 When you use the App, we generate and use unique identifiers to identify you whilst you are using the App (Art. 6 para. 1 lit. b GDPR), and to be able to clearly attribute and analyse any errors that occur in the App (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in analysing and resolving these errors to ensure the App functions correctly.

2.1.2 We process your device’s language settings so that we can provide you with the App in the correct language (Art. 6 para. 1 lit. b GDPR).

2.1.3 In addition, we collect the following personal data in order to provide the App’s features and to ensure its stability and security (Art. 6 para. 1 lit. f GDPR):

Session data (such as the time and duration of the App session);
Usage data (such as content accessed, the volume of data transferred and error messages/App crashes) and
Device and installation data (such as the operating system, screen size, language setting and the version of the App).

2.2 When you download the App, the information required for technical purposes is transmitted to the Google Play Store or the Apple App Store; this includes, in particular, your username, email address and customer number for your account with the relevant app store provider, the time of the download and your unique device identifier. We have no control over this data collection and are therefore not responsible for it. We process the data only to the extent necessary for downloading the App onto your device (Art. 6 para. 1 lit. b GDPR). Further information from the data controller can be found here:

Privacy Notice from Google
Privacy Notice from Apple

2.3 Within the App, we process your ‘Likes’ – that is, the brands, shops and offers you have selected as your favourites – in order to display them to you in the App and to guide you to these brands, shops and offers on the map of Outletcity Metzingen (‘Outletcity Metzingen’) (Art. 6 para. 1 lit. f GDPR). This information is also used in your Outletcity Club account once you have registered with the Outletcity Club and linked your account to the App. Based on this information, we offer you the option on certain pages within the App to personalise the sorting and display of shops and brands. This allows you to customise the results of product category searches, the overview of all offers, and the shops on the site map according to your preferences (Art. 6 para. 1 lit. b GDPR). Please refer to the General Privacy Notice for further details.

2.3.1 The App includes certain features (map function and display of available public Wi-Fi networks nearby) that are tailored to your current location within Outletcity Metzingen. This geolocation data is used within the App to show your location on the integrated map of Outletcity Metzingen or when you take part in certain ‘quests’ (see section 2.9). We also use this data in accordance with section 2.3.2 to create usage profiles using pseudonyms. We do not carry out any further analysis of this data. You can allow or block the App’s access to your geolocation data at any time via your operating system’s settings. When location tracking is active, your device will indicate this data processing via a corresponding icon in the top bar. Please note that we can only offer you some of the App’s features if we know your location. You can object to this processing at any time within the App by using the opt-out switch under ‘Settings’ in the App. Insofar as personal data is processed in this context, this is done solely on the basis of consent (Art. 6 para. 1 lit. a GDPR).

2.3.2 For the purposes of market research and to tailor our entire range of services to your needs, we create pseudonymised user profiles of App users using data relating to the device on which the App is installed, including system data, your App activity, identification data (e.g. your Outletcity Club customer ID) and your location data, in order to improve our services for you (Art. 6 para. 1 lit. f GDPR). You may also object to the processing of your data for these purposes by using the opt-out toggle under ‘Settings’ within the App (see also section 5.3).

2.4 We may ask you to rate our App via a dialogue box within the App, so that this rating is included in the overall rating of our App on the Google Play Store or the Apple App Store. For this purpose, we collect and store the following personal data that you have provided in our App:

the frequency of certain interactions with our App (e.g. “Likes”, see section 2.3, online purchases and purchases at Outletcity Metzingen, as well as customer benefits).

Our legitimate interest in processing your personal data in this way is to gather feedback on your satisfaction with our App (Art. 6 para. 1 lit. f GDPR).

To process your review, the relevant app store provider will independently collect further personal data from you, which you enter into the review system. The processing of your personal data by the relevant app store provider is carried out in accordance with its applicable privacy notice. We do not at any time transfer the data collected by us under this clause to the relevant app store provider.

2.5 We use push notifications to send you messages. In doing so, we process a unique identifier (see section 2.1.1) based on Article 6 para. 1 Iit. f GDPR, insofar as we are permitted to do so by law without your consent, or otherwise based on your consent (Art. 6 para. 1 lit. a GDPR). Our legitimate interest lies in informing you about special offers, terms and conditions, and updates relating to Outletcity Metzingen and the App. You may also object to the processing of your data for these purposes by using the opt-out toggle under “Settings” in the App (see also section 5.3).

2.6 Where your personal data is processed via the App in connection with the Outletcity Club, the General Privacy Notice also applies. The first time you use the App, we generate an Outletcity Club code for you to make it easier for you to use the App in conjunction with the Outletcity Club (Art. 6 para. 1 lit. f GDPR). The Outletcity Club Code is a digital OUTLETCITY loyalty card issued by us for the Outletcity Club. However, this Outletcity Club Code is only linked to your customer account once you have registered.

2.7 When you redeem a Shopping Pass code in the App, we process your Outletcity Club code, as well as the date of redemption and the date and time of activation of the relevant Shopping Pass, based on Art. 6 para. 1 lit. b GDPR.

2.8 As a member of the Outletcity Club, you have the opportunity to earn status points by taking part in certain activities, known as “quests”. As part of some of these quests, we may need to collect and process your location within Outletcity Metzingen via the App. This processing is based on Art. 6 para. lit. f GDPR. Our legitimate interest lies in carrying out the respective quest and providing you with more targeted and relevant advertising. For further details, please refer to the General Privacy Notice.

3. Storage Period

Unless otherwise stated in this Privacy Notice, we will retain your personal data until the respective processing purposes have been fulfilled. Beyond that, we will only retain it if and to the extent that commercial, tax or other legal requirements give rise to a longer retention obligation or a right to retain it for a longer period.

4. Recipients of the Data

4.1 In order to provide the App, we transfer your personal data to our hosting provider. We also use other service providers as data processors to offer certain services within the App (Bonscan) and to improve the App through analysis.

4.2 We only transfer personal data to third countries to the extent that service providers operate in third countries as data processors or as joint controllers. Where there is no adequacy decision by the European Commission for the third country in question, the data transfer takes place with your consent and/or subject to suitable or appropriate safeguards (Art. 46 and 49 GDPR). You may obtain a copy of the relevant safeguards used by contacting the controller at the address provided above. For companies based in the USA, the adequacy decision adopted by the European Commission on 10 July 2023 (EU-US Privacy Framework) applies, provided that the relevant company is certified under the EU-US Privacy Framework.

5. Rights of Affected Parties

5.1 Under the law, you have the following rights:

Right of access (Art. 15 GDPR);
Right to rectification (Art. 16 GDPR);
Right to erasure (Art. 17 GDPR);
Right to restriction of processing (Art. 18 GDPR);
Right to data portability (Art. 20 GDPR) and
Right to object to processing (Art. 21 GDPR).

5.2 Where the processing is based on Art. 6 para. 1 lit. a GDPR, you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.

5.3 You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Art. 6 para. 1 lit. f GDPR; this also applies to any profiling based on these provisions, as well as to processing carried out using artificial intelligence (AI) techniques. We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where the processing is carried out for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to the processing, your personal data will no longer be processed for these purposes.

5.4 You have the right to lodge a complaint with a supervisory authority.

5.5 You have the right to lodge a complaint with a supervisory authority. To exercise your rights, please contact our Data Protection Officer (section 1).