Data Protection
Note: This is the privacy policy of BayWa r.e. AG, the publisher and operator of this website. If you're interested in the privacy policy of a BayWa r.e. subsidiary, please choose from the following drop-down menu.
As of: June 2025
Who is responsible for the data processing and whom can you contact?
Which personal data is processed and what are the sources?
For what purposes and on what legal basis is the data processed?
Who receives my data?
How long is my data stored?
Is personal data transferred to a third country?
Processing of personal data for advertising purposes
Processing of personal data related to credit ratings
Processing of applicant data
Diagnosis, correction and optimisation with Sentry
Contact form
Communication by email
What information is collected when you visit this website?
What data protection rights do I have?
Protecting your personal data is a top priority for us. Accordingly, we at BayWa r.e. AG and its subsidiaries (hereinafter jointly referred to as "BayWa r.e." or "BayWa r.e. Group") therefore solely process your personal data (hereinafter referred to as "data") based on statutory provisions. In this privacy policy, we aim to inform you comprehensively about the processing of your data in our company and the data protection claims and rights to which you are entitled according to the European General Data Protection Regulation (EU GDPR).
1. Who is responsible for the data processing and whom can you contact?
The responsible party is BayWa r.e. AG, Arabellastr. 4, 81925 Munich, Germany, email: info(at)baywa-re.com, phone: +49 89 383932 0.
The data protection officer of BayWa r.e. AG can be contacted via the above specified address or via email at: data-protection-officer(at)baywa-re.com.
2. Which personal data is processed and what are the sources?
Personal data within the meaning of the EU GDPR is any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified directly or indirectly by means of an assignment, for example to an identifier.
We process the data that we receive from you when commencing and maintaining business relations. We also process data that we have received legitimately from credit agencies, creditor protection associations, publicly accessible sources (e.g. business registers, registers of associations, land registers, media) and other companies with which we have long-term business relationships.
The scope of such personal data includes:
Your master/contact data such as:
For private customers: First and last names, address, contact data (e.g. email address, telephone number, fax), date of birth, data from identity material submitted (copy of ID card), bank details
As a corporate customer or supplier: Name of your legal representative, company, commercial register number, VAT ID number, company number, address, contact person contact data (email address, telephone number, fax), bank details
In addition, we may also process the following additional personal data:
Information about the nature and content of our business relationship such as contract data, order data, sales and receipt data, customer and supplier history, consulting documents, vehicle data,
Information about your financial status (e.g., creditworthiness data),
Advertising and sales data,
Documentation data (e.g. counselling protocols), image data,
Information from your electronic transactions with BayWa r.e. (e.g. IP address, login data),
Other data that we have received from you in the context of our business relationship (e.g. in customer meetings),
Data that we generate ourselves from master/contact data and other data, e.g., by means of customer requirements and customer potential analyses.
The documentation of your declaration of consent for the receipt of e.g. newsletters.
Image data from video monitoring systems
Photos taken at public events
3. For what purposes and on what legal basis is the data processed?
We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the currently valid version of the Federal Data Protection Act (BDSG) 2018:
• within the scope of your consent (Art. 6 (1) (a) GDPR):
If you have given us your consent to process your data, it will be processed for the purposes and to the extent specified in the declaration of consent. Consent given, e.g. for sending our newsletter, can be revoked at any time with effect for the future. To do so, please contact the party named under no. 1.
• for the fulfilment of (pre-)contractual obligations (Art 6 (1) (b) GDPR):
Your data is processed for the sale and distribution of our goods and services, for procurement and logistics purposes and for supplier and customer management. The data is processed in particular when initiating business and when executing contracts with you, for example in the following cases:
Creating and managing a customer account or a supplier account
Delivering orders
Managing customer cards
Participation in sweepstakes
Sending information on request, e.g., a catalogue
Employment within the meaning of Chapter 9.
The processing of your data is necessary for the initiation, conclusion and fulfilment of contracts concluded with us. You are neither legally nor contractually obliged to provide your data. If you do not provide us with this data, we will usually have to refuse to conclude the contract or execute the order or will no longer be able to fulfil an existing contract and will therefore have to terminate it.
• for the fulfilment of legal obligations (Art 6 (1) (c) GDPR):
Your data has to be processed for the purpose of meeting various legal obligations, e.g., as imposed by the German Commercial Code or the Tax Code, money laundering regulations, or product-specific regulations such as the Hazardous Substances Ordinance.
• to protect legitimate interests (Art 6 (1) (f) GDPR):
Based on a balancing of interests, data may be processed beyond the scope required to execute the contract to protect either our own legitimate interests or those of third parties. Data processing to protect legitimate interests may include the following cases, for example:
Consultation of and data exchange with credit agencies and creditor protection associations to determine creditworthiness data. This processing serves to identify financial default risks;
Advertising or marketing. This processing serves to market and increase sales of our goods and services.
Maintaining a group-wide customer database. This processing serves to improve customer service.
in the context of legal prosecution and defense. This processing serves to enforce or defend our rights.
4. Who receives my data?
If we use service providers who work on our behalf, these service providers are generally processors in terms of data protection law. In these cases, we nevertheless remain responsible for the protection of your data. All processors are contractually obliged to handle your data confidentially and to process it only within the scope required for the provision of services. The processors commissioned by us will receive your data if they require the data to fulfil their respective service. These include, for example, IT service providers that we require for the operation and security of our IT system, as well as advertising and address publishers for our own advertising campaigns Other categories of recipients are, if required for legal reasons or if there is a factual reason for this, management consultancies, law firms, authorities, telecommunications service providers, logistics companies, auditors, banks, insurance companies, tenants and owners, as well as our group companies, provided that there is a legal basis under data protection law.
Your data is processed in customer databases of BayWa AG and its subsidiaries, including BayWa r.e. AG. These customer databases support the enhancement of the data quality of the existing customer data (duplicate cleansing, address correction) and enable the enrichment with data from public sources. This data is made available to the Group companies of BayWa AG that participate in the BayWa customer database (participating companies) and can be used for personalized direct marketing campaigns (e.g., newsletters), for targeted online marketing and personalized online shop design.
The maintenance of master data in the BayWa customer database is the joint responsibility of BayWa AG and the participating companies. The parties shall contractually determine the allocation of data protection obligations within the scope of this data processing. BayWa AG and BayWa r.e. undertake in equal measure to inform the data subjects about the data processing and to support them in realizing their rights.
You can object to the storage of your personal data at any time. Your personal master data will then be deleted from the BayWa customer database. To exercise your right to object, please contact:
data-protection-officer(at)baywa-re.com.
Participating companies that serve the same customers should be able to use information about these customers across organizations. This approach aims to provide customers with the most up-to-date and relevant information at all times.
An overview of the BayWa AG Group companies can be found under the following links:
https://www.baywa.com/en/about/at-a-glance
https://www.baywa.com/en/data-privacy-policy
If there is a legal obligation and in the context of legal proceedings, authorities and courts as well as external auditors may also receive your data.
In addition, insurance companies, banks, credit agencies and service providers may also receive your data for the purpose of entering into and fulfilling contracts and in case of the sale of projects also investors.
5. How long is my data stored?
We store your data for as long as is necessary to fulfil the purposes described in this privacy policy. Provided there are no legal retention periods to the contrary, we will delete your data once the purpose has been achieved.
For example, we process your data until the business relationship ends or the applicable guarantee, warranty, statute of limitations and statutory retention periods (e.g., from the German Commercial Code or the German Fiscal Code). The latter can be up to eight years. In addition, we may store the data until the legally binding conclusion of legal disputes in which the data is required as evidence.
6. Is personal data transferred to a third country?
We generally process your data within the borders of the European Economic Area. In addition to the EU member states, this includes Iceland, Liechtenstein and Norway. The EU GDPR refers to countries that do not belong to the European Economic Area as third countries.
Data is transferred to a third country in individual cases and only on the basis of an adequacy decision by the European Commission, standard contractual clauses, suitable guarantees or your express consent. The standard contractual clauses and an overview of the adequacy decisions can be found under the following links.
https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj
7. Processing of personal data for advertising purposes
We also use your data to communicate with you about your orders, certain products or marketing campaigns and to recommend products or services that might be of interest to you.
Product recommendations by email
Pursuant to the legal requirements of Section 7 para. 3 Act Against Unfair Competition, BayWa r.e. BayWa r.e. is entitled to use the email address you provided to us when ordering a product or service for the purpose of directly advertising its own similar goods or services. You will receive these product recommendations from us, regardless of whether or not you have subscribed to a newsletter.
The legal basis for the processing of your personal data is Art. 6 (1) (f). GDPR. Our legitimate interest lies in marketing our products and services to our existing customers. If you no longer wish to receive product recommendations from us by e-mail, you can object to the use of your email address for this purpose at any time without incurring any costs other than the data transmission costs. To do so, please contact the party named under no. 1. Of course, every email always includes an unsubscribe link.
Newsletter
We use the so-called double opt-in procedure for sending the newsletter, i.e. we will only email you our newsletter if you have expressly confirmed to us beforehand that we should activate the newsletter service. We will then send you a notification email and ask you to reconfirm that you would like to receive our newsletter by clicking on a link contained inside.
The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. If you subsequently decide you no longer wish to receive newsletters from us, you can revoke your consent at any time without incurring any costs, other than the data transmission costs at your standard rate. Written notification to the party named under no. 1 will suffice in this case. Of course, you will also find an unsubscribe link in every newsletter.
8. Processing of personal data related to credit ratings
The legal basis for the processing of creditworthiness information is Art. 6 (1) (f) GDPR. Our legitimate interest in commissioning agencies lies in ensuring the creditworthiness of our contractual partners.
Further legal bases in addition to the above-mentioned legitimate interest are the fulfilment of a contract or the implementation of pre-contractual measures within the meaning of Art. 6 (1) (b) and the fulfilment of legal obligations pursuant to Art. 6 (1) (c) to carry out creditworthiness checks of customers (§ 505a and § 506 of the German Civil Code).
Transmission of data to SCHUFA
BayWa r.e. transmits personal data collected in the context of contractual relationships entered into with you regarding the application for, execution and termination of such business relationships as well as data on non-contractual behavior or fraudulent behavior to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden.
SCHUFA processes the data received and also uses it for the purpose of profiling (scoring) in order to provide its contractual partners in the European Economic Area and Switzerland and, if applicable, other third countries (provided that an adequacy decision of the European Commission exists for these) with information, among other things, to assess the creditworthiness of natural persons. Further information on SCHUFA's activities can be found in the SCHUFA information sheet in accordance with Art. 14 GDPR or online at www.schufa.de/datenschutz.
Data transmission to other credit agencies
BayWa r.e. also uses the following credit agencies to obtain credit information when a legitimate interest exists:
Bisnode Deutschland GmbH, Robert-Bosch-Straße 11, 64293 Darmstadt, Germany
Coface Central Europe Holding AG, Stubenring 24, A-1010 Vienna
CRIF Bürgel GmbH, Radlkoferstraße 2, 81373 Munich
Creditreform, Machtlfinger Straße 13, 81302 Munich
EOS Deutschland GmbH, Gottlieb-Daimler-Ring 7-9, 74906 Bad Rappenau.
9. Processing of applicant data
When you send your application to the job portal, we store your personal data in a secure operating environment to protect it from loss or misuse. The respective subsidiary of BayWa r.e. Group to which you apply within our applicant management system is responsible for the processing of your data.
The contact details of this company result from the job advertisement in BayWa r.e. job portal.
9.1. Which data is processed?
As part of the application process, we process the following categories of personal data in particular:
Master data (e.g. name, date of birth, nationality, place of residence)
Documents (e.g. certificates, attestations, curriculum vitae)
Educational history (e.g. data on (higher) school education, professional qualification)
Billing data (e.g. bank details for the reimbursement of application costs)
Communication data (e.g. e-mail, telephone)
Log data generated during the use of IT systems
Other personal data that you submit as part of the application process
In individual cases, the processed data can also include special categories of personal data in accordance with Article 9 (1) of the GDPR, such as data on health (e.g. in the case of severe disability) or religious affiliation (e.g. for tax reasons), if you provide us with this information as part of your application.
9.2. For what purposes and on what legal basis is my data processed?
The data processing serves to carry out the application procedure, to initiate and establish an employment relationship with the BayWa r.e. Group company to which you have applied.
The legal basis for the implementation of the application process is Art. 6 (1) (b) GDPR in conjunction with the relevant national regulation for the implementation of pre-contractual measures to establish an employment relationship.
Insofar as special categories of personal data are processed, this is done on the basis of Art. 9 (2) (b) GDPR. If the job to which you have applied requires processing of health data to assess your ability to work, this is done on the basis of Art. 9 (2) (h) GDPR in conjunction with the relevant national regulations.
9.3 How does the application process work?
You can apply directly for a job advert published in our BayWa r.e. job portal by entering your data in the application form for the advertised position. In addition to manual entry, you have the option of transferring certain master data from your XING or LinkedIn profile as well as by using "CV Parsing" in the application form.
We will keep you informed of the processing status of your application by email. As part of the application process, we may ask you whether we may forward your application documents to other vacancies within the BayWa r.e. Group that match your profile or include them in our applicant pool.
If you have sent us an unsolicited application via the BayWa r.e. job portal, we may ask you whether we may forward your application documents to vacancies within the BayWa r.e. Group that match your profile. If there is no position that matches your qualifications or wishes at the time of application, we may include you in our applicant pool. However, this will only take place with your express consent. The legal basis for this data processing is Art. 6 (1) (a) GDPR.
Applications in paper form or by e-mail will not be accepted with reference to the application process via our BayWa r.e. job portal. The data will not be transferred to the applicant management system. Therefore, applications in paper form will be disposed of immediately in accordance with data protection regulations; applications by e-mail will be deleted immediately. An exception to this is the receipt of an application in paper form or by e-mail due to a special occasion (e.g. meeting at a trade fair). Your data will then be imported into the applicant management system. The process described above also applies to applications of this type.
9.4. Who receives my data?
Within the BayWa r.e. Group company to which the application is made, only the persons responsible for this and the departments involved in the application process (e.g. superiors, HR department, specialist department, employee representatives) will have access to your personal data for the above-mentioned purposes. If the persons involved in the application process belong to another company of the BayWa r.e. Group, your data may be transferred to the respective persons in individual cases.
We use service providers to fulfill our contractual and legal obligations. We have concluded the contracts required by data protection law with these service providers, provided they process personal data on our behalf. For applicant management, we use a software solution from rexx systems GmbH, Süderstraße 75-79, 20097 Hamburg and Workday Limited, The Kings Building, Mary Lane, Dublin 7, Ireland, which act as a processor on our behalf.
9.5. Are personal data transferred to a third country?
When applying to a BayWa r.e. subsidiary outside the European Economic Area (EEA) data are transmitted on the basis of Art. 49 (1) (b) GDPR, unless there are no other appropriate data protection safeguards.
The data centers for the applicant platforms of rexx systems GmbH and Workday Limited used by us are located in the EEA.
9.6. How long will my data be stored?
If your application does not lead to the conclusion of an employment contract, we will store the data you have sent us in connection with your application for a period of six (6) months after you have received the rejection from us. If an employment contract is concluded with you, your data will be further processed by our personnel administration department. The data will then be stored for the duration of the employment relationship and for a period of up to 30 years after you leave the company. The period of 30 years is based on the long limitation periods for payments to social security institutions in accordance with § 25 (1) sentence 2 SGB IV and claims to benefits from the company pension scheme in accordance with § 18a BetrAVG.
9.7 Application pool
If you receive a rejection from us for a position for which you have applied, we may include your application documents in our application pool with your consent (Art. 6 (1) (a) GDPR). In this case, we will store your application data for a period of 12 months.
During the period in which your application data is stored in our application pool, we can suggest job vacancies at one of the BayWa r.e. companies. If you wish to apply for one of these positions and you inform us of this, we will forward your application data to the respective company. If you are hired by this company, its personnel administration will continue to process your personal data as part of the employment relationship (see 9.4 above). If you are not hired or if you decline employment, the BayWa r.e. company that received your application data from the application pool will also store your data for the six (6) months mentioned above. In addition, your data will be transferred back to our applicant pool. In any case, your data will be deleted from the application pool 12 months after inclusion in the application pool.
You can revoke your consent to the storage of your data in our application pool at any time. The deletion periods of the respective application procedures will then apply.
10. Diagnosis, correction and optimisation with Sentry
10.1. Scope and purpose of processing
We use the Sentry software from Functional Software, Inc, 1501 Mariposa St #408, San Francisco, CA 94107, USA, to improve the technical stability of our services on our website by monitoring system stability and detecting code errors. The software runs exclusively on German servers provided by Hetzner Online GmbH.
10.2. Type of data
In the event that errors are detected, the following data can be transmitted and processed:
IP address (only for technical transmission of the error)
Type of browser / version of the browser
Operating system / version of the operating system
Stack trace of the error (where and how the error occurred)
Possibly text from contact form (in case of an error in the contact form)
The data will not be passed on to third parties. BayWa r.e. does not analyze data for advertising purposes.
10.3. Legal basis for the processing of personal data
The legal basis for the processing of users’ personal data is Article 6 (1) (f) of the GDPR (legitimate interest of the controller). Our legitimate interest lies in improving the technical stability of our services on our website by monitoring system stability and identifying code errors.
10.4. Storage duration
The following personal data is deleted immediately after transmission, as it is only used for transmission between the server and client:
IP address
The following data will be stored for the above-mentioned purpose for 90 days and then irrevocably deleted:
Type of browser / version of the browser
Operating system / version of the operating system
Stack trace of the error
Text from the contact form
10.5. Option of making an objection
Because we do not store your IP address, we can no longer assign the stored data to your person and therefore always store anonymous data. A right of cancellation therefore only exists if we have stored personal data in connection with the content of an incorrect contact form in individual cases. To exercise your right to object, please contact: data-protection-officer(at)baywa-re.com.
11. Contact form
11.1. Scope and purpose of processing
You can contact us using the form provided on our website. The personal data collected from the input screen will be used exclusively for processing the conversation.
11.2. Type of data
The following data is transmitted when a message is sent:
Subject
Title
Name
Company (optional)
Address (optional)
Email address
Phone number (optional)
IP address
Time and date of contact
Personal data voluntarily provided in the message
11.3. Legal basis for the processing of personal data
The legal basis for the processing of personal data gathered from the contact form is Art. 6 (1) (f) GDPR. Our legitimate interest is the appropriate response to contact requests. If the contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR applies.
11.4. Storage duration
The personal data will be deleted when the conversation with the user has ended. This is the case when it is clear from the circumstances that the matter in question has been conclusively clarified.
11.5 Option of making an objection
You can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. To exercise your right to object, please contact: data-protection-officer(at)baywa-re.com.
All personal data stored when you contact us will then be deleted.
12. Communication by email
Please note that transmission of unencrypted emails should be regarded as unsafe, since unauthorized persons may note the content of the email and manipulate it under certain circumstances. Accordingly, we request that you refrain from sending sensitive data by email when communicating with us. As an applicant, please use our applicant portal, since your application documents are transmitted there securely. Should it ever be necessary to send sensitive data by email, please use a content encryption service.
In order to protect our employees and our IT systems, all incoming emails are screened for anomalies and malicious patterns by the service of the provider Cloudflare, Inc. Cloudflare works on our behalf. All services are provided via data centers within the EEA.
13. What information is collected when you visit this website?
We process a range of data when you visit our website through its use. Details can be found in the cookie policy, which you can access via the consent management banner. The cookie consent manager is displayed when you first access the website and can be opened at any time thereafter using the button in the bottom left-hand corner.
14. What data protection rights do I have?
You have a right to information about or the correction, deletion or restriction of the processing of your stored data, a right to object to the processing as well as transfer the relevant data and to file a complaint in accordance with the requirements of data protection law.
Right to information
You can request information from us concerning whether and to what extent we process your data. You also have the right to request a copy of your personal data.
Right to correction
If we process your data in a way that is incomplete or incorrect, you can request that we correct or complete it at any time.
Right to deletion
You can request that we delete your data if the processing purpose for which we originally collected the data no longer applies. Please note that there may be reasons that prevent immediate deletion, e.g. in the case of statutory retention obligations.
Irrespective of whether or not you exercise your right to deletion, we will delete your data immediately and completely, provided this is unhindered by any legal transaction or legal retention period to the contrary.
Right to limitation of processing
You may request that we restrict the processing of your data if:
You dispute the accuracy of the data for a period of time that allows us to verify the accuracy of the data,
The processing of the data is unlawful, but you reject the option of deletion and instead request a restriction on its use,
We no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or
You have lodged an objection to the processing of the data.
Right to data portability
You may require that we provide you with the data you have given to us in a structured, commonly used and machine-readable format and to allow you to pass this data to another person in charge without our interference, provided that
We process this data on the basis of irrevocable consent granted on your part and or to fulfil a contract between us, and
This processing is carried out using automated If technically feasible, you can ask that we transfer your data directly to another person responsible.
Right to object
If we process your data for legitimate reasons, you can object to this data processing at any time for reasons arising from your particular situation; this also applies to profiling based on Art. 6 para. 1 lit. e and f GDPR. We will then refrain from any further processing of your data unless we can prove compelling reasons worth protecting for the processing that outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.
Right to lodge a complaint
If you believe that we are violating German or European data protection law when processing your data, please contact us to clarify any questions. Of course, you are also entitled to contact any supervisory authority directly. The responsible authority for BayWa r.e. AG is the Bavarian State Office for Data Protection Supervision.
If you wish to assert any of the aforementioned rights against us, please contact us as outline under no. 1. In case of any doubt, we may request additional information to confirm your identity.