I. The responsible for the processing of personal data
We, BSH Home Appliances Limited, Grand Union House, Old Wolverton Road, Wolverton, Milton Keynes, MK12 5PT , are the provider of the services described herein (hereinafter “We” or “Provider”) including the respective processing of personal data. This Data Protection Information provides to you, the user of the services (hereinafter “You”), information about the relevant processing of personal data for all touchpoints where you interact with us. Some of the services provided, e.g., repair via a service technician, may be provided by a different entity. In such situations, the data processing related to these services will be handled by the respective entity responsible for providing the service, and we will inform you accordingly.
II. Our Data Protection Principles
In the context of provision of the services described herein and the operation of websites and other touchpoints, we process your personal data in different ways. We are informing you about each processing of personal data as well as the respective legal basis and principles under which this processing takes place.
We are committed to protecting your personal data. Therefore, we process your data with great care and in strict compliance with applicable data protection laws and the individual permissions you may have given to us. We have taken organisational and technical security measures to protect all our websites, apps and other (digital) touchpoints against the potential risks present in processing personal data. Our group companies and partners who support us in the provision of the services must also comply with these rules and principles.
Please use the contact information provided in this Data Protection Information to contact us either generally or with specific data protection questions and/or enquiries.
There are different laws that regulate Data Protection depending on the country in which you are located. Based on the principles of the European General Data Protection Regulation, i.e. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (“GDPR”), we defined the following basic principles as our guidelines on how we process and protect your personal data when providing our websites and services:
1. Lawfulness
We only use personal data if such use is lawful, which is the case only if and to the extent that at least one of the following applies:
• You have given your consent.
• The use of personal data is necessary for the performance of a contract to which you are party.
• The use of personal data is necessary for compliance with a legal obligation, e.g., in cases of product safety actions, where we are obliged to inform all our customers.
• The use of personal data is necessary to protect the vital interests of the person, e.g., in cases where we inform individual customers about product safety issues.
• The use of personal data is based on a legitimate interest in using personal data and our usage does not adversely affect your data protection rights.
For all processing of personal data, we describe herein, we will also provide the legal reason the processing is based on at the end of each major section as well as in the description of specific third-party providers of services we use in Section XII of this data protection information.
2. Fairness and Transparency
We will inform you about the personal data we collect and why we collect it in a fair and transparent manner in this Data Protection Information. You can access the Data Protection Information directly or via a link when you register and/or at any touchpoint where you interact with us.
Users below the age of 16 should only transmit personal data to us with the consent of their parent or legal guardian. The data protection law that applies in your country may result in different age limits in this regard.
3. Purpose limitation and data minimization
We only collect and use personal data that we really need and for the purpose that you provided the personal data to us. If we can achieve the purpose with less personal data, we will only use the minimum data required. Nevertheless, at any time, you are free to provide additional personal data, if this would enhance your experience with the services provided.
4. Types of processing including third parties
In cases in which we do not process your personal data directly as data controller (e.g. website hosting, technical services etc.) we contract with third parties who deliver these services on our behalf as data processors. These contracts bind them for the processing of your personal data to secure the lawfulness and security of the processing. This is named a Controller to Processor relationship and is defined in Artt. 28/29 GDPR, where we are the Controller and the respective third party is the Processor. You will find a list of the data processors we engage at the end of this Data Protection Information
Joint Controllership describes the situation, when multiple parties, we are being one of them, work together to decide how data will be used and managed (Joint Controllers, see Art. 26 GDPR). Joint Controllers need to inform clearly about who is processing which personal data and what obligations each party has taken over regarding the applicable data protection rules. As Joint Controllers agree on their roles and make sure the data subjects (people the data is about) are informed about these roles, we will inform you about these roles and your individual rights for each of the Joint Controllership situations described herein. When we use a third-party service or partner, who is processing personal data as a Joint Controller, we will inform you about the rights and roles accordingly in the third-party providers listing in Section XII at the very end of this document.
Sometimes there is a need to transfer personal data to a third party acting as independent controller who acts in their own name and own account, e.g., using a shipping company to send home appliances to you. In these instances, we agreed with those independent controllers’ minimum data protection standards to protect your personal data.
Our website may also contain links to third party websites, the content of which is not provided or controlled by us. In these cases, we have no control over the processing of your data on these websites or their compliance with data protection regulations, but we will inform you when leaving e.g. our website. Please refer to any privacy information these third parties may provide.
5. Trans-border processing EU and non-EU
As some of the third parties providing services for us (as described in this document) are not located in your country, the processing of your personal data may also include a trans-border transfer of your personal data. Our aim is only to process personal data within the European Union, so most of the third-party services providers process personal data in European data centres.
If this is technically not possible or if there is another reason, why a processing of personal data may also take place out of the European Union, we follow the principles set out in Art. 44 et seq. GDPR and secure such transfers via contracts (based on specific legal transfer mechanisms), we conclude with such providers or based on an adequacy decision of the Commission of the European Union including the EU-US Data Privacy Framework “DPF”). The information if a provider is participating in the DPF and actively fulfilling the prerequisites, you will also find searchable under:
https://www.dataprivacyframework.gov/s/participant-search
6. Security
We will process your data in a manner, which ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Where we use third parties to process personal data, we commit these third parties to an appropriate level of technical or organisational measures to be followed.
7. User Rights
You have the following rights against us which we comply with in a timely and adequate manner upon receipt of your respective request as outlined below:
• Your right to request access to your personal data according to Art 15 GDPR: We will inform you whether we hold personal data on you and if so, provide you access to and information about such data.
• Your right to request rectification of your data according to Art. 16 GDPR: We will correct inaccurate information or complete incomplete personal data, provided this data is necessary for the intended purpose of processing your data.
• Your right to request deletion of your data according to Art. 17 GDPR: We will delete the personal data we hold about you. Unless such data are subject to retention periods or retention rights, for example because we need to retain your data to fulfil our contractual obligations or as required by law.
• Your right to request restricting processing of your data according to Art 18 GDPR: In cases as outlined in Art. 18 (1) GDPR you may request us to block your data. We will process blocked data only further to a very limited extent and if necessary to provide such services or obligations, which performance is necessary after the blocking of your data requested by you.
• Your right to withdraw consent according to Art. 7 (3) GDPR: For those data processing’s requiring your consent, you can withdraw your consent at any time to prevent future processing of your data. Data Processing’s based on your consent prior to your withdrawal remain valid and lawful.
• Your right to object to the processing of your data according to Art. 21 GDPR: You can object to future processing of your data, if we are processing your data based on one of the legal justifications set out in article 6 (1e or 1f) GDPR. If you object, we will cease processing your data, unless we have compelling legitimate grounds for further processing which override your interests and rights or for the establishment, exercise or defence of legal claims. The processing of your data for the purposes of direct marketing never constitutes compelling and legitimate grounds for us.
• Your right to data portability according to Art. 20 GDPR: Where data processing is carried out by automated means and based on consent or contract, we can provide you your data you provided to us in a structured, commonly used and machine-readable format.
• Your right to appeal to a regulatory authority: You can lodge an appeal pertaining to data protection with a Data Protection Authority. To do so, contact the relevant Data Protection Authority that is responsible for your place of residence or the data protection authority under whose jurisdiction we fall (named below in the List of the Data Protection Authorities).
If you wish to execute your rights, please use the following contact channels:
• Consumers: Please use the Consumer Data Request web form for your country on
https://datarequest.bsh-group.com/
• Dealer/supplier/service providers and its employees: Please contact our local sales or procurement department.
• Our employees: Please contact the local HR department.
8. Deletion principles
We process your personal data only for defined necessary purposes. Once the purpose(s) of the processing activity elapsed, we will delete your personal data, unless there is a retention requirement or right to retain it for a longer period. This applies to all personal data regardless of how and where it is stored.
There are various local laws, such as tax or commercial laws, which outline the legal requirements for data retention. Additionally, we may retain personal data based on legitimate interests, such as complying with product safety laws to protect consumers/customers. We may also retain personal data for business purposes, if the GDPR acknowledges these purposes as justifications for retention, such as keeping customer records to defend against legal claims.
Access to personal data that is held solely for the purpose of fulfilling legal retention periods or rights, after the original purpose for collecting the data no longer applies, will be restricted. This ensures that the personal data is no longer actively used in our business operations.
9. Data Protection Officer
If you have any questions regarding data protection or if you would like to exercise your rights, our Data Protection Officer (DPO) is here to assist you. You can easily get in touch with our DPO directly by sending a letter or an email using the contact information provided below. They will be happy to address any concerns you may have and guide you through the process of exercising your rights under data protection laws. As far as you are resident in an EU-Member-State (except the United Kingdom), please contact:
BSH Hausgeräte GmbH, Data Protection Officer, Carl-Wery-Str. 34, 81739 Munich, Germany, Data-Protection-GB@bshg.com
If you are resident in the United Kingdom:
BSH Home Appliances Limited, Data Protection Officer, Grand Union House, Old Wolverton Road, Wolverton, Milton Keynes, MK12 5PT, Data-Protection-GB@bshg.com
The representative in the United Kingdom (Art 27 UK GDPR):
BSH Home Appliances Limited, UK GDPR Representative for Home Connect GmbH, Grand Union House, Old Wolverton Road, Wolverton, Milton Keynes, MK12 5PT
The representative in Switzerland:
BSH Hausgeräte AG, Representative for Home Connect GmbH, BSH Hausgeräte AG, Fahrweidstrasse 80, CH-8954 Geroldswil
10. Changes to this Data Protection Information
This Data Protection Information reflects the current state of data processing on our website/and other touchpoints (e.g. brick and mortar store, call centre, social media accounts etc.). In the event of changes to data processing, this Data Protection Information will be updated accordingly. We always provide the latest version of this Data Protection Information on our website so that you can be informed about the scope of data processing via this website.
III. Our Internet-Touchpoints
1. Websites
a) Provision of the Website(s) itself
To display the website on your internet browser, we use various technical devices to ensure that all content (text, images, video, etc.) is up to date and displayed correctly in your browser. To ensure that your user experience, particularly the loading speed of the website, is efficient, we also use technical service providers who enable us to provide the content required for the presentation of the website ("Content Delivery Networks" or CDN). These CDN service providers act on our behalf and are bound to our instructions by corresponding agreements. We use the data collected in this way to display the contents of the website in your internet browser and they are deleted immediately after intermediate storage after delivery. We also use technology to technically safeguard our webservices including web-application-firewalls, specific security software and similar technologies.
b) Website(s) search functionality
We use a trusted third-party service that enables us to enhance your browsing experience by offering powerful search and discovery features. This functionality allows you to quickly find relevant information and products on our website. To provide this search functionality, we may collect and process certain data, including but not limited to:
Search Queries: When you use the search function, search terms you enter will be a) stored in your local storage for your personal use only b) statistically collected and processed, to improve the accuracy and relevance of the search results.
Web Local Storage: The search utilizes web local storage to store temporary data related to your search queries. This helps to enhance the performance and speed of the search functionality.
Improvement: We may also collect anonymous usage data to analyse and improve the search functionality over time. This data does not personally identify you and is used solely for statistical purposes.
Please note that the provider of the search functionality, is bound by strict confidentiality and data protection obligations. They are prohibited from using your personal data for any other purpose than providing the search service to you.
c) Categories of data
For technical reasons, each time your internet browser accesses our website it automatically sends information to our web server (i.e. log data). We store some of this information in log files, such as:
• Date and time of the access,
• URL and files of the website accessed, including volume of data transferred,
• Version of the HTTP protocol used (including the type of the operating system),
• Type and version of the internet browser,
• IP address (anonymised), and
• Search terms.
The log data does not contain personal data. We only analyse log data when required, for example to remedy faults in the operation of our website or to manage security incidents.
In addition, it may be necessary for us to collect the full IP address of the device as well as log data to remedy faults or preserve evidence relating to security incidents.
We delete this data on remediation of the fault, full clarification of the security incident or if the original purpose of the processing is no longer required. In the event of a security incident, we will transmit log data to the investigating authorities on a case-by-case basis, to the extent permitted and necessary.
2. Marketplaces, Apps and other touchpoints representing us on the Internet
We may also provide information, goods and/or services via Marketplaces (internet-platforms run by third parties where a particular product or service can be bought) and other touchpoints in the internet as e.g. specific websites, allowing the purchase of one specific product. For such touchpoints the information contained herein is also applicable, but additional, specific information on data protection and the processing of personal data will be given directly on such touchpoints, as e.g. such Marketplaces may use an account as prerequisite for their usage and will process your data accordingly.
If you use Apps provided by us, e.g. Home Connect, you will find the appropriate data protection information directly in the respective App. There the specific processing of personal data will be described as well as additional information will be given for such processing’s.
3. Our Social Media Pages
a) General
The protection of your privacy when processing personal data is important to us. We process personal data transmitted to us, which is collected during your visit to our respective social media page (e.g. Facebook Fanpage, Instagram/Pinterest Page and Accounts), confidentially and only in accordance with the statutory provisions. As processing is partly also executed by the respective social media pages, please also observe their privacy information.
b) Categories of data
The social media service processes your personal data as soon as you use our respective social media site. Processing is linked, for example, to the following usage processes:
• View a page or post or video from a page,
• Subscribe or unsubscribe to a page,
• Mark a page or post with "I like" or "I don't like anymore" or similar functions,
• Recommend a page in a post or comment,
• Comment on, share or respond to a page post (including the type of response),
• Hide a page contribution or report as spam,
• From another site, click on the social media provider or from a Web page outside the social media provider on a link that leads to the page,
• Move the mouse over the name or profile picture of a page to see a preview of the page contents,
• Use functions of the social media provider, such as the website, phone number, "plan route" button or any other button on a page,
• The information whether the login is made via a computer or a mobile device.
c) Recipients / Categories of recipients
Responsible for the processing of your data via our social media site is the respective operator of the social media site (see examples below) together with us. As far as the processing of these data takes place within our area of responsibility, we are available to you in all questions concerning data protection and the exercise of your rights in accordance with the information in this data protection information. You can find out which personal data is collected by the social media provider, how it is processed and which data protection rights you have vis-à-vis the social media provider in the following data protection guidelines of the social media provider. We have no influence on the data processing by the social media provider.
d) Data processing by us
On the website provided by us via the social media provider, the social media provider grants us access to the following data categories:
• The social media provider grants us access to statistical analyses that provide information about the use of our social media website. The analyses visible to us do not allow us to individually analyse the usage behaviour of individuals. We can only view aggregated data (such as number of hits, likes, followers, region of origin, age group, gender, etc.) that tells us about our audience and the use of our social media site. The data of the respective user on which the analyses are based are not transmitted to us.
• We can set the target group to be reached for the social media website or for individual published articles. The setting is based on general parameters (e.g. age group, language, region, interests) that can be used to align our content with specific groups. It is not possible for us to address or identify individual persons on the basis of the data provided to us by the social media provider.
• If you contact us directly via the social media provider or interact with us in any other way and consciously transmit personal data (e.g. direct networking with our social media website), we store and process this personal data for the purposes for which you transmitted it to us.
• We process this data exclusively for the purpose of making content on our social media website known to the target group and to better understand and optimise the use of our social media website.
In addition, we cannot influence the data processing (for the provision of this data upstream) by the social media provider in their area of responsibility.
Please refer to the relevant third-party service provider to find out which personal data is collected by them in detail, how these are processed and which data protection rights you have vis-à-vis the respective social media provider by using the list of third-party service providers at the end of this document:
4. Social Media Plugins as Hyperlinks
Some content from our website can be shared on social networks as e.g. Instagram, Facebook-Fanpage and YouTube using integrated social media buttons. All social media buttons that facilitate the sharing of content are integrated using simple hyperlinks rather than social plugins developed by social network providers. This ensures that your details are not automatically transmitted to social network servers as soon as you access our website. In addition, when you share content from our website, we only transmit the information to the social network that is required to share the relevant content (e.g., the link to the content you want to share). We do not transfer personal data in this context.
At the same time, simple links to our websites on social networks can be found as well. If you follow a link from our website to a social network, or if you log in to your social network in order to share content from our website, your data is processed by the provider of the social network in question.
If you are registered and signed in other networks or services that require registration while using our website or individual functions (e.g., Vimeo, YouTube), the respective network/service may collect information about your use or adopt settings, such as videos played/playing status. However, this data is collected solely by the respective network/service in its own data protection responsibility and processed by the respective provider.
For information about the purpose and scope of data collection, further processing and use by the respective network provider, as well as your associated rights and settings options for protecting your privacy, please refer to the Data Protection Information made available at the website of the respective provider.
4. User-Generated Content (UGC) from Social Media
UGC from social media allows us to share content created by customers and published on social media or other channels, such as text, images, videos, and reviews, with our social networks. We will obtain rights to your content through a separate licence agreement. When using such UGC, various types of personal data can be connected with the UGC. This data may include:
• Profile information: this may include the username, profile picture, and any other details you directly have provided on your social media profile.
• Posts and comments: content that you have posted or commented on, including text, photos, videos, and links, may be processed.
• Location data: if you have enabled location services on your social media account, the location information may be processed when you post or engage with content.
• Friends/followers data: user's connections or followers on social media may be processed if it is relevant to the user-generated content being utilized.
Please note that the specific personal data processed can vary depending on the social media platform and the privacy settings chosen by you.
5. Legal Basis for data handling
We base the above data processing operations in GDPR regions on a legal permit in accordance with Art. 6 para. 1 lit. f) GDPR except for UGC which is based on a legal permit in accordance with Art. 6 para. 1 lit. b) GDPR.
IV. Communication
1. Contacting Us
If you contact us outside of a specific contractual relationship (e.g. for the provision of information) or a registration, we provide various, also purely technical contact possibilities via our websites, including the possibility to contact us e.g. via (automated) chat.
In order to be able to process your specific request when making such contact, we may ask you to provide personal data. This includes, for example, your name and email address and other information such as the subject of your request and your message. Optional postal address and/or telephone number can be given. We collect the information requested in order to be able to deal with your request in an appropriate way.
The personal data transmitted to us in this way are used exclusively for the purpose for which you provide them to us when contacting us - in particular the processing of your request. The data will not be used for other purposes or passed on to third parties without your express consent. Excluded from this are - insofar as it is necessary to fulfil your request - the persons and companies (e.g. local service company) involved in carrying out the communication and answering the request. We may also use service providers for the automated routing of your request to our service agents. The content of your message can be analysed by an automated process using artificial intelligence (AI) and automatically routed to the service agent that will help you best.
If there are no legal storage obligations, your personal data will be deleted after the request has been processed.
2. Call-centre
One of our contact options is the call centre. Depending on your request, we store your personal data, such as your contact details, in order to process your case, such as e.g.:
• Call recording: after a given consent, we can record calls for quality assurance or training purposes. This involves processing the audio data, which may contain personal information shared during the call.
• Call logging: we usually log information about each call, such as the caller's name, contact details, reason for calling, and any relevant details discussed during the call. This helps in handling your customer interactions and providing efficient service.
• Call routing and transfers: Personal data may be processed to route calls to the appropriate agent or department based on the nature of the inquiry or the customer's preferences. This may include the use of artificial intelligence (AI) for the automated routing of your call.
• Identity verification: Call centre agents may need to process personal data to verify the identity of callers before providing them with account-specific information or making changes to their accounts.
• Issue resolution and support: Call centre agents may access customer records or databases to help, resolve issues, or answer inquiries. This involves processing personal data to address customer needs.
For call-centre services, we use service providers which are third parties and/or service providers within our group of companies.
3. Chat-Bot Function
Chat function (if available on the web shop or if we have a social media account in your country) allows us to answer your questions about our products and services simultaneously. If you ask a question in the chat, an application will try to answer your questions. By using artificial intelligence (AI), the system may send you relevant links or escalate your concern to a customer service representative in live chat. We use chat-bot to process your request and to improve our business and services. We receive services from a technical service provider to enable chat-bot function on our websites and via other touchpoints.
As part of chat functionality, the following personal data may be processed:
• Mandatory information to initiate a chat (may differ from country to country)
• Chat history as a transcript ("transcript")
• IP address, approximate location, browser type and version, device type, visitor path
• Usage data (e.g. times of chat start, chat end, chat duration, chat performance data)
• Other content processed within the chat (e.g. telephone number, email address)
4. Surveys
We conduct surveys on your satisfaction with our products and services. We may ask you for feedback e.g., via a form on our websites, or send you an email. If we ask you to rate our products and services via email, you usually may rate them on a scale up to ten points. Further, you may leave comments in a free text field or – as the case may be – leave your phone number to receive call backs concerning your rating and comments. Taking part in these surveys is completely voluntary. We store the data you provide to us in such survey together with your contact details and transactional data related to the product or service we provided to you. We use this data to improve our products and services. Your personal data will be anonymized after 12 months.
If we conduct surveys on our website, in general, these surveys are carried out anonymously. If we as an exception do collect your data during a survey, the paragraph above applies.
5. Newsletter
Our website provides the option of subscribing to our newsletter. We use a double opt-in process to verify whether the owner of an email address has registered to receive the newsletter. The newsletter is only successfully subscribed to if the owner of the email address has expressly confirmed the activation of the newsletter by clicking on the link in the confirmation email. We log the completion of the individual stages of the double opt-in process for evidence purposes.
As part of our newsletter campaigns and based on (eventually additional) consent you had given, when opting in for a newsletter, we use analytics tools to tailor our newsletter to your needs, for advertising purposes and for market research. You will find additional information about analytics and marketing in Section V and XII below.
For this purpose, we collect and process data about your use of our email newsletter. When you open an email newsletter from us, a file contained in the email (so-called web beacon) connects to our servers. This enables us to determine whether an email newsletter has been opened and, if so, which content has been clicked. In addition, we collect technical information about your end device with which the contents of the email newsletter are retrieved (e.g. time of retrieval, browser type and operating system). We use this data exclusively for statistical analysis of our newsletter campaigns. If you subscribe to receive our newsletter, and therefore consent to it being sent to you, your details are used to send you the newsletter and analyse your use of the email newsletter. You can withdraw this consent at any time. The relevant link is included in each copy of our newsletter. We will make a note of the fact that you have unsubscribed from the newsletter in our database.
6. Contacting via Chat applications
If you prefer to contact us via chat application, data is processed by the relevant entity named in the list of the third-party providers. Such chat applications chosen by us, will enable a secure and data protection friendly way to contact us via such an application.
If you install and use a third-party app on your mobile device, you agree to the terms and conditions of the specific app, over which we do not have any influence. Such app may, among other things, ask for access to your phone number and the contacts stored on your mobile device. Likewise, such data is stored on the third-party providers’ servers, which may not be subject to European data protection law.
7. Legal Basis for data handling
Depending on the type of contact you make with us, we base the above data processing operations in GDPR regions on a legal permit in accordance with
• Article 6 para. 1 lit. a) GDPR based on your consent for e.g. call centre recordings, and newsletters and surveys without connection to a contractual relationship as well as surveys, where you actively opted in for participation.
• Art. 6 para. 1 lit. b) GDPR for (pre-)contractual communication e.g. using our call center or chat bots or other chat applications, order of a service technician, questions about deliver or returning products.
• Art. 6 para. 1 lit. f) GDPR in case of contacting us e.g. for the performance of customer satisfaction surveys.
V. Analytics, Marketing and Tracking
To make your visit to our websites as smooth and relevant as possible, we use standard digital technologies, e.g. cookies. This section explains what these technologies are, why we use them, and how you can control them.
Our goal is to create a better online experience for you. We do this in two main ways:
• Improving Our Website (Analytics): We collect anonymous information about how visitors use our site. This helps us understand what’s working well and what we can improve, ensuring the website is easy to use and helpful.
• Showing You Relevant Content (Marketing & Tracking): With your permission, we use technologies to remember your interests. This allows us to show you personalized content and advertisements that are more likely to be useful to you, both on our websites and on other platforms.
For any of these activities that go beyond the basic functioning of the website, we will ask for your explicit consent via our cookie banner. The following text provides a full breakdown of the technologies we use and your options for managing them.
1. Cookies and similar Technologies
When you visit our website cookies or a so-called pixel-code/web beacon as well as similar technologies, as e.g. local storage or server-side technologies can be used by us. These technologies will allow us to interact with your browsing device as follows:
• Cookies are small text files that are stored in a special memory area of your browser which enable us to identify you when you revisit our website. Such information could also be stored in the local storage of your browser and behave as we would use a cookie.
• Web beacons are tiny graphic files that contain a unique identifier that allows us to recognize user activity such as how often you have visited our website.
• We may also use direct server-side solutions and similar technologies to measure the usage of our websites as well as the reach of our advertisements.
• Cookies and similar technology may be used for a variety of reasons such as making the website work or show you personalized content and advertisement.
We use the following types of cookies and technologies on our website:
• Functional Cookies and Technologies: necessary to make the website available, secure, and work properly.
• Analytics Cookies/Similar Technologies: here we collect information about how you interact with the website, such as which pages you visit, how long you spend on each page, and any errors you may encounter. This data is then used to analyse and improve the website's performance and user experience.
• Marketing Cookies/Similar Technologies: with this, we can track your browsing behaviour and interactions with the website. Later, when you visit other websites or social media platforms, you may see targeted advertisements related to the product you viewed earlier. This is because marketing technologies enable advertisers to deliver personalized ads based on your interests and preferences.
• Third Party Cookies/Similar Technologies: these technologies are used to e.g., when reading an article on a news website that has embedded content from a social media platform, such as a Twitter feed or a Facebook post. In this case, the news website and the social media platform may both use cookies to track your activity. These are third-party cookies because they are set by a different website or service than the one you initially visited. Third-party cookies can be used for various purposes, such as targeted advertising, social media integration, or measuring website analytics.
For more information on specific cookies and similar technology we use on a specific website please see the cookie banner/notice; the banner can be reached at any time during your website visit in clicking on the banner-icon on the bottom of the respective website. Functional Cookies will be used by us even you decline other types of cookies, as these are necessary for the use of the websites or steering the cookie options you choose.
All other Cookies as well as similar technologies will only be used, if you accept the relevant category of cookie within the cookie banner/notice. Once you have chosen which cookies you accept/decline, you can always revisit the privacy settings in the cookie banner/notice by clicking on the check mark located on the bottom left-hand side of our website and accommodate the changes. You also can delete the cookies set manually via the respective setting in your browser.
You can find a comprehensive list of the marketing and analytics tools we utilize in Section XII, located at the end of this document. This section not only provides the names of the tools but also describes the type of data processing conducted by each respective tool or provider.
2. Analytics
Analytics refers to the process of collecting, processing, and analysing data to gain insights and make decisions. For us, it's like examining patterns and trends to better understand how our products and services are used by you. This insight allows us to make our products and services more user-friendly. It also enables us to identify areas for improvement and innovation in our products and services. Our websites integrate with analytics platforms (e.g., Adobe Analytics). These platforms provide JavaScript code that is added to the website. This code interacts with cookies or similar technologies to collect data when users interact with our website. As users navigate the website, the analytics code collects data from the cookies/pixels. This data we collect includes information on page views, clicks, time spent on pages, and other relevant metrics.
Analytics platforms aggregate the collected data, providing us with insights into user behaviour and website performance. This aggregated data is used for understanding audience demographics, popular content, and areas that may need improvement.
3. Marketing (including Re-Marketing)
We may collect and use your personal data using tracking technologies to send you relevant marketing communications. These communications could include product updates, promotional offers, and newsletters. You can easily manage your communication preferences and opt out if desired.
We also carry out digital marketing activities including retargeting. Retargeting, also known as remarketing, means showing targeting ads to users who have previously interacted with Our website or digital content but did not complete a desired action, such as making a purchase.
When a user visits our website and takes specific actions (e.g., views a product, adds an item to the cart), a tracking pixel or cookie is placed on their device. This allows us to show targeted ads to these users as they browse other websites or social media platforms, encouraging them to return to our website.
Please see Section XII for more information on the providers including information about the specific usage and additional information on provider-specific data protection aspects.
4. Profiling (based on specific permission)
We may offer you the option to enable profiling, which allows us to personalize your experience and provide you with tailored content. We want to ensure transparency and give you control over how your personal data is used. Profiling involves the automated processing of your personal data to analyse and predict your characteristics, preferences, behaviour, or interests.
By enabling profiling, we can better understand your needs and deliver a more customized experience based on such information and to enhance your experience on our website. This includes personalizing recommendations, delivering targeted advertisements, and improving our services based on your preferences.
Our profiling activities are based on your consent, which you can freely give or withdraw at any time. We also rely on our legitimate interests in providing you with a tailored and relevant experience. You have the right to control your data and profiling preferences. You can choose to enable or disable profiling through your account settings or privacy preferences. Additionally, you can exercise your data protection rights, including the right to access, rectify, or delete your personal data at any time.
We may share your data with trusted third parties for profiling purposes. However, we only do so with your explicit consent or when necessary to provide our services. We ensure that appropriate safeguards are in place to protect your data when shared with these parties.
Please see the specific information given during opt-in for the profiling permission for more information on the providers including information about the specific usage and additional information on provider-specific data protection aspects.
5. Legal Basis for data handling
All the processing described above, in particular the setting of pixels and cookies to read information on your device you use to access the respective website, will only take place if you have given us your consent to do so. You can revoke your consent at any time with effect for the future by following the procedure described in "Cookie handling" above. Alternatively, you can use the deactivation page for EU consumers at: http://www.aboutads.info/choices or http://www.youronlinechoices.eu/.
We base the above data processing operations in GDPR regions on:
a) Your consent pursuant to Art. 6 para. 1 lit. a) GDPR:
• Cookies for recording usage behaviour,
• Web Analytics & Marketing via Cookies and/or similar technologies,
• Profiling.
b) a legal permit in accordance with Art. 6 para. 1 lit. b) GDPR:
• Registration on our website,
• Comfort registration (Social Sign-On Option).
c) a legal permit in accordance with Art. 6 para. 1 lit. f) GDPR:
• Technical cookies, which are necessary for the provision of the website,
• Interactive Digital Assistants,
• Technical providing for the presentation of the website (e.g. Content Delivery Networks, security functions),
• Additional website functions (e.g. product videos),
• log data,
• Session cookies and persistent cookies for convenience features.
VI. Events and Contests, Trade-fairs
1. Participation in events or show-room appointments
When you register for an event or a show-room appointment, we store and use the information you provide to run the event/organize and perform your showroom visit including follow-ups. The data we collect for this purpose depends on the registration form on the specific websites, where you register. Your information is deleted once it is no longer required to run the event or complete any follow-ups. Usually, such registration process will include a confirmation email of your participation, additional email(s) about the organisation/any changes and a follow-up email, which may also include the possibility to provide us feedback.
Some events require to pay the participation fee directly or are completely or partially supervised and carried out by our partners. In such a case you may be redirected to the website of the respective partner. In this case, the relevant payment details (last name, first name, postal address, number of participants, and means of payment) are transmitted to our partner to carry out the event/payment process, provided you have already provided it.
2. Participation in raffles/contests
When you sign up for a raffle or contest, we store and utilize the information you provide for the sole purpose of organizing and managing the raffle or contest, as well as any necessary follow-ups. The specific data we collect depends on the registration form you fill out on the raffles or contests page.
Rest assured that once the raffle or contest has concluded and any required follow-ups have been completed, we promptly delete your information. We only retain your data for as long as it is necessary to fulfil the purpose of running the raffle or contest and any related activities.
3. Trade Fairs and similar Events
We participate in both on-site and digital trade fairs. In this context, data processing especially of your contact details occurs in case of:
• Your wish to receive further information from us subsequently by email or post,
• The initiation of a business relationship,
• Your participation in raffles,
• Your request for newsletters and advertisements,
• Answering questions related to our products,
• Your placement of an order.
Please find additional information in the section “Communication”, “Business Partners” and “Shopping and Customer Service” in this information, how in detail we may process your personal data depends on the type of context you provide your data.
4. Legal Basis for data handling
We base the above data processing operations in GDPR regions on a legal permit in accordance with Art. 6 para. 1 lit. b) GDPR.
VII. Shopping and Customer Service
We provide you touchpoints where you can purchase products or services directly via e.g. our websites, technicians and the call centre. Regarding the processing of personal data, the following interactions may take place when you are using these touchpoints.
1. Typical Interactions
• Browsing and product selection: Consumers browse through various products or services, comparing features, prices, and reviews before making a decision.
• Adding to cart and checkout: Consumers select items, add them to their cart, and proceed to the checkout process, providing necessary information such as shipping address, payment details, and contact information.
• Payment and order confirmation: Consumers complete the payment process and receive confirmation of their order, including an order number and estimated delivery date.
• Inquiries and support: Consumers may have questions or need assistance regarding products, orders, shipping, returns, or other issues. They can reach out to customer service through various channels like phone, email, chat, or social media.
• Issue resolution: Customer service representatives help resolve any problems or concerns raised by consumers, such as addressing product defects, order delays, or billing discrepancies.
• Returns and exchanges: Consumers may request returns or exchanges for products that do not meet their expectations or have arrived damaged. Customer service assists in initiating the return process and providing necessary instructions.
• Feedback and reviews: Consumers may provide feedback or leave reviews about their shopping experience or specific products. This helps other consumers make informed decisions and provides valuable insights to us.
2. Contract
In order to realize your orders and conclude a contract with you, we process the following personal data;
• Title,
• First and last name,
• Full postal address,
• Telephone number,
• Email address,
• Billing information (depending on the payment type allowed by us and chosen by the user).
3. Payment and Creditworthiness Checks
Your payment data will be transmitted to the respective payment service provider for realizing payment. If you make use of chargeable services (e.g. orders in the accessories shop), billing data (depending on the payment method provided by us and selected by you, for example credit card data, account data) will be processed. Your personal data may in addition be processed (also in an automated way or by using specific algorithms) for the investigation and prevention of fraud, abuse, security-related incidents and other harmful activities, e.g., for anti-money laundering and criminal prosecution. This is based on compliance with applicable laws (e.g., money laundering prevention) as well as our legitimate interest in limiting the risk of non-payment. If additional types of data are processed, specific third parties involved or specific types of automated processing (including the use of artificial intelligence) may be used in specific cases, you will find that information in direct connection to the respective payment method within your user journey on our website.
We involve external service providers with tasks connected with payment handling, programming, data hosting, and hotline services. We have carefully selected these service providers and monitor them on a regular basis, especially regarding their diligent handling of and protection of the data that they store. All service providers are obliged by us to maintain confidentiality and to comply with legal requirements. Service providers can also be other companies of the Bosch Group.
During check out process, we may initiate creditworthiness checks depending on your selected payment method. We work with creditworthiness check tool provider(s) / agencies if available in your country and we transmit your order information to receive information on such checks. Before we initiate creditworthiness checks, we will provide you a specific information on how we deal with your data on the relevant touchpoint (on our website/in paper form in brick-and-mortar stores).
4. Delivery, Withdrawal of an Order and Returns
As part of the delivery process, we use logistic service providers, and your contact details are transferred to our logistic service providers so that they can perform the delivery as well as contact you to arrange deliveries and inform you about delivery problems as they occur. If applicable in your country, we may also use your order information to plan delivery routes.
You may also be offered to choose a convenient day and time frame you prefer to deliver your orders in case your country enables this option. In such a case our logistic service providers and suppliers receive your order information to offer you the available date and time. You can also track status of your products via the tracking link we sent you. Your order information, delivery note, and your preferred delivery date and time information are processed to inform you on the status of your delivery. We may also use external partners for this service.
In case you decide to return your product, you can either
• use (if available in our country) the “withdrawal button” and fill in the connected form to execute your right of withdrawal,
• use the specific form/returns-portal via website (if available in your country), or
• contact our call centre.
The information needed for returns may be a combination of your order ID/order information, personal information (e.g. name/surname) and email address information and/or zip code (from your delivery address).
The option to create a return label may also be available via these options. In this case, the information you provided is used by us and/or the return portal service provider and passed to the respective logistics service provider, to handle your contract cancellation/return. After you drop off your return parcel at the logistic service provider partner you will receive emails regarding the status of your return and your refund.
5. Insurance/Warranty Extension
We collect your personal information to facilitate the insurance service you opt for, enhancing your overall customer experience. This includes information necessary for policy creation, claims processing, and communication regarding your insurance coverage.
We may collect details such as your name, contact information, address, and information specific to your household appliances. We will transfer this data to our partners providing the insurance or warranty extension. This ensures that our partners can tailor insurance solutions to meet your individual needs.
6. Collection Agents
In certain circumstances, it may be necessary to disclose relevant information to a collection agency to facilitate the resolution of outstanding payments.
The disclosure of data to a collection agency is specifically for the purpose of recovering outstanding payments related to our products or services. This ensures the fair and lawful handling of financial transactions.
The information disclosed to the collection agency may include details such as your name, contact information, billing information, and details of the outstanding payment. This information is limited to what is necessary for the collection agency to perform its services effectively.
7. Specific to Online sales channels
a) Registering on our website / My Account / Synced Home Appliance Account
You can register on our website to use different services. We collect and process the following details as part of the registration process, whereby the set of details may differ depending on the specific registration page:
Required details: Title, first and last name, full postal address, telephone number (mobile or landline), email address, Password.
Optional details: Date of birth, what made you find us, consent to receiving advertising and possibility to revoke.
We store registered users' data until the user deletes their account. Registered users can delete their accounts at any time via the settings of their user account. The user account also allows users to change or delete specific information provided at the time of registration at any time.
b) Comfort registration (including SingleKey ID)
For the registration on our website or other electronic touchpoints you can also use the comfort registration via SingleKey ID or Social Sign-On Options (if available).
SingleKey ID is a digital identity platform that allows you to access websites, stores, apps and services of many partner companies with a single login. For data processing while registering with the SingleKey ID, please see Section XII below for more information (including the specific processing of personal data) on the specific provider(s). After registration when using SingleKey ID at our touchpoints we collect and use the access data, i.e. identification data that serves to control access to the SingleKey ID user account and consists of the user ID (e.g. email address or mobile phone number of the user) for login.
Social Sign-On Options may in addition be available for various social networks. To register, you will be redirected to the website of the relevant social network, where you can register with your access data. This links your Social Network user account to the user account on our website. When linking, we automatically receive the data required for registration from your social network. You can find out which data is transferred from your social network to us from the data protection information and terms of use of the relevant social network. We store and process only your name and email address from this data for the provision of our services.
By linking the two user accounts, you no longer must log-in additionally on our website if you have already registered in your social network. To provide this, a corresponding cookie is set in the Internet browser and used at your next visit of our website for the purpose of signing in to your account.
We use the data stored in the context of the comfort registration exclusively for the provision of the services of our website, particularly the Social Sign-On option. We store the data of registered users until the user account is deleted. Registered user can delete their accounts at any time via the settings of the user account. The user account also provides the option of changing or deleting certain data entered during registration at any time.
c) Shopping on our website
You can also use our website or other touchpoints (e.g. call centre, brand store, technician sales) to access services requiring payment (e.g. orders in the accessories store, book a repair). We collect and process the following order information when services are ordered (order information):
• Title, first and last name,
• full postal address,
• telephone number (landline or mobile),
• email address,
• billing information (depending on the payment type provided by us and chosen by the user).
As a registered user, you also benefit from the fact that the time and scope of all purchases (display of the history of purchases made in the user account) is displayed for you in your customer account, so that you can track your orders directly there.
We use state-of-the-art encryption techniques (e.g. SSL) via HTTPS to warrant the security of your data during transmission.
When you place an order, we use your information for the sole purpose of processing that order, to display the history of purchases, to deliver your products within your preferred day and timeframe and tracking status of your deliveries. We store order information at least until the expiry of the statutory retention periods. We store data provided when registering until the user deletes its account.
d) Video Advice
With video advice, our customer service representatives can visually demonstrate you troubleshooting techniques, provide step-by-step instructions, and offer personalized guidance in case you need any assistance with your household appliances. Depending on the tool we use for video advice, your personal data may be processed by the tool provider and transferred outside of your country.
e) Product Configurators
This website offers Interactive Digital Assistants that help users find the most suitable product and enable digital product configuration. To utilize the interactive digital assistants, simply navigate through the available questions on our website. Based on your responses, the Interactive Digital Assistants will recommend a product or show you a visual representation of the product based on your choices (e.g., selecting a colour for My Unlimited) and allow you to configure certain aspects of the products. Please note that this service is provided by a third-party configurator supplier, and you can find more information about them in the "list of third-party providers" at the end of this document.
When you use this service and provide us with a permission, such as through consent given via the tracking banner, we collect the following usage data:
• Event data: (digital assistant performance, question answers, navigation, product recommendations, purchase),
• Browser / operating system / device used,
• Traffic source.
We use this data collected (by using a cookie ID) to enhance the experience of the Digital Assistant and digital product configurators as well as for technical purposes to improve the service. Your IP address is not collected. Therefore, it is not possible to deduce the user identity from the ID used.
f) Location (Maps)
One feature available to you as a user of our website is a map showing cooperating dealers in your area. We use Google Maps to display this map. You can find details on how personal data is processed when Google Maps is used via the following link: https://policies.google.com/privacy. Please also see the list of third-party providers at the end of this document for more information on Google.
To display cooperating dealers in your area, you have the option to provide a location. This can be done by manually entering your location or allowing the geolocation function on your internet browser to automatically determine it. If you manually enter the information, no personal data is processed unless you specifically provide your home address. However, if you choose to use the geolocation function, your IP address will be processed for the purpose of automatically identifying your location. We are allowed to process this information with your consent, which your internet browser will request when accessing the map. It's important to note that we do not store your IP address in this context.
g) Product reviews
You can also create reviews for some products on our website, as well as report reviews or content, you hold inappropriate. The data we collect for these purposes are determined by the form provided for the specific purpose.
Reviews or other user-generated content will be published on our publicly facing website or mobile applications, and it may be read, collected, and used by our product review provider, its affiliates, subsidiaries, vendors and clients as per its privacy policy. Note also that our product review provider uses also the following technology and resulting information for providing us client services including fraud detection and analytics:
• Precise Location Data: If this function is enabled such in your mobile application, your precise location may be collected with your express permission. You may opt-out of location-based services at any time by editing the setting at the device level.
• Cross Device Collection: Your information may be combined across all the devices and browsers with which you access the product review provider’s network.
Please see the list of third-party providers at the end of this document for more information on our Product Review Provider.
We may also process user activity logs (sessions, page/features usage, duration) to improve user experience and system stability. Activity data is processed using irreversible methods (e.g., hashing) to prevent any inference about individuals.
If you think, a review is inappropriate or otherwise use the reporting function, your submission can be made anonymously in most cases; there may be report options, where you are obliged by law to provide personal information or other cases, where you freely can choose to provide us such information. These options are always made transparent in the respective form.
8. Specific information to Offline sales channels
a) Offer/Sales Procedure
When you visit our physical stores, you have the option to receive information about our products and services in a digital format by choosing to receive information/quotations via email instead of paper forms. Additionally, when you make a purchase, we will send the order confirmation to your email address. In these instances, the order information you provide will be used to ensure the delivery of your products to you. We may also ask for feedback about your shopping experience via a survey option.
If you would like to understand how we handle your data during the delivery process, we encourage you to refer to the Delivery and Returns section located above for more detailed information.
b) QR codes
We utilize QR technology to conveniently direct you to our online store website, other sales channels (such as Google shopping), or our social media pages. Additionally, QR codes are used to provide you with promotional information, access product and service catalogues, and conduct customer surveys.
c) Video Surveillance
For your safety and security, it's important to note that our stores and their immediate vicinity may be under video surveillance, where this is indicated e.g. by showing the video surveillance logo. This is done to ensure the protection of our customers, staff, and property. We adhere to the principles and requirements of the applicable data protection laws when implementing such video surveillance measures, e.g. by avoiding capturing unnecessary personal data or areas where individuals have a reasonable expectation of privacy.
Detailed information about the video surveillance practices, including the purpose, duration of retention, and the rights of individuals can be obtained in our stores. If you have any questions or concerns regarding the video surveillance practices in our stores, also our staff will be happy to provide you with further information.
9. Customer Service / Book a repair
You have the option to conveniently schedule a repair appointment with a service technician directly on our website or via phone. To facilitate this process, we will require certain information related to your household appliance, a description of the problem, your address, and additional contact details (please refer to the "Purchasing on our website" section above for more information). The specific data collected during the booking process will be determined accordingly.
Please note that it is important to review the relevant subpage where you can arrange the repair appointment, as it provides important information regarding the associated costs.
As part of the booking process, we utilize the Google Maps database to verify the accuracy of the address entry, ensuring that any potential errors or mistakes are avoided. Rest assured that your personal data is not transferred in this context.
10. Legal Basis for data handling
We base the above data processing operations in GDPR regions on:
a) Your consent pursuant to Art. 6 para. 1 lit. a) GDPR:
• Participation in product reviews,
• Loyalty Program,
• Google Maps including dealer search,
• QR Codes.
b) A legal permit (performance of a contract) in accordance with Art. 6 para. 1 lit. b) GDPR:
• Shopping on our website and other touchpoints e.g. brand stores, payment,
• Video Advice,
• Registering on our website / My Account,
• Comfort registration (Social Sign-On Option),
• (Product-)Configurators,
• Product Reviews,
• Insurance/Warranty extension,
• Creditworthiness Checks (during the purchasing process),
• Delivery (including delivery arrangements, tracking and returns),
• Customer Service including repair,
• Arrange an online repair appointment,
• Product/service-information by email,
• Data processing for address verification,
• Collection Agents.
c) A legal permit (legitimate interest) in accordance with Art. 6 para. 1 lit. f GDPR:
• Creditworthiness Checks (outside of a specific purchasing process),
• Sanction Screening,
• Video Surveillance.
VIII. Safety Actions
1. Voluntary Product Safety Registration
Via our websites, we provide a voluntary product registration for safety actions. The data provided via this registration will only be used if the registered product is affected by a safety issue or product recall. The registration will be active, as long it is not deleted by you; the specific deletion period (see sub-section 4 below) is applicable. In case your registered product is affected, you will be notified by us.
2. Safety Archive
Your Name, e-mail address, product information (if any) and information about the interaction you had with us, is stored in a safety archive. This archive can only be accessed in case of a product recall and allows us to reach all potential persons, who may be affected by such product recall or other safety measure. This archive also serves to long-term store your information provided via a voluntary product registration for safety actions.
2. Product recall
In the event of a product recall, we take proactive measures to ensure the safety of our customers. If you are affected by a product recall, we will notify you via contact information you provided to us, e.g. via email, to provide you with important information. To facilitate this communication, we utilize the contact data and assigned product information stored in our customer database.
It's important to note that such a recall will be a one-time data processing activity specifically for the purpose of informing you about the product recall. We prioritize the security and confidentiality of your data throughout this process. Rest assured that your information is used solely for the purpose of addressing the product recall and will not be shared or used for any other purposes.
By promptly notifying you about product recalls, we aim to protect your safety and ensure that you have the necessary information to take appropriate action. We appreciate your cooperation and understanding in helping us maintain the highest standards of safety for our customers.
3. Security and similar updates
We prioritize data protection and security, and we are committed to continuously improving the security features as well as the stability of the software of our home appliances. To address any potential vulnerabilities or software issues that may emerge over time, we regularly release security or similar updates. These updates are crucial for maintaining the function, integrity and security of your home appliances.
We strongly recommend that you regularly check for and install these updates. By doing so, you can ensure that your appliances remain safeguarded against potential security threats and stays up to date. Neglecting to install these updates may expose your personal data and connected devices to unauthorized access or compromise. We may also inform you about such updates.
Your privacy and the security of your information are of utmost importance to us. By staying proactive and keeping your appliances up to date with the latest security updates, you can help protect yourself and maintain a secure environment within your home.
4. Specific deletion period
Personal data relevant for product safety actions will be subject to a centrally applied, specific deletion period of 30 years. After the standard deletion period has expired, this data will be transferred to a separate access-restricted archive for further storage. If you place a deletion request via our website (see Section I above), your data will also be deleted from this safety archive on a regular timely basis.
5. Legal Basis for data handling
We base the above data processing operations in GDPR regions on:
a) Your consent pursuant to Art. 6 para. 1 lit. a) GDPR:
• Voluntary Product Safety Registration.
b) A legal permit in accordance with Art. 6 para. 1 lit. c) GDPR:
• Obligatory product recall.
c) A legal permit in accordance with Art. 6 para. 1 lit. d) GDPR:
• Voluntary product recall or update notification.
d) A legal permit in accordance with Art. 6 para. 1 lit. f) GDPR:
• Security updates.
IX. Business Partners
1. General
a) Contractual relationship with business partners
The following data protection information applies to you if you are our business partner or a legal representative, employee, shareholder, or economic beneficiary of a business partner. Business partners are legal or natural persons who are in negotiations with us to establish a business relationship or who are already party to a corresponding business relationship with us. Contracts relating to employment or training relationships are expressly excluded.
b) Categories of data
Which data is processed in detail depends largely on the agreed services and the subject of our business relationship. Therefore, not all parts of this information will be relevant to you.
As a rule, we collect your data from you. However, in certain constellations it may also be necessary, due to legal regulations or legitimate interests (e.g. in the context of business partner compliance checks), to process personal data that we receive from other companies, tax offices, authorities, credit agencies, insolvency registers, publicly accessible sources (internet research) or other third parties. This also includes reports via our established whistle-blower channels on possible compliance violations. Relevant personal data may include:
• Personal data (e.g. first name/last name, address and other contact data, date and place of birth and nationality),
• legitimation and authentication data (e.g. excerpts from the commercial register, identification data, specimen signature),
• company, as well as position, position and department in the company, supervisor,
• data within the scope of our business relationship (e.g. payment data, data on orders),
• data on company structures and ownership,
• photographs and video recordings (e.g. on deliveries of goods),
• log data,
• username and identification, user ID,
• compliance-relevant data (e.g. information on references, information on insolvencies,
• negative reporting, check for sanction listings,
• information on criminal investigations relating to the subject matter of the service,
• Sanction Screening,
• Vehicle registration number and other data comparable with the categories named above.
When concluding a contract, we may collect data on your creditworthiness from credit agencies to fulfil the above-mentioned legitimate interests. We use the credit agencies' data on creditworthiness to check your creditworthiness. The credit agencies store data that they receive from banks or companies, for example. You can obtain information about the data stored about you directly from the credit agencies.
Insofar as you conclude a contract with us by means of a digital signature, we process your related data (particularly email address, IP address, date/time at which you processed the respective contract document). In addition, it is possible to sign certain contracts with a so-called qualified electronic signature. In this case, we also process the certificate data of your signature in addition to the categories mentioned. This data is accessible to all persons involved in the approval and signing of the contract.
c) Recipients/Categories of recipients
Within our company, the departments that receive access to the data you have provided are those that need it to fulfil contractual or legal obligations or to fulfil legitimate interests or have been approved by you in the separate declaration of consent.
These are usually the procurement department or purchasing department and the service recipients within the BSH country organisation with which the business partner has entered the business relationship.
Within the framework of the contractual relationship, for the fulfilment of legal obligations and for the protection of legitimate interests, authorities or service providers also receive access to your personal data.
Compliance with data protection regulations is contractually ensured. The data may also be transferred to companies within the Bosch Group to fulfil contractual obligations.
If you have concluded a framework agreement with the whole of BSH or the Bosch Group as an authorised service recipient, the respective procurement and purchasing departments of BSH or the Bosch Group have access to the business partner data relevant for contacting you and the national compliance departments of the Bosch companies each have access to the business partner compliance check data. Outside our group of companies, the data will only be passed on if we are legally obliged to do so (e.g. official investigations).
2. Legal Basis for data handling
We base the above data processing operations in GDPR regions on:
a) a legal permit in accordance with Art. 6 para. 1 lit. b) GDPR:
• Use our website as a business partner (pre-contractual and contractual use).
b) a legal permit in accordance with Art. 6 para. 1 lit. f GDPR:
• Use our website as business partner (e.g. surveys, invitation to events, congratulations, and Christmas cards),
• Creditworthiness Checks,
• Selection of a suitable business partner (e.g. intermediary check).
X. Applicants
As an applicant to a job-offer, you may use one of our touchpoints to submit your data to us. In addition to information provided directly on the relevant touchpoint (e.g. job market page), we inform you below about our general handling about such personal data.
1. General
We use your applicant data,
• to identify you as an applicant,
• to contact you,
• to carry out the application procedure.
Your personal data will be transmitted to
• our employees responsible for your application,
• our works council and, if applicable, the representative body for severely disabled persons,
• if applicable, our service providers for the technical support of the application / applicant portal / job platform,
• if applicable, our postal and logistics service providers.
Your personal data will be deleted as mentioned in the respective applicant site, unless we have received your consent to keep your data longer, e.g. for processing in an applicant pool. In case there are legal or contractual obligations to retain such data, your data will be stored as long as it is required to fulfil these legal/contractual obligations, but access to your data will be restricted. For statistical purposes, some data points resulting e.g. from the application procedure will be anonymized and processed further after your personal data was deleted.
2. Legal Basis for data handling
We base the above data processing operations in GDPR regions on your consent pursuant to Article 6 para. 1 lit. a) GDPR for retention of applicant data beyond the regular deletion period or a legal permit in accordance with Art. 6 para. 1 lit. b) GDPR for regular processing.
XI. List of the GDPR Data Protection Authorities
In accordance with the General Data Protection Regulation (GDPR), individuals have the right to protect their personal data and can seek assistance from the relevant Data Protection Authorities (DPAs). The list below aims to provide you with a list of DPAs within the GDPR region. It is important to note that data subjects have the option to contact either the DPA of their place of residence or the DPA responsible for the website's provider, depending on the location of the provider. Please note that this list is not exhaustive, and there may be additional DPAs within the GDPR region or, if you are not in the GDPR region, in your country.
Austria: Österreichische Datenschutzbehörde, http://www.dsb.gv.at/
Belgium: Autorité de la protection des données - Gegevensbeschermingsautoriteit (APD-GBA), https://www.autoriteprotectiondonnees.be https://www.gegevensbeschermingsautoriteit.be
Bulgaria: Commission for Personal Data Protection, https://www.cpdp.bg/
Croatia: Croatian Personal Data Protection Agency, http://www.azop.hr/
Cyprus: Commissioner for Personal Data Protection, http://www.dataprotection.gov.cy/
Czech Republic: Office for Personal Data Protection, http://www.uoou.cz/
Denmark: Datatilsynet, http://www.datatilsynet.dk/
Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), http://www.aki.ee/
Finland: Office of the Data Protection Ombudsman, http://www.tietosuoja.fi/en/
France: Commission Nationale de l'Informatique et des Libertés – CNIL, http://www.cnil.fr/ https://www.cnil.fr/en/contact-cnil
Germany/Bavaria: Bavarian Data Protection Authority (BayLDA), http://www.baylda.de
Greece: Hellenic Data Protection Authority, http://www.dpa.gr/
Hungary: Hungarian National Authority for Data Protection and Freedom of Information, http://www.naih.hu/
Iceland: Persónuvernd, https://www.personuvernd.is , https://www.dpa.is
Ireland: Data Protection Commission, http://www.dataprotection.ie/
Italy: Garante per la protezione dei dati personali, http://www.garanteprivacy.it/
Latvia: Data State Inspectorate, https://www.dvi.gov.lv/
Liechtenstein: Data Protection Authority, Principality of Liechtenstein, https://www.datenschutzstelle.li
Lithuania: State Data Protection Inspectorate, https://vdai.lrv.lt/
Luxembourg: Commission Nationale pour la Protection des Données, http://www.cnpd.lu/
Malta: Office of the Information and Data Protection Commissioner, http://www.idpc.org.mt/
Netherlands: Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl/
Norway: Datatilsynet, https://www.datatilsynet.no
Poland: Urząd Ochrony Danych Osobowych (Personal Data Protection Office), https://uodo.gov.pl/
Portugal: Comissão Nacional de Proteção de Dados – CNPD, http://www.cnpd.pt/
Romania: The National Supervisory Authority for Personal Data Processing, http://www.dataprotection.ro/
Slovakia: Office for Personal Data Protection of the Slovak Republic, http://www.dataprotection.gov.sk/,
Slovenia: Information Commissioner of the Republic of Slovenia, https://www.ip-rs.si/
Spain: Agencia Española de Protección de Datos (AEPD), https://www.aepd.es/
Sweden: Integritetsskyddsmyndigheten, http://www.imy.se/
XII. List of the Third party providers and their use
• SingleKey ID for registration services and sign-in functionality are provided by Robert Bosch GmbH, Robert-Bosch-Platz 1, 70839 Gerlingen-Schillerhöhe, GERMANY, ("RBG"). The responsibilities of us and RBG under the Joint Controllership Agreement are the following:
| Obligation under GDPR | Robert Bosch GmbH | We |
| Article 6: Requirement of legal basis for Joint Processing | [x] (regarding RBG’s processing) | [X] (regarding our own processing) |
| Articles 13,14: Providing information on Joint Processing of Personal Data | [X] | [X] |
| Article 26(2): Making available the essence of this JCA | [X] | |
| Articles 15-20: Rights of the Data Subject with regard to the Personal Data stored by RBG after the Joint Processing | [X] | |
| Article 21: Right to object insofar as the Joint Processing is based on Article 6(1)(f) | [X] (regarding RBG’s processing) | [X] (regarding our own processing) |
| Article 32: Security of the Joint Processing | [X] (regarding the security of the SingleKey ID Features) | [X] (regarding the correct technical implementation and configuration on our touchpoints) |
| Articles 33, 34: Personal Data Breaches concerning the Joint Processing | [X] (insofar as a Personal Data Breach concerns RBG’s obligations under the Joint Controller Addendum) | [X] (insofar as a Personal Data Breach concerns our obligations under the Joint Controller Addendum) |
For additional information about data transfers related to the central SingleKey ID Service within the Bosch Group, please refer to the RBG data protection information available at https://singlekey-id.com/en/data-protection-notice/. If you wish to delete your Single Key ID and the associated data, you need to delete your Single Key ID account provided by RBG.
• Facebook and Instagram including WhatsApp and Facebook messenger is provided by the following entities:
• for countries in the European region: Meta Platforms Ireland Limited, Merrion Road Dublin 4 D04 X2K5, Ireland
• for other countries: Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA;
http://www.facebook.com/policy.php
https://help.instagram.com/519522125107875
Meta is providing the following services:
• as social media provider (Facebook, Instagram),
• providing chat functionality via WhatsApp and Facebook Messenger,
• Facebook Pixels and Custom Audiences, where For Facebook Pixels and Custom Audiences, Facebook processes your data under a joint responsibility with us, in accordance with the contract we concluded with Facebook on our joint responsibility. We do not have access to your individual tracking data processed by Facebook as Facebook provides us with aggregated data only. We may share this aggregated data with third parties, e.g. cooperation partner for marketing purposes. The essence of this contract is available here:
https://www.facebook.com/legal/controller_addendum.
• You can find information about Facebook ads and Facebook pixels with the following links:
https://www.facebook.com/policy and https://www.facebook.com/business/help/651294705016616
• To permanently prevent the collection of usage data, please use the following link:
https://www.facebook.com/policies/cookies/
As a registered Facebook user, you can also set what types of ads are displayed to you within Facebook, use the following link:
https://www.facebook.com/settings/?tab=ads
WhatsApp Messenger (service specific information):
As a messaging service through which we e.g. send notifications regarding deliveries, you may choose to utilize the service of WhatsApp. However, we do not accept calls through WhatsApp. In the execution of this messaging service for the purpose of contacting and transmitting messages, we shall utilize your telephone number. (Legal basis: Article 6(1)(a) GDPR). Furthermore, we process additional personal data that you have provided on WhatsApp or that is contained within your messages, such as your name, profile picture, and messages/images that you send to us via the messenger. Your data shall be deleted once it is no longer required for communication and support. For detailed information on the specific personal data collected by the respective messaging service, how it is processed, and the data protection rights you possess with regard to the respective messaging service, please refer to the privacy policy and terms of use provided below for the respective messaging service:
• The privacy policy for WhatsApp can be found here: https://www.whatsapp.com/legal/#privacy-policy.
• The terms of use for WhatsApp can be found here: https://www.whatsapp.com/legal.
Additionally, we have no control over the (previously mentioned) data processing carried out by the messaging service. In terms of the General Data Protection Regulation, WhatsApp Ireland is responsible for WhatsApp as the messaging service, and the Irish data protection authority serves as the competent supervisory authority. We would like to inform you that, while using the messaging service, WhatsApp stores users' data in third countries outside the European Union and exchanges it with other services provided by the same entity. We have no influence over this.
• Pinterest as an online marketing tool is provided as follows:
Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, https://policy.pinterest.com/en/privacy-policy. The Pinterest Tag help us analyse use of our website and to track the effectiveness of our advertising campaigns (Conversion Tracking). We also use the Pinterest Tag to create audiences and show you personalized advertising based on your interest in our products (retargeting). For this purpose, Pinterest Europe processes data, which the service collects from pixels, cookies and similar technologies on our website.
If you have a Pinterest account and have allowed Pinterest Europe to do so in your account’s privacy settings, Pinterest Europe may also link the information collected about your visit to us with your Pinterest account and use it for showing you the targeted advertisements. You may see and change the privacy settings, especially for personalisation, in your Pinterest account at any time. For more information, please see https://help.pinterest.com/en/article/edit-personalization-settings.
If you have not agreed to the use of the Pinterest Tag, Pinterest Europe will only show you general Pinterest Ads which have not been created based on the data collected about you.
This collection and transmission of activity data within the scope of the Pinterest Tag is carried out by us and Pinterest Europe as joint controllers within the meaning of Article 26 GDPR. We have an agreement with Pinterest Europe concerning this processing as joint controllers. This agreement defines the division between us and Pinterest Europe of the duties under data protection law. In this agreement, we and Pinterest Europe have agreed, among other things, that we are responsible for providing you pursuant to Articles 13 and 14 GDPR with all information about our joint processing of your personal data and that Pinterest Europe is responsible for facilitating the exercise of rights of data subjects pursuant to Articles 15 to 20 GDPR. You may see more information on this agreement below.
Responsibilities of us and Pinterest Europe under the Joint Controllership Agreement
| Obligation under GDPR | Pinterest Europe | WE |
| Article 6: Requirement of legal basis for Joint Processing | [x] (regarding Pinterest Europe’s processing) | [X] (regarding our own processing) |
| Articles 13,14: Providing information on Joint Processing of Personal Data | [X] | |
| Article 26(2): Making available the essence of this JCA | [X] | |
| Articles 15-20: Rights of the Data Subject with regard to the Personal Data stored by Pinterest Europe after the Joint Processing | [X] | |
| Article 21: Right to object insofar as the Joint Processing is based on Article 6(1)(f) | [X] (regarding Pinterest Europe’s processing) | [X] (regarding our own processing) |
| Article 32: Security of the Joint Processing | [X] (regarding the security of the Ad Data Features) | [X] (regarding the correct technical implementation and configuration of our use of the Ad Data Feature) |
| Articles 33, 34: Personal Data Breaches concerning the Joint Processing | [X] (insofar as a Personal Data Breach concerns Pinterest Europe’s obligation under the Joint Controller Addendum) | [X] (insofar as a Personal Data Breach concerns our obligations under the Joint Controller Addendum) |
Pinterest Europe is responsible as sole controller for the processing of activity data subsequent to their transmission. You can find more information on how Pinterest Europe processes Personal Data, including the legal basis Pinterest Europe relies on and the ways to exercise Data Subject rights against Pinterest Europe, in Pinterest Europe’s Privacy Policy at
• https://policy.pinterest.com/privacy-policy#section-residents-of-the-eea
• In addition, you can find out more about the Pinterest Tag at
https://help.pinterest.com/en/business/article/pinterest-tag-parameters-and-cookies.
• LinkedIn as a business network is provided by the following entities:
• for countries of the European Union (EU), the European Economic Area (EEA) and Switzerland: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland and
• for all other countries: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.
• Adobe is providing several services which are used or can be used via our websites. These services are provided by Adobe Systems Software Ireland Ltd., 4-6 Riverwalk, Citywest Business Park, Dublin 24, Ireland ("Adobe”). You can find additional information about how Adobe Analytics cookies work and the opt-out option via the following link: http://www.adobe.com/privacy/opt-out.html.
We use the following services:
• for web analytics we use Adobe Audience Manager und Adobe Tracking being part of the Adobe Marketing Cloud: The information relating to your use of our website is transferred to Adobe servers, analysed and solely returned to us as cumulative data. This data allows us to identify trends in how the website is generally used. We do not conflate the resultant usage profiles with your name or any other details that could disclose your identity, such as your email address. The usage data is stored by the service used for a maximum duration of 37 months from the date on which it was collected.
• for A/B testing we use Adobe Test & Target: Adobe Test & Target works based on A/B tests. This means that the person using our website is shown a different version of the website from the original (e.g. with altered design and content). Comparing both versions provides us with information about which version of our website is preferred by users. When Adobe Test & Target is used, the only information relating to you that is processed cannot be used to identify you. IP anonymisation is also activated, meaning that your IP address is shortened before Adobe Test & Target carries out any further processing. We do not conflate the usage profiles resulting from this with your name or any other details that could disclose your identity, such as your email address. The usage data is stored by the service used for a maximum duration of 37 months from the date on which it was collected. You can also use the following link if you wish to prevent your usage data being collected: http://bsh.tt.omtrdc.net/optout.
• Optimizely (with its Global HQ in 119 5th Ave 7th floor New York, NY 10003, USA and Optimizely AB in Torsgatan 11, 111 23 Stockholm, Sweden) is another tool we use for A/B testing. While using our website the individual user may see a different version of the website from the original (e.g. with altered design and content). Comparing both versions provides us with information about which version of our website is preferred by users. More information about privacy at Optimizely will be found here: https://www.optimizely.com/legal/privacy-notice/
• Google is providing several services which are used or can be used via our websites. These services are provided via several brands or tools, which we describe in more detail below. In general, these services are provided by the following entities:
• for countries of the European Union (EU), the European Economic Area (EEA) and Switzerland: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• for other countries including UK: Google LLC (formerly Google Inc.), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
You can find general information on how personal data is processed when Google tools are used via the following link https://business.safety.google/privacy/. Opt-out: To permanently prevent the collection of usage data, Google offers a plugin for various Internet browsers: http://www.google.com/settings/ads/plugin. To disable only interest-based ads, you can block the use of third party cookies or cookies from the "www.googleadservices.com" domain or disable interest-based ads using this link at https://support.google.com/ads/answer/2662922?hl=en-GB.
We are using the following Google tools in the following specific way:
• YouTube for the presentation of videos on our websites. If you declined the use of cookies via the cookie banner, you may be ask to consent separately for consent before the display of such videos on our website. Only if you consented, any possible data transfer will start.
• YouTube as social media provider, where we present videos on different YouTube Channels. Please see the privacy information stated above when using such channels.
• Google reCAPTCHA: In order to protect our website and your website interactions, such as logins or registrations, against attacks, we perform risk assessments on website users to detect computer generated interactions. For these purposes, we use Google reCAPTCHA. Google reCAPTCHA analyses your interactions with our website and therefore processes your personal data including the storage of cookies on your end device.
• Google Maps as service for location and mapping services, whereby only such data is used, you provide in using that service. A proximate location is used to show e.g. partners near your location or verify the postal code for service requests.
• Google GA4 Technology is used by us (only if you gave your cookie consent), to implement server-side tracking as similar technology to cookies. In using that tool, we do not send usage data or similar data to Google but use the tool to send statistical and/or event-based information of the website use to our servers. This data is processed by us and does not allow any individual identification of you or your device, you use the website/service from.
• Google Tag Manager (GTM) is a tool used by us enabling us to manage and deploy marketing tags on websites without code modification. Tags include analytics and tracking codes, providing insights into website performance and user behaviour. While GTM itself doesn't set cookies, tags deployed through it may use cookies for tracking.
• Google Ads & Remarketing
We use online marketing tools from Google on our own responsibility. The cookies used in this service generally lose their validity after 30 days and are not intended to identify you personally. Google merely provides us with statistical evaluations. Google processes your information in accordance with Google's data usage policy.
Opt-out: To permanently prevent the collection of usage data, Google offers a plugin for various Internet browsers: http://www.google.com/settings/ads/plugin.
To disable interest-based ads, you can block the use of third-party cookies or cookies from the "www.googleadservices.com" domain or disable interest-based ads using this link at
https://adssettings.google.com/authenticated?hl=en_GB
Interest ads can also be deactivated via the link http://www.aboutads.info/choices if the provider has joined the self-regulatory campaign "About Ads".
• Google Ad Server
We use online marketing tool (formerly DoubleClick) of Google. The usage data will be deleted after 540 days from the time of collection. For more information about DoubleClick, please visit:
https://support.google.com/admanager/answer/6022000?hl=en,
We use online marketing tools from Google on our own responsibility. To this end, we have agreed with Google in a data protection agreement that our customers' data may only be processed based on our instructions, may not be passed on to third parties and must be sufficiently technically protected.
• Medallia Experience Orchestration (formerly known as “Thunderhead”) is an online (re-)marketing platform provided by Medallia, Inc., 6220 Stoneridge Mall Rd, Floor 2, Pleasanton, CA 9458, USA. We use this service for our website as a marketing tool to display personalized information to you on our websites, as well as on websites of other providers, about our products that may have interested you while using our website. Medallia provides us with statistical analysis for this purpose. This service also provides us with cross-device and cross-context usage profiles (data) to help us learn more about our website users. We do not use this data to identify you personally.
Medallia processes this data on our behalf within the framework of a data protection agreement, in which we have agreed that our customers' data may only be processed on our instructions, may not be passed on to third parties and must be sufficiently technically protected. For detailed information on the cookies we use and the purposes for which we use them, refer to our cookie consent preference centre. These preferences can be updated at any time and you can also deactivate tracking in making a new choice by modifying your choice there. Most internet browsers are configured to automatically accept cookies. These settings can be modified to selectively accept, block cookies, or alert you when cookies are being sent to your device. You may also refer to your browser’s documentation or visit www.allaboutcookies.org for ways to manage cookies. Additional information on Medallia and its data handling can be found with the following link: https://www.medallia.com/privacy-policy/.
• ChannelSight for conversion tracking purposes the provider of the service is ChannelSight Ltd., Suite 3, Anglesea House, Carysfort Ave., Blackrock, Co. Dublin, Ireland (www.channelsight.com). You can purchase many our products directly via the corresponding hyperlinks (e.g. a button “Buy Online”) to cooperating dealers' online stores (e.g. the function "Visit retailer shop"). If you follow the respective hyperlink to the chosen product page in the dealer's online store, we use JavaScript code and cookies (i.e. conversion tracking) to log that you clicked on the hyperlink and whether you purchase the product in the dealer's online store. The usage data collected in this way is used to measure the attractiveness of the "Visit retailer shop" function and, where applicable, for commission settlement purposes with the dealer's online store (i.e. affiliate marketing). Sometimes dealers' online stores pay us a commission when we successfully redirect prospective buyers and customers to them. The information relating to your use of the "Go to dealer's website" function is transmitted to ChannelSight servers, analysed and returned to us, to allow us to evaluate trends relating to use of the "Visit retailers shop" function. Please note that this tracking is directly connected to the "Visit retailer shop" function, where we will you inform directly of the intended use of data. By using the "Visit retailer shop" button on our website, you give your consent for the inter-website recording of your website use and the analysis by us for the indicated purposes, and to the associated data collection by ChannelSight and the retailer, as well as the transfer of data from ChannelSight and the retailer to us. The usage data is deleted once it is no longer required for commission settlement and analysis.
Opt-out: To prevent the collection of usage data via ChannelSight, please use the ChannelSight opt-out Web site with the following link:
https://www.channelsight.com/privacypolicy/
• We use Mouseflow to improve our website and the services it offers. Mouseflow is provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark. On our websites we record the mouse movements and clicks of randomly selected users of our website, whereas your IP address is anonymized. We do not conflate the resultant usage profiles with your name or any other details that could disclose your identity, such as your email address.. The usage data is deleted three months after the date on which it is collected. Opt-out: Please use Mouseflow's opt-out website via the following link if you wish to prevent this usage data being collected: https://mouseflow.com/opt-out/
• We use Zendesk as Chat and/or Chatbot provider, provided by Zendesk 989 Market St., San Francisco, CA 94103, https://www.zendesk.com/company/agreements-and-terms/privacy-notice/
• We use Kore.ai as Chat and/or Chatbot provider, provided by Kore.ai Inc., 7380 West Sand Lake Road, Suite 390, Orlando, FL 32819 https://kore.ai/privacy-policy/
DPI_EU_EN_2.0_2026.06.17