Data privacy statement

OC Payment GmbH, Domstraße 20, 50668 Cologne, Germany, hereinafter referred to as “paymenttools” or “we”, operates the website www.paymenttools.com.

This information gives you an overview of the processing of your personal data when you visit the paymenttools.com website. We inform you about what data we collect from you and how we use it. We also inform you of your rights under applicable data protection law and tell you who to contact if you have any questions.

1 Controller

The controller under data protection law is the: Company indicated above

2 Contact person for data protection

DYou can reach the controller’s data protection officer at:

OC Payment GmbH
Datenschutzbeauftragter
Domstraße 20
50668 Köln
E-Mail:dataprotection@paymenttools.com

3 Processing of personal data

We process your personal data when you visit the paymenttools.com website, provide us with information via a contact form on our website, request access to protected information or otherwise contact us. The following data or data categories may be collected:

  • data you provide when contacting us (including title, first name, last name, email address, telephone number, company, position, address, date of registration, date of last login)
  • data generated when using our website through the use of cookies, web beacons, advertising IDs and other unique identifiers and technologies (e.g. device ID, operating system, pages viewed, links clicked, services used, time of use)
  • data that you provide to us when you apply for an advertised position or send us an unsolicited application (personal data, education data, career history data, cover letter, CV, portrait photo, certificates)
  • data that you provide on career platforms such as Xing and LinkedIn or other platforms such as Stackoverflow and that we collect as part of the recruiting process (surname and first name that you provided on the platform, your current position, the date we contacted you, your response to our inquiry, samples of your work, etc.)

4 Scope, purpose and legal basis of data processing

4.1 Making contact via the contact form

You can contact us via the contact form, email, post and telephone. We process your data in order to answer your inquiry and, if necessary, to send you requested information material. Your data may be transferred to the office responsible for your request. The legal basis for the data processing described above is Article 6 (1) sentence 1 b), f) GDPR (pre-contractual measure, fulfilment of contract or balancing of interests, based on the interest of paymenttools in answering inquiries).

4.2 Recruiting and application

We process your personal data when you apply to paymenttools via the contact form on the paymenttools.com website or in any other way. Your data will be analysed as part of the application process and, if necessary, forwarded to the head of the department to which you have applied. In addition, the data required for this purpose will be used in the context of job interviews and corresponding rejections or offers. Specifically, this may be the following data:

  • data collected when using our website (pages viewed, links clicked, the date and time of the request, the duration of the visit, the identification data of the type of browser and operating system used and the website from which you are visiting us)
  • data you provide when setting up a candidate profile (first name, surname, email address, password, place of residence (country), address, title, telephone number, date of birth, interest in receiving email notifications on job tickers with new job offers and/or information about the company, invitations to events and interviews about the application process, consent to being included in the candidate pool, documents you upload such as CVs and certificates)
  • data that you provide to us as part of an application by email or post
  • data about your applications submitted when using the online application system (title, first name, surname, date of birth, address, email address, telephone number, mobile phone number, previous contacts with a REWE Group company, first name and surname of parent/guardian, data on school education, training and studies, data on previous professional career, data on driving licence, data on possible impairments, data on field of employment, cover letter, CV, certificates, portrait photo, insofar as you provide us with the respective information)
  • data from job-oriented social networks (e.g. Xing, LinkedIn) insofar as they are generally accessible
  • data that we require as proof of your consents, e.g. when you are admitted to the candidate pool, when you receive information about the company or invitations to events and declarations of consent given
  • data that you provide to us via a web form on a website maintained by paymenttools or in any other way when you contact us
  • data that you provide to us in the context of a chat application (voice recording and text logs) (first name, surname, email address, telephone number, professional and managerial experience, education and further education, job interests, driving licence, mobility, skills, health pass, health insurance pass, availability, place of residence, postcode, insofar as you provide us with the respective information)

data that you provide to us in the context of a chat application (voice recording and text logs) (first name, surname, email address, telephone number, professional and managerial experience, education and further education, job interests, driving licence, mobility, skills, health pass, health insurance pass, availability, place of residence, postcode, insofar as you provide us with the respective information)

The primary purpose of data processing is the establishment, implementation and termination of the employment relationship. The primary legal basis for this is Article 88 GDPR in conjunction with. section 26 (1) sentence 1 of the German Data Protection Act (BDSG).

Insofar as special categories of personal data are processed pursuant to Article 9 (1) GDPR, this serves the exercise of rights or the fulfilment of legal obligations under labour law, social security law and social protection law within the framework of the employment relationship (e.g. disclosure of health data to the health insurance fund, recording of severe disability for the purposes of granting additional leave and determination of the severely disabled person’s levy). This is done on the basis of Article 9 (2) b) GDPR in conjunction with section 26 (3) BDSG. In addition, the processing of health data may be necessary for assessing your fitness for work pursuant to Article 9 (2) h) in conjunction with section 22 (1) b) BDSG. In addition, the processing of special categories of personal data may be based on consent pursuant to Article 9 (2) a) GDPR in conjunction with section 26 (2) BDSG (e.g. occupational health management).

If we collect other categories of personal data not mentioned here or wish to process them for a purpose not mentioned above, we will inform you in advance.

We offer you the option of conducting the interview via Google Hangouts video telephony. We would like to point out that this is an offer and not an obligation. If you do not agree to the use of Google Hangouts, this will not have a negative impact on the application process. In this case, we will arrange an interview by telephone or, if possible, in person. With regard to data processing by Google Ireland Limited, we refer to the corresponding data privacy statement: https://policies.google.com/privacy. Data processing within Google Hangouts video telephony is based on your consent and thus occurs in accordance with Article 6 (1) sentence 1 a) GDPR, section 26 (2) BDSG. You may revoke your consent at any time with future effect. Even in the event of a revocation, this has no negative impact on the application process.

4.3 Forwarding to social media services

On our website you will find links to the platform operators of LinkedIn, Xing, Twitter and Kununu. You can recognise links to the websites of social media services by the respective company logo. If you follow these links, you will reach paymenttools’ corporate presence on the respective social media service. Clicking on a link to a social media service establishes a connection to the servers of the social media service. This communicates to the servers of the social media service that you have visited our website. In addition, further data is transferred to the provider of the social media service. These are, for example:

  • address of the website on which the activated link is located
  • date and time the website is accessed or the link is activated
  • information about the browser and operating system used
  • IP address

The social media service uses web tracking methods. As already explained, we are unfortunately able to exercise very little influence on the web tracking methods of the platform. We cannot switch them off, for example. Please be aware of this. You can find more detailed information on data processing by this operator and further objection options in the privacy policy of the respective operator.

4.4 Cookies

To be able to optimally design the website accordingly. This allows for easier navigation and a high degree of user-friendliness. Cookies are small text files that are stored on your terminal’s hard disk. They allow information to be retained for a certain period of time and your terminal device to be identified. We only use so-called session cookies, which are automatically deleted when you close your browser. You can set your browser to inform you about cookies being placed. This makes the use of cookies transparent for you. Important: If you completely exclude the use of cookies, you may not be able to use individual functions of our website.

Necessary technologies
We use necessary technologies. These services, technologies and cookies are necessary to guarantee central functions or the correct display of the portal. They cannot be deactivated by you as a website user. The use of the necessary technologies takes place on the legal basis of Article 6 (1) sentence 1 f) of the General Data Protection Regulation (balancing of interests, based on the interest of paymenttools in providing central functions of the website).

5 Recipients of personal data

Within paymenttools, only persons who need your data to complete the tasks assigned to them will have access to it. In addition, service providers who assist us in fulfilling our tasks may have access to your data. These are service providers in the following categories:

  • Hosting service providers for the operation of our servers
  • Development service providers for programming, development, maintenance and support of software applications
  • The vendors/recipients of data named in this data privacy statement within the scope of cookies and other technologies

We do not use service providers located in third countries outside the European Union to process your data.

Service providers we use must comply with special confidentiality requirements. They will only have access to your data to the extent and for the period of time that is necessary for the fulfilment of the tasks.

6 Storage period

We generally only store your data for as long as we need it for the respective processing purposes. If the data is no longer required for the fulfilment of the processing purposes stated in this data privacy statement, it will be deleted unless its retention is still necessary for the fulfilment of retention obligations under commercial or tax law.

  • data on an inquiry pursuant to point 4.1 as a rule three months, at the latest ten years after the event is completed
  • data on an application pursuant to point 4.2 for an advertised position six months after completion of the application process

7 Automated individual decision-making, profiling

We do not use your personal data for automated decision-making or profiling.

8 Your rights as a data subject

Insofar as we process your personal data, you as the data subject are entitled in particular to the following data subject rights under the requirements of data protection law.

8.1 Right to information

You may request information from us about the personal data which we process.

8.2 Rectification

If your information is not (or no longer) correct, you can request that your data be corrected. If your data is incomplete, you may request that it be completed.

8.3 Deletion

You have the right to demand the erasure of your data. Please note that a claim for erasure depends on the existence of a legitimate reason. In addition, there must be no regulations that oblige us to retain your data.

8.4 Restriction of processing

You have the right to demand that we restrict the processing of your data. Please note that a claim to restrict processing depends on the existence of a legitimate reason.

8.5 Objection on the grounds of legitimate interests

If data is collected on the basis of Article 6 (1) (f) GDPR (data processing for the protection of legitimate interests), you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing is for the purposes of asserting, exercising or defending legal rights/claims.

8.6 Right to lodge a complaint

You are entitled to lodge a complaint with the competent data protection supervisory authority if you do not agree with the processing of your data.

8.7 Data portability

You have the right to receive personal data that you have provided to us in an electronic format.