1 Joint Controllers
The following companies are Joint Controllers for all processing of personal data in accordance with Art. 4 (7) of the EU General Data Protection Regulation (GDPR) and Art. 26 of the GDPR:
• FREY Berlin OpCo GmbH, Alter Spandauer Weg 1, 14641 Wustermark, Germany,
Telefon: +49 (0) 33 234 - 90 40
Email: info@designeroutletberlin.com
• ROS Berlin Management GmbH, Alter Spandauer Weg 1, 14641 Wustermark, Germany
Email: info@designeroutletberlin.com
hereinafter referred to as "data controllers".
Being Joint Controllers means that each of the data controllers process your data jointly, taking into account the highest data protection standards. A corresponding contract has been concluded between each of the data controllers. Even if there is joint responsibility, the data controllers fulfil the obligations under data protection law in accordance with their respective responsibilities. Within the framework of joint responsibility, you can assert your rights in connection with data processing with each of the data controllers.
Primarily, kindly direct your concerns and inquiries to ROS Berlin Management GmbH, Alter Spandauer Weg 1, 14641 Wustermark, Germany, Email: info@designeroutletberlin.com
You can reach our Data Protection Officer at the postal address provided above, adding “Attn: Data Protection Officer.”
2 General Data processing
2.1 Data processing in accordance with Art 13 GDPR
We process the data that data subjects provide to us, for example in the context of an inquiry by email, for the purpose of initiating and concluding a contract or a business relationship.
2.2 Data processing in accordance with Art 14 GDPR
In addition, we process data of persons who may be part of a contractual relationship, which we have permissibly received in the context of information provided by third parties (e.g., managing directors provide us with the data of their employees or colleagues).
2.3 Data Subjects
We process the following data from contracting parties (e.g. VIP Club members, competition participants): first and last name, email address, date of birth.
We process the following data from contact persons of tenants: Company, title and name of contact person, business address data and contact data, bank details, contract data.
We process the following data from suppliers and business partners that is required for the initiation or conclusion of a contract: Company, title and names of contact persons, business address data and contact data, bank details, contract data.
We process the following data from event participants: Name, contact data and address data.
2.4 Recipients of personal data
Recipients of personal data will only be third parties if it is necessary for the fulfilling of a contract or if it is required by law.
2.5 Data retention
1. Expiration of contractual obligations: If there are contractual provisions that prescribe how long personal data must be retained, the data controller ensures that these deadlines are met. Once these deadlines have expired, the data is deleted or anonymized by the data controller.
2. Withdrawal of consent: If a person withdraws consent to the processing of their personal data, the data controller deletes this data unless there is another legal basis for processing.
3. Expiration of legal obligations: In some cases, there may be exceptions that not only allow but even require the data controller to continue retaining personal data for a defined period, such as the storage of tax or accounting records. After these statutory deadlines have expired, the data controller also ensures that the data is anonymized or deleted.
2.6 Contact via Email
When you contact us via email, the data you provide will be stored by us in order to respond to your inquiries. We will delete this data once it is no longer necessary for processing or restrict the processing if legal retention periods apply.
Legal basis: Art. 6 para. 1 lit. f GDPR
2.7 Publication of the names of originators
We are required by law to disclose names of creators of image data (photos or videos) whenever we publish image data. We automatically delete this personal data as soon as we stop using the image data.
2.8 Legal basis
The below points are the legal basis of data processing:
• Initiation and fulfilment of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
• Legal obligations in accordance with Art. 6 para. 1 lit. c GDPR, (for example, legally prescribed storage and documentation obligations).
• Legitimate interests of our company within the meaning of Art. 6 para. 1 lit. f GDPR (for example usage of software).
• Art 6 para. 1 lit. a GDPR when obtaining consent (for example when processing image data or for advertising purposes).
3 Data processing of VIP Club members
If you decide to become a member of our VIP Club, we will process the data you enter in our form (online or print).
A membership in our VIP Club with many financial advantages requires the authorisation of the Outlet to send you offers, information, advertising, invitations to competitions as well as promotions of the partners of the designer outlet by email.
In order to complete your registration in the VIP Club, we require your first and last name as well as a valid email address or a further confirmation that you are indeed the supposed recipient of the mailings sent to you. For this purpose, we will send a confirmation email to the email address entered with a link contained therein (double opt-in); only after clicking on this link is the registration completed.
If you want to receive special birthday vouchers as a member of the VIP Club, we also need your date of birth. However, you can also become a member without mentioning your date of birth. For this purpose of processing, the legal basis utilized is our legitimate interest in providing the client with a personalized service.
We collect further data in this context insofar as you provide it, but this is not necessary for the receipt of the advertisements.
If you do not wish to receive any more mailings, you can terminate your membership at any time informally by sending an email to the contact details given in section one of this Privacy Policy. When you terminate your membership, we will immediately delete your personal data processed for this purpose.
When you become a member of our VIP Club, you enter into a contract with us in that you receive discounts and we process your data in return. The processing of your data is thus necessary for the performance of the contract to which you are party.
For managing our VIP Club members and sending emails (newsletters), we use the services of Placewise AS, located at Kobbes gate 2, 7042 Trondheim, Norway. Placewise provides us with the so-called Marketplace Performance Cloud (MPC) — a powerful platform that allows us to consolidate all shopper data into a single, unified layer. This enables us to carry out personalized marketing based on intelligent automation and tailor our offers even more precisely to your interests.
For more information, please refer to Placewise’s privacy policy at: www.placewise.com/privacy-policy-terms
Legal basis: Art. 6 para. 1 lit. a GDPR
4 Data processing of competition participants
If you take part in our competitions, we will process your data in order to carry out the competition, to determine and notify the winner and to send the prize offered. For this purpose, we need to process your name and your email address. Without this data, you cannot participate in the competition. As participants must be at least 18 years old in order to enter the competition, you also need to provide your date of birth.
You can also disclose your telephone number on a voluntary basis. If you do so, we will use this data to contact you by telephone if you have not responded to the email prize notification. However, this data is not necessary for entering the competition. We process this personal data based on our legitimate interest in providing the winner with the respective prize.
The data will be deleted after the winner has been determined and the competition has been completed.
When you enter our competition, you enter into a contract with us, in that you get the chance to win a prize, while we process your data in return. The processing of your data is thus necessary for the performance of the contract to which you are party.
Legal basis: Art. 6 para. 1 lit. b GDPR
5 Data processing via our website
5.1 Contact
If you have asked us to contact you via our web form or if you have sent us a message, we store the data that is required to contact you. This is your name and your email address. We additionally process data that you provide to us voluntarily. We delete the data as soon as storage is no longer necessary or you object to the processing.
You also have the option to register for the VIP Club through the contact form. Further details can be found in the section 'Data Processing of VIP Club Members'.
Legal basis: Art. 6 para. 1 lit. a GDPR
5.2 Purchase of gift vouchers
You can purchase gift vouchers for Designer Outlet Berlin and the stores located there via our website. For this, we require your first and last name, your address details for invoicing and postal delivery of the voucher, and your email address to send you the order confirmation along with our bank account details. We may also need your credit card number. Additionally, we require your telephone number so that we can respond to any queries more quickly. Without this data, we cannot execute the contract with you.
Legal basis: Art. 6 para. 1 lit. b GDPR
5.3 Applicants
If you send us your application documents, we process your personal data contained therein as well as your CV and references for the purpose of personnel selection and filling the position. The processing of your data is necessary to take steps at your request prior to entering into a contract with you. In the event of a rejection, we delete your documents 7 months after sending the rejection to you.
Legal basis: Art. 6 para. 1 lit. b GDPR
If you consent to be kept on file with us for the purpose of contacting you later, we will approach you with a separate request for the transmission of a consent. If you explicitly give us this consent, we will store your consent. If there is no further opportunity to fill a vacancy with us within one year, we will delete all your applicant data one year after you have sent us your consent.
Legal basis: Art. 6 para. 1 lit. a GDPR
6 Social Media
We operate the social media sites: Facebook, Instagram, TikTok and Pinterest. When visiting our social media pages, personal data, including the IP address, is processed by the respective provider and cookies are used for data collection. For detailed information on the specific data transmitted, please refer to the privacy policy of each service. There, you will also find contact information and various privacy settings.
We prioritize comprehensive customer satisfaction and primarily use these services to engage and communicate with you. Furthermore, we consider it an additional option to complement our existing range of information services.
In services with a US connection, the data collected is usually transmitted to a server in the USA and stored there. We have no control or ability to supervise the nature or extent of the data processed by these services, the way it is processed and used or the disclosure of this data to third parties. To limit the processing of this data within the settings of these services, please refer to the detailed descriptions provided in the privacy policies of the respective providers.
Furthermore, we point out that you use the respective services and their features at your own responsibility. This applies particularly to the use of interactive functions such as sharing, commenting, or rating.
The providers of the social media services have provided us with corresponding agreements - in most cases these are agreements on joint responsibility for data processing. The use of social media is based on our legitimate, operational interest.
Legal basis: Art. 6 para. 1 lit. f GDP
7 Data processing when visiting our website
7.1 Informative use of the website
In the case of informative use of the website, we only collect the personal data that your browser transmits to our server (server log files). If you wish to view our website, the most data we collect is that which is technically necessary for us to display our website to you and to ensure its stability and security:
• IP address
• Date and time of the request
• Time zone difference to Coordinated Universal Time (UTC)
• Content of the request (specific page)
• Access status/HTTP status code
• Website from which the request came
• browser
• Operating system and its interface
• Language and version of the browser software.
This data is not merged with personal data sources. We reserve the right to check this data retrospectively if we become aware of concrete indications of unlawful use and to pass on the data to the law enforcement authorities if there has been a hack attack. The data will not be passed on to third parties beyond this.
Legal basis: Art. 6 para. 1 lit. f GDPR
7.2 Cookies
Cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive in relation to the browser you are using and which provide the party setting the cookie (in this case us) with certain information. Cookies cannot execute programs or transmit viruses to your computer.
The cookie enables you to be recognised when you visit the website without having to re-enter data that you have already entered previously.
The information contained in the cookies is used, for example, to determine whether you are logged in or which data you have already entered, or to recognise you as a user when a connection is established between our web server and your browser.
We distinguish between technical cookies, which are used exclusively to ensure the operation of a website, and other cookies, which are set for the purpose of statistical analysis, tracking or advertising/marketing by us or third-party providers.
Legal basis: Art. 6 para. 1 lit. f GDPR (in the case of technical cookies), Art. 6 para. 1 lit. a GDPR (for all other cookies)
7.3 Data transfer to a third country
It cannot be ruled out that personal data may be transferred to an insecure third country (countries outside the EEA without an adequate level of data protection) when you visit our website. If this is the case, we will point this out directly in the description of the external service in this privacy policy.
The GDPR requires so-called suitable guarantees in accordance with Art. 46 GDPR for a data transfer to an insecure third country or to an international organisation.
In the case of data processing of personal data in a third country or in the case of data processing by US data recipients who have not submitted to the regulations of the EU-US Data Privacy Framework , , the following risks in particular cannot currently be ruled out for you as a data subject:
• Your personal data could possibly be passed on to other third parties by the respective service provider beyond the actual purpose of order fulfilment.
• You may not be able to assert or enforce your rights to information against the respective service provider in the long term.
• There may be a higher probability that incorrect data processing may occur because the technical organisational measures for the protection of personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.
By giving your consent via the consent banner to the use of external services and to the setting of the corresponding cookies, you expressly consent to the possible transfer of your personal data to insecure third countries.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
8 Data processing for Google services
We use the services of Google Ireland Limited ("Google"), a company incorporated and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, on our website.
Further information can be found in Google's privacy policy at policies.google.com/privacy;
8.1 Google Analytics
We use Google Analytics on our website, a tool that allows us to analyse how our website is used. Google Analytics allows us to see how many people visit our website and how long they stay.
This website uses the function "Activation of IP anonymisation" (i.e. Google Analytics has been extended by the code "gat._anonymizeIp();" to ensure anonymised collection of IP addresses (so-called IP masking)). As a result, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.
Google uses the information collected to analyse your use of the website, to compile reports on website activity and to offer other services relating to website use.
Your IP address, which is transmitted from your browser to Google Analytics, is not merged with other Google data. However, Google may pass this information on to third parties if this is required by law or if third parties process this data on behalf of Google.
You can prevent cookies from being stored on your computer by making the appropriate settings in your browser. Please note, however, that in this case you may not be able to use all the functions of our website to their full extent.
Further information on terms of use and data protection can be found at www.google.com/analytics/terms/de.html or at support.google.com/analytics/answer/6004245.
Legal basis: Art. 6 para. 1 lit. a GDPR
8.2 Google Doubleclick
The website uses the online marketing tool DoubleClick. The Google advertising network and certain Google services can be used to support AdWords customers and publishers in placing and managing adverts on the web. DoubleClick uses cookies to serve ads that are relevant to users, to improve campaign performance reports or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to record which adverts are displayed in which browser and can thus prevent them from being displayed more than once. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick advert and later visits the advertiser's website with the same browser and makes a purchase there. According to Google, DoubleClick cookies do not contain any personal information. Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advert from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out your IP address and store it.
Legal basis: Art. 6 para. 1 lit. a GDPR
8.3 Google Fonts
We use Google Fonts on our website. To ensure a uniform and appealing display of fonts and icons, your browser loads the required fonts into your browser cache. To do this, it is necessary for the browser you are using to contact the Google Fonts servers, which means that Google Fonts becomes aware that our website has been accessed via your IP address.
You can find out what data is collected by Google and what this data is used for at www.google.com/intl/de/policies/privacy/.
Legal basis: Art. 6 para. 1 lit. a GDPR
8.4 Google Maps
We use the Google Maps service on this website. This enables us to show you interactive maps directly on the website and allows you to use the map function conveniently. When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data already mentioned under "Informational use of the website" is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or customising its website. Such an analysis is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.
Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: www.google.de/intl/de/policies/privacy.
Legal basis: Art. 6 para. 1 lit. a GDPR
8.5 Google Tag Manager
We use Google Tag Manager on our website, which enables us to integrate and manage website tags such as tracking codes or conversion pixels. This collects data on the website and forwards it to associated analysis tools, which store and analyse this data. Although the Google Tag Manager collects data (e.g. IP address), it does not store it and has no access to it. It merely acts as an interface between the website and the analytics software.
You can find more detailed information here: www.google.com/intl/de/tagmanager/faq.html.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
8.6 Google reCAPTCHA
We use the Google service reCAPTCHA to determine whether a human or a computer is making a specific entry in our contact or newsletter form. Google uses the following data to check whether you are a human or a computer IP address of the end device used, the website you visit with us and on which the captcha is integrated, the date and duration of the visit, the identification data of the browser and operating system type used, Google account if you are logged in to Google, mouse movements on the reCAPTCHA areas and tasks where you have to identify images.
You can find more detailed information here: cloud.google.com/security/products/recaptcha
Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
9 Data processing when using Amazon CloudFront CDN (AWS)
Amazon CloudFront is a content delivery network (CDN) operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg.
With the CDN service, website content such as web videos or other large media can be provided quickly and securely. Proxy servers store the files locally and thus improve the access speed when downloading . Using the Amazon CloudFront CDN helps us to optimise the loading speed of our website.
The CDN service processes the IP address of the website visitor. The IP address is automatically deleted from the CloudFront logs.
Further information can be found in the Amazon Web Services privacy policy at aws.amazon.com/privacy/;
Legal basis: Art. 6 para. 1 lit. f GDPR
10 Data processing when using Meta-Pixel
Our website uses Meta-Pixel ("pixels") from the social network Facebook, provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the analysis, optimisation and economic operation of our online offering.
Meta can use the pixels to determine the website visitors as the target group for the display of adverts (so-called meta ads). Accordingly, we use them to display the ads placed by us on Meta platforms (Facebook and Instagram) only to those Meta users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain artists or events determined on the basis of the websites visited) that we transmit to Meta (so-called "custom audiences"). The aim is to ensure that our ads correspond to the user's interests and are not annoying. With the help of pixels, we can also track the effectiveness of Meta adverts for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta advert (so-called "conversion").
Your actions are stored in one or more cookies. These cookies enable Meta to match your user data (such as IP address, user ID) with the data in your Meta account. The data collected is anonymous and cannot be viewed by us and can only be used in the context of adverts. If you wish to prevent the link to your Meta account, you have the option of logging out before taking any action.
For more information, please refer to the Facebook/Meta data policy at de-de.facebook.com/policy.php.
For specific information on Meta-Pixel, please refer to en-gb.facebook.com/business/help/742478679120153;
Legal basis: Art. 6 para. 1 lit. a GDPR
11 Data processing when using Usercentrics (Cookiebot)
In order to obtain data protection-compliant consent for the use of cookies and services requiring consent on our website, we use the Consent Banner Cookiebot from Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.
The consent banner records and stores the selection of cookies and services requiring consent of the respective user of our website. The use of the consent banner ensures that statistical, functional and marketing cookies and services requiring consent are only set or loaded if the website visitor gives his or her express consent.
The consent tool records, logs and stores the website visitor's settings for the duration of the session. Cookiebot collects, transmits and stores certain user information (including the IP address) so that the selected settings can be clearly assigned to the respective website visitor.
For more information, please refer to the privacy policy of Usercentrics and usercentrics.com/us/privacy-policy/.
Legal basis: Art. 6 para. 1 lit. f GDPR
12 Data processing when using web fonts by Hoefler&Co.
Our website uses external fonts from Hoefler & Co, 611 Broadway, Room 725, New York, NY 10012-2608, USA.
This service provides the "Cloud.Typography" fonts that are displayed on users' devices. During each session, your browser establishes a direct connection with the company's servers in the USA, which allows your IP address to be determined.
By using this service, a transfer of personal data to the USA takes place or cannot be excluded! 7.3- For more information, please refer to of this declaration.
Further information can be found in Typography's privacy policy:
www.typography.com/policies/privacy
Legal basis: Art. 6 para. 1 lit. a GDPR
13 Your rights
You have the following rights with regard to your personal data:
• Right to information, rectification and erasure
• Right to restriction of processing
• Right to object to the processing
• Right to data portability
info@designeroutletberlin.comPlease send your enquiries and requests by e-mail to or contact us using the contact details provided.
If you believe that we have violated German or European data protection law when processing your data and thus infringed your rights, please contact us so that we can clarify any issues.
You also have the right to lodge a complaint with the competent supervisory authority, which is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin
Phone: +49 30 13889-0
Fax: +49 30 215 50 50
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de/
14 Changes to this privacy policy
We reserve the right to make changes to our privacy policy from time to time. We will publish all changes to the privacy policy on this page. Please refer to the latest version of our privacy policy in this regard.
