Responsible for data processing:

ALDI International Services SE & Co. oHG, Mintarder Str. 36-40, 48481 Mülheim an der Ruhr

Data protection officer: Kay-Torsten Schuy - datenschutz@aldi-sued.de

The following types of data are processed:

• Data for resolving IT security vulnerabilities:
  • Report title (e.g. “SQL injection allows access to other customer’s data”)
  • Systems affected (e.g. “aldi-sued.de”)
  • Steps to reproduce
  • Severity (CVSS score)
  • Attachments (e.g. exploit code)
  • E-mail (can be provided voluntarily for follow-up-questions)
• Data for Hall of Fame:

  All following data is non-mandatory to report IT security vulnerabilities. If consented to, this information will be published on our webpage:

  • Name (can be only first name or first- and last name) or alias (nick name)
  • Personal URL (e.g. LinkedIn profile)

  If you want your "Hall of Fame" information changed or deleted, please directly contact us.

• Log files:

  Each time you access or attempt to access our website, at least the following data is collected and stored in a log file:

  • IP address
  • Name of the file retrieved
  • Date and time of retrieval
  • Transferred data volume
  • Notification as to whether data retrieval was successful
  • Notification as to why the data retrieval failed, if applicable
  • Operating system and browser software installed on your computer
  • Screen resolution
  • Browser language
  • Colour depth
  • Browser plug-ins (JavaScript, Flash Player, Java, Silverlight, Adobe Acrobat Reader, etc.)
  • Website from which you visit us

  The processing is based on Article 6 para. 1 lit. f GDPR in order to provide our website, guarantee the stability of our systems, ensure data protection and the reliability of our systems, and implement legal provisions. The data will be erased after thirty days.

The data is processed for the following purpose(s):

• The main purpose of the VDP (Vulnerability Disclosure Policy) is to ultimately fix IT security vulnerabilities, which were reported by external security researchers acting in good faith. If a researcher provided contact details, we will solely use it for the purpose of resolving the reported security vulnerabilities.
• Vulnerabilities can be reported without providing any personal information. Only if actively agreed to be added to our “Hall of Fame” https://security.aldi-sued.com/hall-of-fame, we would manually add the provided details (e.g. researcher name and URL) to show the security researcher’s contribution to improve ALDI’s security.

The legal basis for processing data is Art. 6 para. 1 lit. f) GDPR (processing is necessary for the pur-poses of the legitimate interests pursued by the controller).

The data is retrieved from the following source(s): https://security.aldi-sued.com/ (vulnerability reporting and contact forms).

In case a vulnerability is reported which refers to a webpage/application controlled by another ALDI SOUTH entity, your provided information including your contact details may be forwarded to that respective entity, including entities outside of the EEA. We will use the provided personal data exclusively for the purpose of processing and resolving your reported vulnerability.

ALDI SOUTH commissions third-party service providers in order to support us in providing our technological infrastructure, designing our websites and offering our services. These service providers may be granted access to your personal data in this context. These service providers are obliged by contract to only process data as instructed by ALDI SOUTH and to take all measures necessary to ensure an appropriate level of data protection and data security.

Recipients can be outside of the European Union if a vulnerability report requires it.

Data is only processed in states outside the European Union and/or the European Economic Area if the EU Commission has decided that this country offers an appropriate level of data protection or if the processor has committed to ensuring an appropriate level of data protection by concluding Standard Contractual Clauses, among other things.

Your data will be stored and processed for the following period:

• Reported vulnerability data will be stored for up to ten years in internal systems.
• "Hall of Fame" contributions will be there for unlimited time. "Hall of Fame" information can be removed after a request with proof of identity.

You are not obliged to provide any personal data. Also, the amount of provided personal information is up to the reporter (e.g. only an e-mail address OR only a nick name could be provided). Vulnerabilities can be submitted anonymously without providing any personal data.

Automated decision-making is not applied.

Provided that the necessary requirements as stipulated by Article 15 et seq. GDPR are met, you are entitled to exercise your rights of access, rectification, erasure, restriction of processing and data portability at any time.

• Right of access to the personal data stored concerning yourself (Art. 15 GDPR)
• Right to rectification of inaccurate personal data concerning yourself and, if applicable, completion of incomplete personal data (Art. 16 GDPR)
• Right to erasure if one of the grounds specified in Art. 17 GDPR applies
• Right to restriction of processing if one of the grounds specified in Art. 18 GDPR applies
• Right to data portability under Art. 20 GDPR
• Right to object on grounds relating to your particular situation (Art. 21 para. 1 GDPR)
• Right to lodge a complaint with the competent supervisory authority. The competent supervisory authority is: Landesbeauftragte für Datenschutz und Informationsfrei-heit Nordrhein-Westfalen (North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW) ), PO box 20 04 44, 40102 Düsseldorf, Tel.: 0211/38424-0, e-mail: poststelle@ldi.nrw.de