Source: http://lsag.com/c/cms/privacynotice/index.html?shop=en
Timestamp: 2019-04-22 06:18:04+00:00

Document:
As the operator of the shoe retail chains Humanic und Shoe4You, Leder & Schuh AG has branches in the following countries: Austria, Bulgaria, Germany, Croatia, Romania, Slovakia, Slo-venia, Czech Republic and Hungary.
Leder & Schuh AG processes data for the subsidiaries listed above.
As a basic principle, we collect and use personal data of our users only to the extent necessary to provide a functioning website and to prepare our content and services. The collection and use of personal data of our users are routinely and strictly subject to the consent of the users.
An exception is made in such cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
When the processing of personal data is required for the performance of a contract to which the data subject is party, Art. 6 (1) b) GDPR serves as the legal basis. This also applies to such pro-cessing operations as are necessary for the steps which need to be taken prior to entering into a contract.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) c) GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or of a third party, except where such interests are overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6 (1) f) GDPR serves as the legal basis for processing.
The personal data of the data subject will be deleted or blocked as soon as the purpose of stor-age ceases to apply. Data may be stored beyond this time if provision is made for such storage by the European or national legislative authorities in EU directives, laws or other regulations to which the controller is subject.
The data will also be blocked or deleted if a period of storage prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
The data are also stored in the log files on our system. These data are not stored together with other personal data of the user.
The legal basis for the temporary storage of data and log files is Art. 6 (1) f) GDPR.
The temporary storage of the IP address by the system is necessary in order to enable the web-site to be delivered to the computer of the user. The IP address of the user must therefore be stored for the duration of the session. The data are stored in log files to ensure the functionality of the website. The data also help us to optimise the website and to ensure the security of our information technology systems. The data are not evaluated for marketing purposes in this context. These purposes also encompass our legitimate interest in the processing of data pursuant to Art. 6 (1) f) GDPR.
The data will be deleted as soon as they are no longer required for the purpose for which they were collected. Where data are collected to provide the website, this is the case when the respective session is over. Where data are stored in log files, this is the case after 30 days at the latest. An extended term of storage is possible. In this case, the IP addresses of the users are deleted or dissociated so that they can no longer be assigned to the client seeking access.
The collection of the data for the provision of the website and the storage of the data in log files are absolutely necessary for the operation of the website. Consequently there is no prospect of lodging any objection.
The user data collected in this way undergo a technical pseudonymisation process so that it is no longer possible to identify the user. The data are not stored together with other personal data of the users.
The legal basis for the processing of personal data using strictly necessary cookies is Art. 6 (1) f) GDPR. The legal foundation for the processing of personal data using analytical cookies is based on your consent pursuant to Art. 6 (1) a) GDPR.
The analytical cookies are used to improve the quality of our website and its content. The analyti-cal cookies tell us how the website is used, allowing us to keep optimising our service. For this purpose we create a profile of you under a pseudonym.
The data will be used for the sole purpose of sending the newsletter.
The legal basis for the processing of the data after the user has registered for the newsletter is the issue of consent by the user pursuant to Art. 6 (1) a) GDPR.
The email address of the user is collected in order to send the newsletter. All the other data listed under IV.1. are used to select the appropriate newsletter.
The data will be deleted as soon as they are no longer required for the purpose for which they were collected. The personal data collected from the user will be stored until the subscription to the newsletter is cancelled.
The subscription to the newsletter may be cancelled at any time by the user. There is a link in each newsletter for this purpose. Users with online registration to the customer club or in the online shop may also revoke their consent to receive the newsletter online at any time.
It is also possible to send notice of revocation by email to dataprotection@LSAG.com zu richten.
No other data will be passed on. The data are sent to companies within the European Union or within the European Economic Area or to US companies with Privacy Shield certification. They are not sent to any international organisations. They are sent so that the payment can be pro-cessed (by payment service providers), so that the address and credit rating can be checked (by address and credit investigation companies), and so that the orders can be dispatched (by freight forwarding companies). The legal basis for this is Art. 6 (1) b) GDPR and Art. 6 (1) f) GDPR. The transfer of the data is absolutely necessary for the fulfilment of the contract therefore you have no right to object to their transfer.
The legal basis for registration is the consent of the user in accordance with Art. 6 (1) a) GDPR. The legal basis for the execution of purchase orders placed by the user is Art. 6 (1) b) GDPR and Art. 6 (1) f) GDPR.
The data are processed for the conclusion of contractual matters.
The data will be deleted as soon as they are no longer required for the purpose for which they were collected.
The personal data are required for the fulfilment of the contract therefore you cannot exercise any right of objection and deletion in this respect. Naturally users may cancel the registration online at any time.
The data will be used solely for the customer club processes.
The data are used solely for the calculation of yourKIDS bonus points.
The legal basis for the processing of the data is the consent of the user in accordance with Art. 6 (1) a) GDPR.
Users need to log into the customer club section for certain content and services.
These services include (mobile) club card, exchange without receipt, yourSIZE (foot measure-ment and shoe size recommendation – optional: separate registration required), yourKIDS (bonus scheme for the purchase of children's shoes – optional: separate registration required), birthday surprises, price savings, promotions, prize draws and newsletters (optional: separate registration required).
The data will be deleted as soon as they are no longer required for the purpose for which they were collected. This is the case for the data collected during the registration process if the regis-tration for the customer club is cancelled or changed.
Registered users may correct their data or revoke their registration online at any time. It is also possible to send an email to yourclub@humanic.net or to dataprotection@LSAG.com.
The data are used solely for the measurement of the feet and the shoe size recommendation. The data are passed on to processors in connection with the data usage. These transfers take place within the European Union (EU) or the European Economic Area (EEA).
Registered users may correct their data or revoke the use of yourSIZE online at any time. It is also possible to send an email to yourclub@humanic.net or to dataprotection@LSAG.com.
Alternatively, you can contact us via the email address provided. In this case, the personal data transmitted by the user with the email will be stored. In this context, the data will not be passed on to third parties. The data will be used for the sole purpose of communicating with the user.
The legal basis for the processing of the data is the consent of the user in accordance with Art. 6 (1) a) GDPR. The legal basis for the processing of the data transmitted in the course of sending an email is Art. 6 (1) f) GDPR. If contact is made by email with a view to entering into a contract, the additional legal basis for the processing is Art. 6 (1) b) GDPR.
The personal data taken from the input mask are processed only to deal with the matter about which we were contacted. If contact is made by email, this also constitutes the necessary legiti-mate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to safeguard the security of our information technology systems.
The data will be deleted as soon as they are no longer required for the purpose for which they were collected. Where personal data are taken from the input mask of the contact form and are sent by email, this is the case when the respective conversation with the user is finished. The conversation is finished when it can be inferred from the circumstances that the relevant points have been clarified and the matter has been finalised.
The additional personal data collected during the sending process will be deleted after a period of no more than 30 days.
Users may revoke their consent to the processing of the personal data at any time. If users con-tact us by email, they may object to the storage of their personal data at any time. In any such case, the conversation cannot be continued.
In order to withdraw your consent, please write to dataprotection@LSAG.com. All the personal data stored in the course of the conversation will be deleted in this case.
All the data listed here are provided to Google Inc. They are provided for the purpose of analysing the usage of our website by visitors (incl. online shop). The legal basis of the transfer is the Privacy Shield framework. The data are not sent to any international organisations.
The purpose of web analysis is to analyse the behaviour of our users in order to optimise our website for them.
The data will be deleted as soon as they are no longer required for the purpose for which they were collected or you revoke your consent by deleting the cookie.
We use social media plug-ins to attract attention to our advertising, to measure the success rate of our advertising and for target marketing.
All the data listed here are provided to the social media plug-in operator. They are provided with a view to attracting attention to our advertising and measuring the success rate of our advertising as well as for target marketing. The legal basis for the transfer of the data is the consent of the user in accordance with Art. 6 (1) a) GDPR. For social media plug-in operators based in the USA, the Privacy Shield framework is the legal basis of the transfer. The data are not sent to any international organisations.
Advertising analysis serves the purposes of attracting attention to our advertising, measuring the success rate of our advertising, and target marketing.
Users may revoke their consent to the processing of the personal data at any time by deleting the cookie.
There are CCTV systems on the shop floor and in the storage areas in some branches in order to prevent theft and to preserve evidence in the event of theft. The areas which are monitored are clearly indicated by pictograms.
The legal basis for the processing of the data is Art. 6 (1) f) GDPR.
The data are used to protect property and to preserve evidence in cases of theft.
The personal data are required for the overriding interest of protecting the property therefore you cannot exercise any right of objection and deletion in this respect.
We will have received these data either in the course of an electronic application (e.g. by email), by post, by personal delivery or from a recruitment consultant or an online platform.
In order to conduct the application process, personal data will be exchanged between the head office and the branches (Humanic and Shoe4You) of Leder und Schuh AG. These data will not be passed on to third parties and will only be used in connection with job application processes.
The legal basis for the processing of the data is a potential employment contract which we may wish to enter into with you. In this sense, the legal basis is the fulfilment of the contract pursuant to Art. 6 (1) b) GDPR.
The applicant data are used to recruit employees and to establish working relationships (conclu-sion of employment contracts).
The personal data will be stored for as long as necessary to accomplish the relevant purpose or to fulfil legal obligations to preserve business records or to safeguard legal claims. The data will be deleted on expiry of the statutory retention periods.
Users may revoke their consent to the processing of the personal data at any time by sending an email to dataprotection@LSAG.com.
You have the right to request information as to whether your personal data are transferred to a third country or to an international organisation. In this context, you may ask to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
You have a right to ask the controller to correct and/or complete your personal data records if the information being processed is incorrect or incomplete. The controller must rectify the situation without undue delay.
Where processing has been restricted, such personal data may – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.
If the processing was restricted on the conditions listed above, you will be informed by the con-troller before the restriction is lifted.
(1)	Your personal data are no longer needed for the purposes for which they were collected or otherwise processed.
(2)	You withdraw your consent on which the processing was based pursuant to Art. 6 (1) a) or Art. 9 (2) a) GDPR and there is no other legal basis for the processing.
(3)	You file an objection to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing, or you file an objection to the processing pursuant to Art. 21 (2) GDPR.
(4)	Your personal data have been processed unlawfully.
(5)	The erasure of your personal data is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.
(6)	Your personal data have been collected in relation to the offer of information society ser-vices referred to in Art. 8 (1) GDPR.
Where the controller has made your personal data public and is obliged pursuant to Art. 17 (1) GDPR to erase the data, the controller, taking account of the available technology and the im-plementation costs, shall take reasonable steps – including technical measures – to inform those responsible for the data processing who are processing personal data that you, the data subject, have requested that they erase all links to these personal data or to copies or replications of these personal data.
If you have exercised the right of rectification, erasure or restriction of processing against the controller, then the controller will be obliged to notify all recipients to whom your personal data have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort and expense. You have the right to be notified about these recipients by the controller.
In exercising this right, you also have the right to have the personal data transmitted directly from one controller to another where this is technically feasible. The freedoms and rights of others must not be adversely affected in this process.
The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is carried out on the basis of Art. 6 (1) e) or f) GDPR. The controller will no longer process your personal data unless the latter can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the data are processed for the establishment, exercise or defence of legal claims.
If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data for the purpose of such marketing. This also applies to profiling insofar as it is connected with such direct marketing. If you object to the pro-cessing for direct marketing purposes, your personal data will no longer be processed for these purposes.
In the context of the use of information society services – notwithstanding Directive 2002/58/EC – you may exercise your right of objection by automated means using technical specifications.
You have the right to revoke your consent pursuant to data privacy law at any time. The revoca-tion of consent will not affect the legality of the processing carried out on the basis of the consent until its revocation.
These decisions may not be based on special categories of personal data referred to in Art. 9 (1) GDPR, however, unless Art. 9 (2) a) or g) applies and suitable measures have been put in place to protect the rights and freedoms and your legitimate interests. In the cases referred to in paragraphs (1) and (3) above, the data controller shall implement suitable measures to safeguard the rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, the right to express your point of view and the right to contest the decision.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual resi-dence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78