Privacy Policy
We are pleased that you are visiting our website. Protecting and safeguarding your personal information when you use our website is very important to us.
Therefore, we would like to inform you here about which of your personal data we collect when you visit our website and for what purposes it is used.
This privacy policy applies to the online services of Raiffeisen Waren GmbH, which are accessible under the domain www.rw.net and the various subdomains (“our website”).
A. Responsible person
The controller pursuant to Article 4(7) of the General Data Protection Regulation (GDPR) is:
for www.rw.net and its subdomains:
Raiffeisen Waren GmbH,
Ständeplatz 1-3,
34117 Kassel,
Email: datenschutz@rw.net
You can reach our data protection officer at: datenschutz@rw.net or at our postal address with the addition "Data Protection Officer".
Shared responsibility
For some processing activities, we are not solely responsible, but jointly with one or more other controllers. Joint responsibility exists when two or more controllers determine the purposes and means of processing personal data. We have grouped these joint controllership activities below according to purpose and contractual partners.
Joint controllership means that there are common purposes for the processing and data subjects can enforce their rights under Articles 12-22 GDPR, including Article 77 GDPR, against both controllers.
For the processing of personal data with Page Insights on Facebook and Instagram, we jointly determine the purposes and means with
Facebook Irland Limited
4 Grand Canal Square, Grand Canal Harbour, Dublin 2 (Irland)
https://www.facebook.com/help/contact/2061665240770586
Our privacy policy regarding joint responsibility can be found here.
For the processing of personal data with Page Insights on LinkedIn, we jointly determine the purposes and means with
LinkedIn Ireland Unlimited Company
Wilton Place, Dublin 2 (Irland)
https://www.linkedin.com/legal/impressum
You can find our detailed privacy policy here.
B. Processing of personal data
This privacy policy fulfills the legal requirements for transparency in the processing of personal data. Personal data is any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, email address, IP address, or user behavior when visiting a website. Information that we cannot link to you (or only with disproportionate effort), for example, through anonymization, is not considered personal data. The processing of personal data (e.g., collection, retrieval, use, storage, or transmission) always requires a legal basis and a defined purpose.
Storage duration
Stored personal data will be deleted as soon as the purpose of the processing has been fulfilled and there are no legitimate grounds for further retention of the data. We will inform you about the specific retention periods or criteria for storage in the individual processing operations. Regardless of this, we may store your personal data in individual cases for the establishment, exercise, or defense of legal claims and where statutory retention obligations exist. If deletion is not possible in a specific case, the corresponding personal data will be marked with the aim of restricting its future processing.
Possible recipients of personal data
We only share your personal data, which we process on our website, with third parties if this is necessary for fulfilling the purposes for which it was collected and is covered by a permissible legal basis in each individual case (e.g., consent or the protection of legitimate interests). Furthermore, we may share personal data with third parties in individual cases if this serves the establishment, exercise, or defense of legal claims. Potential recipients may then include, for example, law enforcement agencies, lawyers, auditors, courts, etc.
Legal basis for processing
We process your personal data to fulfill contractual or pre-contractual obligations on the legal basis of Article 6(1)(b) GDPR. We also process personal data based on our legitimate interests. For each processing activity, we will inform you specifically about the legitimate interests involved. The legal basis for the balancing of interests based on legitimate interest is Article 6(1)(f) GDPR. Processing of personal data is also possible if you have given us your consent in accordance with Article 6(1)(a) GDPR. Furthermore, we may be legally obligated to process your data; the legal basis for this is Article 6(1)(c) GDPR.
Legitimate interest
In accordance with Article 6(1)(f) GDPR, we process personal data based on legitimate interests. Legitimate interests may include direct marketing, public relations, business management, fraud prevention, the implementation of security measures, and the establishment, exercise, or defense of legal claims. If, in a specific case, it is not possible to object to a legitimate interest, we will indicate this in the respective processing activity.
Should there be further legitimate interests in individual cases, we will explicitly inform you of these before processing.
Stored personal data will be deleted as soon as the purpose of the processing has been achieved and there are no legitimate grounds for further retention of the data.
We will inform you about the specific storage periods or criteria for storage in the individual processing operations.
Regardless, in individual cases we store your personal data for the establishment, exercise or defense of legal claims and where there are statutory retention obligations.
Third-country transfer
It is possible that personal data may be transferred to a third country (countries outside the European Union). Such transfers will be based on appropriate safeguards pursuant to Article 46 of the GDPR to guarantee an adequate level of data protection. Should this not be possible, we will inform you separately and request your consent.
C. Processing in detail
Below we inform you about the individual processing operations, the scope and purpose of the data processing, the legal basis, the obligation to provide your data and the respective storage period.
1. Cookies
Cookies are small text files that are placed on your computer or mobile device when you visit a website.
Purpose and legal basis
For technically necessary cookies, the legal basis for the processing of personal data is Art. 6 para. 1 lit. f) GDPR, our legitimate interest in ensuring security measures, due to legal obligations or to provide necessary functions for the website.
Cookies that go beyond what is technically necessary are used to improve our website services and for statistical and analytical purposes. If you have given us your consent to the use of cookies based on a notice we provided on the website ("cookie banner"), the lawfulness of the use is additionally governed by Article 6(1)(a) GDPR.
Storage duration
As soon as the data transmitted to us via cookies is no longer required to achieve the purposes described above, this information will be deleted.
Further storage may occur in individual cases if this is required by law or if you have explicitly consented to it.
Browser configuration regarding cookies
Most browsers are preset to accept cookies by default.
However, you can configure your browser to accept only certain cookies or no cookies at all.
However, please note that if cookies are disabled through your browser settings on our website, you may no longer be able to use all the functions of our website.
You can also delete cookies already stored in your browser via your browser settings. Furthermore, it is possible to configure your browser to notify you before cookies are stored. Since different browsers may vary in their functionality, please consult your browser's help menu for configuration options.
If you would like a comprehensive overview of all third-party access to your internet browser, we recommend installing specially developed plug-ins for this purpose.
2. Provision of the website
Type and scope of processing
When you access and use our website, we collect the personal data that your browser automatically transmits to our server.
The following information is temporarily stored in a so-called log file:
IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which access is made (referrer URL)
The browser used and, if applicable, the operating system of your computer, as well as the name of your access provider.
Purpose and legal basis
The processing is carried out to protect our overriding legitimate interest in displaying our website and ensuring its security and stability, based on Article 6(1)(f) GDPR. The collection of this data and its storage in log files is essential for the operation of the website. Due to the exception under Article 21(1) GDPR, there is no right to object to this processing.
Insofar as the further storage of log files is required by law, the processing is carried out on the basis of Art. 6 para. 1 lit. c) GDPR.
There is no legal or contractual obligation to provide the data; however, accessing our website is technically impossible without providing the data.
Storage duration
The aforementioned data is stored for a specific purpose; technically necessary data is typically stored for 14 days. Once the purpose for processing no longer applies, the personal data is deleted. Further storage may occur in individual cases if required by law or necessary for the enforcement of legal claims.
3. Contact form
Type and scope of processing
On our website, we offer you the option of contacting us via a provided form. The information collected via mandatory fields is required to process your request.
You may also voluntarily provide additional information that you consider necessary for processing your contact request.
When using the contact form, your personal data will not be shared with third parties.
Purpose and legal basis
Your data is processed through our contact form for the purpose of communication and processing your inquiry, based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR.
If your inquiry relates to an existing contractual relationship with us, processing is carried out for the purpose of fulfilling the contract, based on Art. 6 para. 1 lit. b) GDPR.
There is no legal or contractual obligation to provide your data; however, processing your inquiry is not possible without providing the information in the mandatory fields.
Use of the web form is voluntary. If you do not wish to provide this data, please contact us using other means.
Storage duration
If you use the contact form based on your consent, we will store the data collected for each inquiry for three years, starting from the date your inquiry is processed or until you withdraw your consent.
If you use the contact form within the context of a contractual relationship, we will store the data collected for each inquiry for three years from the end of the contractual relationship.
4. Registering a customer account in the service portal
Type and scope of processing
As part of the order processing and to present our services to you in a consolidated manner, we collect your personal data to register a customer account. You can choose whether to order as a guest or register a permanent user account.
The information collected during registration via the mandatory fields is identical in both cases and is required for processing the order in the online shop.
When registering a permanent user account, we also collect a password that you choose yourself. Furthermore, you can voluntarily provide additional information that you consider necessary for processing the order.
Your personal data will only be shared with third parties (e.g., shipping providers/freight forwarders) and data processors in accordance with Article 28 of the GDPR to the extent necessary for processing the order.
Purpose and legal basis
We process your personal data for the purpose of registering a customer account in order to fulfill a contract with you pursuant to Art. 6 para. 1 lit. b) GDPR. There is a contractual obligation to provide your data insofar as it relates to the mandatory fields, as this information is necessary for identifying you and for us to fulfill the contract. There is no legal obligation to provide the data.
Without providing this information, placing an order in our online shop and therefore concluding a contract is not possible. There is no obligation to provide the additional information you voluntarily submit.
Ordering from our online shop is also possible without disclosing this voluntary information.
The additional processing of your password for registering a permanent user account is carried out for the purpose of providing a customer account, displaying your previous purchases, and storing your purchase-related data (e.g., billing address, various delivery addresses) based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR. You can revoke your consent at any time with effect for the future by deleting your customer account pursuant to Art. 7 para. 3 GDPR.
Furthermore, we use pseudonymized data in aggregated form for statistical analysis to learn which areas of the service portal or which products are of interest to our customers and which services our customers use.
Storage duration
If you order as a guest, we store your personal data until your order is fully processed (contract end). If you register a permanent customer account, we store the purchase-related data beyond the end of the contract until you withdraw your consent (delete your customer account). In both cases, your data will only be stored further if there are legal retention obligations (e.g., tax and commercial law).
5. Web forms for using our services and for business communication
Type and scope of processing
We offer forms through which you can provide your data for:
▪ business communication purposes,
▪ product inquiries and requests for consulting services,
▪ requesting business information from the Raiffeisen Waren Group (e.g., annual report, sustainability or quality report),
▪ ordering heating oil, gas, electricity,
▪ ordering a fuel card
, ▪ requesting an e-invoice,
▪ submitting a sponsorship request to us
can enter data.
Type and scope of processing and legal basis
When you use a form on one of our websites, we collect the data you enter, at least the information marked as mandatory. The data from the web form is transmitted to the website's server using HTTPS (SSL) encryption and forwarded to us via email. In all email communication, in addition to the data you enter (message content), connection data (e.g., IP address, email client, timestamp), metadata (e.g., size of the data transferred), and any attachments containing personal data are also processed. Emails are routinely scanned for unwanted content (e.g., viruses, spam) by our technical systems.
The processing of your data through the use of one of our web forms is based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR for the purpose of communication and processing your request.
If your request relates to an existing contractual relationship with us, the processing is based on Art. 6 para. 1 lit. b) GDPR for the purpose of fulfilling the contract.
There is no legal or contractual obligation to provide your data; however, processing your request is not possible without providing the information in the required fields.
Using the web form is voluntary. If you do not wish to provide this data, please contact us using other means.
Storage duration
If you use the web form based on your consent, we will store the data collected for each request for three years, starting from the date your request is processed or until you withdraw your consent.
If you use the web form within the context of a contractual relationship, we will store the data collected for each request for three years from the end of the contractual relationship.
6. Newsletter
Type and scope of processing
If you register on our website to receive our newsletter, we collect your email address and your name (last name, first name, title) and store this information together with the date of registration and your IP address.
You will then receive an email in which you must confirm your newsletter subscription (double opt-in). If you do not confirm your subscription within 24 hours, it will expire automatically and your data will not be processed for newsletter distribution.
Purpose and legal basis
We process your data for the purpose of sending newsletters based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by unsubscribing from the newsletter pursuant to Art. 7 para. 3 GDPR.
There is no legal or contractual obligation to provide your data; however, sending the newsletter is not possible without providing your data.
Storage duration
Your personal data will be deleted as soon as it is no longer required for the aforementioned purposes. Therefore, we store your personal data for newsletter distribution as long as you are subscribed to the newsletter.
7. Newsletter Tracking
If you have subscribed to our newsletter, we would like to inform you that we conduct a pseudonymized analysis of newsletter opening rates, including when newsletters are opened and which links are clicked. While it is technically possible to associate this data with individual newsletter recipients, the analysis of personal data is disabled. This means that information about newsletter recipients is only evaluated in pseudonymized form. The analyses cannot be decrypted or linked to individual persons.
Purpose and legal basis
We process your data for the purpose of optimizing newsletter content and design based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by unsubscribing from the newsletter pursuant to Art. 7 para. 3 GDPR.
There is no legal or contractual obligation to provide your data; however, sending the newsletter is not possible without providing your data.
Disabling tracking
You can prevent newsletter tracking by not subscribing to the newsletter or, with effect for the future, by unsubscribing from the newsletter.
8. eTracker
Type and scope of processing
We have integrated components from the company etracker into our website. etracker is a web analytics service. Web analytics involves the collection, gathering, and analysis of data about the behavior of website visitors.
A web analytics service collects data about, among other things, which website a user came from (the so-called referrer), which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analytics is primarily used to optimize a website and to analyze the cost-effectiveness of online advertising.
The operating company of etracker is etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany.
Cookies are used to enable statistical analysis of website usage by visitors and to display usage-related content or advertising. Since pseudonymization is implemented very early on, a legitimate interest can be invoked as the legal basis.
Purpose and legal basis
The legal basis for the processing of personal data using cookies is Article 6(1)(f) GDPR.
Storage duration
To protect your privacy, etracker pseudonymizes data such as IP addresses, login credentials, and device identifiers as early as possible, making it impossible to identify you personally. etracker is committed to never combining collected data with other data sets, for example, to establish a link to an individual. Usage profiles are created under a pseudonym from the information transmitted during your visit. Cookies are used for this purpose.
To object to the collection and storage of your visitor data in the future, you can obtain an opt-out cookie from etracker at any time via the following link: www.etracker.de/privacy =.
This prevents etracker from collecting and storing any future visitor data from your browser. This sets an opt-out cookie named "cntcookie" from etracker.
Please do not delete this cookie if you wish to maintain your objection. Further information can be found in etracker's privacy policy.
We use this service solely for the purpose of increasing the efficiency of our website.
No evaluation takes place, except for statistical purposes in anonymized form (https://www.etracker.com/privacy_info?et=YKgzQb).
The data generated by etracker is processed and stored by etracker exclusively in Germany on behalf of the provider of this website and is therefore subject to strict German and European data protection laws and standards.
etracker has been independently audited, certified and awarded the data protection seal of approval (https://www.eprivacy.eu/kunden/vergebene-siegel/firma/etracker-gmbh/).
Further information on data protection at etracker can be found at https://www.etracker.com/datenschutz/ .
9. Smart Pro
We use technically necessary cookies from Piwik Pro to provide the cookie banner. The legal basis for this is Article 6(1)(c) GDPR, in order to comply with our legal obligation to obtain consent. The technically necessary data is processed on the basis of Article 6(1)(f) GDPR. No analysis takes place without your consent.
For analytical purposes, we also use additional cookies from Piwik Pro. Type and scope of processing
We have integrated the Piwik Pro component (with pseudonymization function) into our website. Piwik Pro is a web analytics service. Web analytics involves the collection, gathering, and analysis of data about the behavior of website visitors. A web analytics service records, among other things, data about which website a user came from (the so-called referrer), which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analytics is primarily used to optimize a website and for cost-benefit analysis of online advertising or to optimize website design.
The cookie is activated based on your consent. The IP address of the data subject's internet connection is shortened and pseudonymized.
Purpose and legal basis
The purpose of the Piwik Pro component is to analyze visitor traffic on our website. Piwik uses the collected data and information, among other things, to evaluate the use of our website, to compile online reports for us that show the activities on our website, and to provide other services related to the use of our website.
Piwik Pro places a cookie on the data subject's information technology system. By setting this cookie, Google is enabled to analyze the use of our website. Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which a Piwik Pro component has been integrated, the respective Piwik Pro component automatically prompts the internet browser on the data subject's information technology system to transmit data to Piwik for the purpose of online analysis. As part of this technical process, Piwik receives personal data, such as the data subject's IP address, browser and device information, which Piwik uses, among other things, to track the origin of visitors and clicks.
The data is processed on the basis of your consent pursuant to Art. 6 para. 1 lit. a) GDPR.
Elimination option
You can refuse the setting of cookies by our website by not consenting to processing for analytical purposes. Consent given in the cookie banner can also be revoked at any time for the future by deleting the cookie or changing the cookie settings in our privacy policy.
As already shown above, you can also prevent the setting of cookies at any time by adjusting the settings of your internet browser accordingly, and thus permanently object to this.
If you do not give us your consent, you can still visit our website, however, not all functions may be fully available.
10. Google Maps
Type and scope of processing
Our website integrates content from Google Maps ("Google"). By visiting a page on our website that includes Google Maps, data about your behavior when using Google Maps is transmitted to and processed by Google.
The processing and transmission of data to Google does not occur automatically, but only through the user's active clicking. Only through this conscious action will data about your behavior when using Google Maps be transmitted to and processed by Google. Google receives information such as the fact that you have accessed the corresponding subpage of our website.
The data processed by Google may include, in particular, your IP address and location data, which, however, will not be collected without your consent (usually given through the settings of your mobile devices).
Purpose and legal basis
Google processes this data as usage profiles and uses it for market research purposes and/or to tailor Google Maps to user needs.
If you are a Google customer and logged into a Google service, this data will be directly linked to your Google account. If you do not want this, you must log out of Google before visiting our website.
The data is processed on the basis of Art. 6 para. 1 lit. a) GDPR.
This serves as the legal basis for our company's processing operations where we obtain consent for a specific processing purpose.
Providing your personal data is neither legally nor contractually required, nor is it necessary for entering into a contract. You are also not obligated to provide your personal data.
However, failure to provide this information may result in you being unable to use our website, or not being able to use it fully.
Elimination option
If you want to prevent data sharing, you cannot use the features of Google Maps.
Nevertheless, we recommend that you regularly log out of your user account on a social network after using it, and especially before activating embedded content, as this will prevent it from being associated with your profile on the respective provider's platform.
11. GoogleAds
Type and scope of processing
We have integrated Google Ads into our website. Google Ads is a service provided by Google Ireland Limited to display targeted advertising to users.
Google Ads uses cookies and other browser technologies to analyze user behavior and recognize returning users.
Google Ads collects information about visitor behavior across various websites. This information is used to optimize the relevance of advertising.
Furthermore, Google Ads delivers targeted advertising based on behavioral profiles and geographic location. Your IP address and other identifying information, such as your user agent, are transmitted to the provider.
If you are registered with a Google Ireland Limited service, Google Ads can associate your visit with your account.
Even if you are not registered with Google Ireland Limited or are not logged in, it is possible that the provider can determine and store your IP address and other identifying information.
In this case, your data is transferred to the operator of Google Ads, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose and legal basis:
We process your data using Google Ads for the purpose of optimizing our website and for marketing purposes based on your consent pursuant to Art. 6 para. 1 lit. a GDPR.
Storage period:
As soon as the data transmitted to us via cookies is no longer required to achieve the purposes described above, this information will be deleted.
12. Use and application of YouTube
Type and scope of processing
We use videos and YouTube plugins on our website. YouTube is a service provided by YouTube LLC (“YouTube”). YouTube LLC is a subsidiary of Google Ireland Limited (“Google”).
When you visit a website that embeds a YouTube video, data is transferred to and stored on a Google server. This does not happen automatically, but only when you actively click on the video. Only through this conscious activation is data about your YouTube usage transmitted to and processed by Google. If you have a Google account and are logged in, Google can then associate your visit with your account. Google stores this data as usage profiles and uses it for its own purposes.
This analysis is carried out in particular (even for users who are not logged in) to display targeted advertising. You have the right to object to the creation of these user profiles. Please contact Google directly regarding this matter.
Purpose and legal basis
By integrating YouTube, we aim to present various videos on our website so that you can watch them directly on our site. The data is processed on the basis of Article 6(1)(a) GDPR. This serves as the legal basis for our company's processing operations where we obtain consent for a specific processing purpose.
Providing your personal data is neither legally nor contractually required, nor is it necessary for entering into a contract. You are also not obligated to provide your personal data. However, failure to provide it may result in you being unable to use our website, or not being able to use it fully.
Preventing data sharing
If you wish to prevent data sharing, you cannot use YouTube's features. Regardless, we recommend that you regularly log out of your social network account after use, and especially before activating embedded content, as this will prevent your activity from being associated with your profile on the respective platform.
13. Use of external links to social media networks
We have integrated external links on our website.
Typically, the button solutions provided by social networks transmit personal data to the respective social network as soon as a user visits a website into which a social media button has been integrated.
Personal data is only transmitted to social networks when a website visitor actively clicks one of the social media buttons via external links.
The use of such external links is intended to protect the personal data of visitors to our website and at the same time to allow us to integrate a button solution for social networks, among others, on this website.
D. Rights of data subjects
Under the conditions of the legal provisions of the General Data Protection Regulation (GDPR), you as a data subject have the following rights:
• Information pursuant to Art. 15 GDPR in conjunction with Section 34 BDSG regarding the data stored about you in the form of meaningful information on the details of the processing, as well as a copy of your data;
• Rectification pursuant to Art. 16 GDPR of inaccurate or incomplete data stored by us;
• Erasure pursuant to Art. 17 GDPR in conjunction with Section 35 BDSG of the data stored by us, insofar as the processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• Restriction of processing pursuant to Art. 18 GDPR, insofar as the accuracy of the data is contested, the processing is unlawful, we no longer need the data and you object to its erasure because you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR.
• Data portability pursuant to Article 20 GDPR, insofar as you have provided us with personal data within the framework of consent pursuant to Article 6(1)(a) GDPR or on the basis of a contract pursuant to Article 6(1)(b) GDPR and this data has been processed by us using automated procedures. You will receive your data in a structured, commonly used and machine-readable format, or we will transmit the data directly to another controller, insofar as this is technically feasible.
• Withdrawal of your consent pursuant to Article 7(3) GDPR with effect for the future.
• Objection pursuant to Article 21 GDPR in conjunction with Section 36 BDSG to the processing of your personal data, insofar as this is based on Article 6(1)(f) GDPR and there are grounds for this arising from your particular situation or the objection is directed against direct marketing. The right to object does not exist if overriding legitimate grounds for the processing are demonstrated or the processing is carried out for the establishment, exercise or defense of legal claims.
• You have the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR if you believe that the processing of your personal data infringes the GDPR. You can usually contact the supervisory authority of your habitual residence, your place of work, or our company's registered office.
No automated decision-making, including profiling, takes place on the raiwa.net website.
If you have any questions about data protection or your rights as a data subject, please contact the contact persons listed at the beginning of the page.