Data privacy

Thank you for your interest in our website and our services. For us, data is the basis for excellent service. However, our most important asset is the trust of our customers. Protecting customer data and using it only in the way our customers expect, is our number one priority. The following privacy notice is therefore intended to inform you about the processing of your personal data and your rights in this processing in accordance with the European General Data Protection Regulation ("GDPR") and other applicable data protection regulations.

1. General information

1.1 Responsible for the operation of this website is METRO AG, Metro-Straße 1, 40235 Duesseldorf, Germany (hereinafter "METRO", "we" or "us"). METRO attaches great importance to the protection of your personal data.

1.2 If you have any questions about privacy and data protection, you can contact our data protection officer using the following contact details: METRO AG, Data Protection Officer, Metro-Straße 1, 40235 Duesseldorf, Germany, email: datenschutz@metro.de.

1.3 This privacy policy explains how we collect, process and use personal data in connection with the provision of our website. Personal data are individual details about your personal or factual circumstances. We process your personal data that we collect, store and use exclusively within the framework of the applicable legal regulations.

2. Processing of Personal Data and Transfer to Third Parties

2.1 Some personal data is collected automatically via your device (computer, mobile phone, tablet, etc.) when you use our website. The IP address currently used by your device, date and time, the typ of browser and operating system of your device and the pages accessed are recorded. This is done for the purposes of data security and to optimise our offer as well as to improve our website. Any other analysis, with the exception of statistical purposes, and that always in anonymous form, is only carried out within the scope of this privacy policy. This personal data is processed on the basis of Article 6(1), first sentence, letter f) GDPR. The protection of our website and the optimisation of our services constitute a legitimate interest of METRO.

2.2 If you contact us (for example via an enquiry at datenschutz@metro.de), we only collect, process and use the personal data that you have made available to us and that is necessary to process and respond to your enquiry.

2.3 You can register for our information service using a separate form. After you have filled out the relevant registration form and, by doing so, sent us your personal data supplied therein as well as your consent to the use of your data for the purposes selected by you, we will send you a confirmation email. The sending of our information takes place only with your consent and is based on Article 6(1), first sentence, letter a) GDPR. You can opt out of receiving the information at any time via the respective link at the bottom of each message that you receive from us.

2.4 In order to enable the data processing procedures mentioned in this privacy policy, we use service providers as data processors within the meaning of Art. 28 GDPR, for example service providers for sending e-mails, maintenance and other services. These are both external service providers and service providers within METRO located in countries within and outside the European Union (EU) and the European Economic Area (EEA). Through contractual arrangements, we ensure that these service providers process personal data in accordance with the GDPR in order to guarantee a high level of privacy, even if personal data is transferred to a country with a different level of data protection for which no adequacy decision by the EU Commission exists. No further transmission of personal data to other recipients takes place unless we are legally obliged to do so. For more information on appropriate security measures for international data transfer or a copy thereof, please contact our data protection officer: datenschutz@metro.de.

3. Cookies

3.1 We use so-called cookies to make our services attractive to visitors and to enable the use of certain functions. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies). You can configure your browser so that you are notified when you receive a cookie and you can decide on an individual basis if you want to accept them; you can also refuse cookies for certain cases or generally refuse them. For more information, see the help section of your web browser. If you do not accept cookies, the functionality of our website may be limited. By accepting our "cookie banner", you agree to the processing of your personal data through cookies. This personal data is processed on the basis of Article 6(1), first sentence, letter a) GDPR. To learn more about cookies and other possible web tracking tools and the choices you have in this regard, please visit: http://youronlinechoices.eu/ (for users in the European Union). The following section takes a closer look at specific cookies.

3.2 On this website, we use Siteimprove Analytics, a web analysis service of Siteimprove GmbH, Kurfürstendamm 56, 10707 Berlin, Germany. We use Siteimprove Anlaytics to analyse website use by users in order to monitor the functionality of our websites (e.g. accessibility of our texts, functionality of links, etc.) and to provide our visitors with the most pleasant and useful experience possible. For example, your anonymised IP address, your browser and operating system, the URL visited, page title, length of stay and other statistical data are temporarily collected, which are used exclusively for quality checks. Their evaluation helps us to continuously improve our services for you.

The data Siteimprove collects and processes from European customers is stored in the EU. The dedicated data centres are located in Germany and Denmark.

3.3. We also work with the following external service providers, who use cookies themselves but do not receive any personal data from us:

• Pingdom Monitoring – monitors the technical functions and availability of our website.
• d.vinci – job portal, where we publish our job offers, which you can also access via our website
• Investis – display of the stock ticker and a mini chart on our website in the Investor Relations section
• SOLR instances (internal search services) – a powerful full-text search technology within our website

4. Provision of personal data and retention periods

The provision of your personal data is voluntary. You are not legally obliged to make your personal data available to us. If you choose not to make your personal data available to us, this has no consequences for you, except that you cannot use our services. Personal data that you make available to us via our website will only be stored until the purpose for which it was processed has been fulfilled or until you tell us to delete your data. We allow you to inspect, modify and delete your data stored with us via a safe procedure, by following the references that you receive from us in all correspondence. Deviating retention periods may, however, result from a legitimate interest of METRO (e.g. to guarantee data security and to prevent misuse). Personal data that we have to store due to legal or contractual retention obligations will be blocked.

5. Social media

Our website contains simple links to the following social media networks:

• Facebook (operated by: Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA)
• Twitter (operated by: Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA)
• XING (operated by: XING SE, Dammtorstraße 30, 20354 Hamburg, Germany)
• LinkedIn (operated by: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
• Youtube (operated by: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)

In these cases, a transfer of data to the social media operators mentioned only takes place if the corresponding icon (e.g. the "f" of Facebook or the bird symbol of Twitter) is clicked. If you click on one of these icons, a page of the corresponding social media operator opens in a popup window. There, you can publish information about our products according to the regulations of the social media operator.

Furthermore, on some of the sites offered by us freely accessible content from the third-party providers Youtube or Twitter is displayed. We do not transmit personal information to these third parties to display the content. YouTube and Twitter have their own cookie and privacy policies which we do not control. Please inform yourself about the data collected by third-party providers from the respective provider.

6. Your rights

to exercise your rights under the GDPR to

• obtain information about the processing of your personal data and a copy of this data (Art. 15 GDPR),
• rectification of inaccurate and completion of incomplete personal data (Art. 16 GDPR),
• erasure of your personal data and, if these have been made public, that METRO informs other controllers about the erasure request (Art. 17 GDPR),
• restriction of processing of your personal data (Art. 18 GDPR),
• data portability, so that your personal data is transmitted to you in a structured, commonly used and machine-readable format and the right to transmit this data to another controller without any hindrance from METRO (Art. 20 GDPR),
• withdrawal of consent given; the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7 GDPR) and
• object to processing of your data (Art. 21 GDPR), you can contact METRO’s Data Protection Officer (datenschutz@metro.de) at any time. You also have the right to lodge a complaint with the competent supervisory authority if you consider the data processing to be incompatible with the GDPR (Art. 77 GDPR).

METRO AG
Corporate Communications

Last amended: May 2018

Cookies - Information and Settings