Privacy Policy

Privacy Policy of BRITA SE

In this Privacy Policy, BRITA SE, Heinz-Hankammer-Straße 1, 65232 Taunusstein, Germany (“we”, “us”, “BRITA SE”) wishes to inform you about how we process your personal data when you visit our websites, use our online shop and/or our BRITA app (“app”).

The purpose of this policy is to clearly state how BRITA SE intends to meet its obligations under relevant data protection laws, including, to the extent applicable, the Australian Privacy Principles (“APPs”) as set out in the Privacy Act 1988 (Cth) (“Privacy Act”) and the European Union (EU) General Data Protection Regulation (“GDPR”). 

Our Privacy Policy details the sort of information BRITA SE may collect about you, how BRITA SE manages, uses and discloses your personal data, sets out some of your privacy rights in relation to personal data and advises how you can contact us with privacy queries.  
By accessing, browsing or using any website or app owned and/or operated by BRITA SE or otherwise providing your information to us, you acknowledge that you have read, understood and agree to be bound by this Privacy Policy. 

 

1. What personal data do we collect from you?

Personal data is any information about a specific or identifiable natural person that you communicate to us and that is generated or collected by us. 
This includes:

• Registration data: You can register your product with us. When you open an online customer account with us, you can permanently store your name, postal address, email address, telephone/mobile number (optional) and country there.
• Other content data: When you use other services or functions on our website or app, such as when using forms, competitions or when you register to receive newsletters, content data entered by you and about you is processed, together with the information you provide.
• Usage data: We set up usage profiles about your use of our website using a pseudonym, which we use to track how our website is used. In addition, your click behaviour when you receive newsletters is evaluated and stored in user profiles; this data is not combined with the pseudonymised usage profiles described in the sentence above or with your customer account.
• Health data: As part of our smart products, you may voluntarily provide certain health data in the app so the product can be personalised and all functionalities can be used. When such data is requested, we will inform you and obtain your consent. You can of course use our products without providing this data.
• Server log data: When you use our websites, data (such as the date and time of your visit, the pages visited and data files requested, the type and version of the web browser you use, the type and operating system of the end device you use as well as your IP address) is temporarily saved in a protocol file.
•  Device data: When using our app, we collect certain device data (e.g., bottle ID) to ensure the functionality of the application.

 

2. How do we collect personal data?

We collect personal data from you in a variety of ways, being when you knowingly provide it to us, such as through our website, BRITA app, via email correspondence, when you enter competitions, when you purchase goods or services, when you subscribe to mailing lists or other services, or otherwise as allowable under law.  
While we endeavour to only collect personal data from you directly, we may also collect data from the following sources that you may be unaware of including:

• third parties (such as agencies on our behalf or our commercial partners);
• public directories and listings;
• personal interactions with BRITA SE employees; and
• electronic information from email or the Internet.

 

3. For what purpose, on what legal basis and how long do we process your personal data?

BRITA SE will generally only use and disclose your personal data if the disclosure is necessary to answer your enquiry or request, to supply you with goods and/or services requested, or to complete the services we provide.

When we collect personal data from you, we will use it for the reasons we collected it and for other reasonable business purposes, which include but are not limited to, the following purposes outlined below in this section.

We will only use sensitive data (including health data) we hold about you for the primary purpose for which it was collected or for a purpose directly related to the primary purpose, and where you would reasonably expect us to use or disclose it for that purpose. 
We have outlined the relevant rights associated with each purpose which are available to our customers that subject to the GDPR. For more information on the rights available to customers that are subject to the Privacy Act, see section 8 below. 

3.1.    Product registration / Customer account

If you register the product you have purchased, then we collect and use your data in order to record the benefits granted to you with product registration (e.g. extended guarantee, shipment of spare parts, product-related information based on your consent). 
When you also register for a personal customer account, we process the registration data to set up and manage your customer account and to process future orders. As a registered customer you have access to your personal online customer account (via your email address and a password chosen by you) in which you can view your order history as well as store and amend your personal settings (e.g. setting for the password, newsletter, billing and delivery).

The legal basis for the processing of data described above is our legitimate interest under Art. 6, para. 1 (f) of the GDPR to provide the service “Product registration” described above or “Customer account” for you, or perform a user contract with you (Art. 6, para. 1 (b) of the GDPR).

If processing is objected, we may then demonstrate compelling legitimate grounds for the processing or outline the possible adverse consequences in order to continue it. We will not do so for the use of a customer account, however, and the customer account will then be deleted and no longer be available to you.

This data is also deleted if the registration on our website is cancelled or modified, or if the customer account is terminated. If it is not possible to delete it for legal reasons, the data concerned is then blocked instead. 

3.2.    Your enquiries

When you contact us with an enquiry using a contact form, by email or a service telephone, we process the information you provided therein to answer your enquiry and, when you use the online contact form the IP address and date/time of the enquiry, to prevent the misuse of the contact form.

The legal basis for processing is our legitimate interest under Art. 6, para. 1 (f) of the GDPR to provide you with the “Enquiries” service described above. If the intention of your enquiry is to initiate or process a contract (including customer service and warranties), the additional legal basis for processing is Art. 6, para. 1 (b) of the GDPR.

If processing is objected, we may then demonstrate compelling legitimate grounds for the processing or outline the possible adverse consequences in order to continue it. If there are no such compelling legitimate grounds, then we will cease communication with you and delete any data already collected.

This data is deleted when our communication with you ends, i.e. the relevant facts have been clarified and there are no further legitimate interests for storing the data, or there are no further statutory obligations to store it.

3.3.    Your BRITA app

If you register in the app, we process registration data to set up and manage your myBRITA account and link it with your smart product. We also process this data to provide our services to you which include, but are not limited to: 

• In-app functions (e.g., personalized address, drinking reminders)
• Product management (e.g., filter change reminders)
• Connection data between product and app (e.g., device ID, Bluetooth

We will also use this data to inform you about important app functions, provide essential service messages (e.g., error messages, security warnings, firmware updates), and if activated, send reminders and account notifications. 
The legal basis for processing is our legitimate interest under Art. 6, para. 1(f); performance of contract under Art. 6, para. (1)(b); and or consent under Art. 6, para. 1(a) of the GDPR.
If processing is objected or consent is withdrawn (such as by deregistering, withdrawing or terminating your account, or due to inactivity for a period of 2 years), your account and/or data will be deleted, as applicable.  

3.3.1.     Health data via third party health apps

If you grant the app access to third party health apps available on your device (such as but not limited to Apple Health or Samsung Health), we process only the health information you approve (e.g., age, gender, weight, water intake). The data is used solely to calculate hydration goals and track fluid intake and is not shared without your explicit consent.
The legal basis for processing is consent under Art. 6, para. 1(a) of the GDPR.
You can manage this access via your device’s settings for the relevant third party health app.

Data we have obtained as described in this section is deleted upon withdrawal, deregistration, or account termination (or after 2 years of inactivity).

3.4.    Taking part in competitions

If you enter one of our competitions, then we use your details in order to carry out the competition, including but not limited to, informing entrants about a win and, where applicable, send a prize.

The legal basis for processing is your consent which is deemed given when entering the competition (Art. 6, para. 1 (a) of the GDPR). Your data is deleted when the respective competition ends and the prizes are distributed. Any further use of your data for other purposes, e.g. advertising only occurs if you have given your explicit consent for this.

3.5.    Advertising and product development (usage data, newsletters etc.)

We would also like to use your personal data and/or any anonymous statistical information created from it in order to inform you about our products and services with regard to water dispensers, water filters and accessories (“BRITA Products and Services”), and to send you offers and special promotions (advertising), or to improve our offers and services (product improvements, customer analyses). 

3.5.1.     Anonymised usage data

Here we use anonymised or aggregated data obtained using analytical tools to track the surfing behaviour of every visitor and thereby improve the design of our website and our range of products in general. You can find details about these analytical tools in section 5.

3.5.2.    Direct marketing

You can subscribe to a free newsletter on our website. Here the data collected at registration is processed (the data shown as compulsory fields is absolutely essential to receive the newsletters; data identified as voluntary is only used to make contact with you more personal and for the selection of the information displayed).

• We will contact you by email or messenger service with information, offers and beneficial promotions for BRITA products and services customised to you personally and your interests or use based on your respective express consent, or – if you buy similar items or services from us and store your email address in so doing – also without any separate consent.
• We will only contact you by telephone with information, offers and beneficial promotions for BRITA products and services customised to you personally and your interests or use with your explicit consent. We also inform our professional consumers (BRITA professionals) by phone about our BRITA products and services if we can legitimately presume their consent to this.
• We will also contact you by written advertising sent by post without consent where necessary in the extent permissible by law for our services.
  Objections to processing described in this section should be made using the relevant functions provided for you (e.g. the unsubscribe function in your personal customer account) or send a communication to that effect in writing (keyword: data protection) or by email to the contact addresses stated under section 9. 
  The legal basis for processing is consent (Art. 6, para. 1 (a) of the GDPR) and our legitimate interests (Art. 6, para. 1 (f) of the GDPR), where applicable in conjunction with Section 7, para. 3 of the Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG).

We will delete this data following your objection or the withdrawal of any consents given or otherwise no later than the end of its use, or we will only store it in aggregated, anonymised form. Where necessary, we will store the fact of your objection to prevent you from being contacted again.

3.6.    For the provision of the website and performance of the services

The processing of server log data is necessary for the provision of the websites and the performance of services for technical reasons and subsequently to ensure system security.
The legal basis for processing is our legitimate interest in providing the website with our services (Art. 6, para. 1 (f) of the GDPR). Processing is absolutely essential for the use of the website for technical reasons and subsequently to ensure system security; there is therefore no right of objection.

This data is deleted after no more than 30 days.

The server log data is subsequently analysed on an anonymous basis, where necessary for statistical purposes, and to improve the quality of our Internet presence. The server log data is not linked in any way to your personal data or with other sources of personal data.

4.    Sharing of data

4.1.    Sharing of data with data processing companies

We sometimes use service providers, subject to compliance with the statutory requirements, by means of commissioned processing, i.e. based on a contract on our behalf, according to our instructions and under our control.
In particular, data processing companies are

• technical service providers that we use to provide the website, e.g. service providers for software maintenance, data centre operations and hosting;
• technical service providers that we use to provide functionalities, e.g. technically essential cookies;
• service providers that carry out order processing for us;
• service providers for the practical implementation of advertising and marketing, e.g. call centres for telephone contact, printers and letter shops for shipment by post (also including the shipment of analytical test-strips for water hardness), service providers for sending emails.

In such cases, we remain responsible for the data processing; the sharing and processing of personal data to and from our data processing companies is based on the relevant legal basis and purpose  that permit us to process data. 

4.2.    Data transmission to third parties

Sometimes we also share your data with third parties outside commissioned processing including:

• where we have sought your consent or as is otherwise allowed or required by law; 
• to our related companies, contractors, suppliers or service providers for the purposes of providing products and services on our behalf and performing our administration and other operations, including accounting and finance checks, IT, marketing, record keeping and statistical purposes, market research, safety purposes, fulfilment services and/or website traffic analysis;
• to any entity to which we propose to assign any part of our business; or
• to other organisations with whom we have contractual agreements.

If any such third parties collect your information they will have their own obligations regarding treatment of your information, and processing of your data by these third parties is governed solely by their privacy policies. If you have any concerns about those parties you should liaise with them directly.

4.3.    Data transmission outside of Australia

Personal data which we collect and hold is stored within our locally housed data servers in Germany.  We utilise some cloud-based service providers for specific functions, such as email and accounts, who may store certain information on our behalf on servers based in Germany and the Netherlands. These service providers are engaged pursuant to terms of service requiring stringent privacy compliance in respect of this data.

Some of the companies we may disclose your personal to are located overseas, including Germany and The Netherlands. In all instances of overseas disclosure, we shall ensure that the transfer of your personal data is carried out in accordance with all applicable privacy and data protection laws.

Such measures may include (without limitation) transferring the data: (i) to a third party in a country that has been identified as providing adequate protection for EU data; or (ii) to a third party which has entered into standard contractual clauses adopted or approved by the European Commission.  Should you require more detailed information with regard to transferring your personal information outside the EU (e.g. the names of the recipients and the exact legal basis for any such transfer), please contact us on the contact details below.

We will not send your personal information outside of Australia unless: 

• It is necessary (including to provide the personal information to a third party) to provide our goods and/or services to you;
• You have provided your consent;  
• We believed on reasonable grounds that the organisation involved would only deal with your personal information in a similar manner to the requirements under the APPs or GDPR (as applicable); or  
• Where otherwise allowed by the Privacy Act or GDPR Act (as applicable).  

4.4.    Disclosure to Artificial Intelligence Platforms

We do not use or disclose personal data on public Artificial Intelligence (AI) platforms. We do not permit personal data to be used or disclosed on public Generative AI platforms.  We also do not use or disclose personal data for automated decision-making purposes. 

5.    Cookies and web analysis

Most browsers are set up so that they accept cookies as standard. You can, however, set up your browser so that it accepts only certain cookies or none at all. It should be noted, that not all functionalities of our website may work if cookies are deactivated on our website via your browser settings. Via your browser settings you can delete cookies already saved in your browser or display the length of time they are saved. Furthermore, it is also possible to set up your browser so that it notifies you before cookies are saved. Since different browsers can vary in their functions, we ask you to use the relevant help menu of your browser to review the various configuration options.

If you wish to have a comprehensive overview of all third-party access to your browser, we recommend that you install a specially-developed plug-in for this purpose.

5.1.    What are cookies

To make our website as user-friendly as possible and to increase the relevance of our advertising for visitors to our website, we and our partners use so-called “cookies”. Cookies are small data files that are placed on the visitor's device. They allow us to provide information over a certain period and identify the visitor's computer. This also takes place in part by using so-called tracking pixels that are not placed on a visitor's hard drive, but may be helpful in identifying the computer in the same way as with a cookie. The term “cookie” below includes both cookies in the technical sense as well as tracking pixels and similar technical methods.

If you are visiting our website for the first time, then the information on data protection is displayed on your start page with the text for consenting to cookies. By subsequently continuing with active use of the website and not objecting to the use of cookies, you consent to the use of cookies, and this consent is stored on your browser (in the form of a cookie) so that we do not have to show you this information again on every page. If this information does not appear in your browser (e.g. by you deleting the browser history), then this information is shown when you visit our website again.

5.2.    What cookies do we use?

On this website we use two categories of cookies: (i) Technically essential cookies, without which the functionality of our website would be limited, and (ii) optional analytical, security, targeting or advertising cookies that generally originate from third-party providers:

i)    Technically essential cookies

These cookies are essential to make it possible for you to navigate our websites and use their functions. For example, they store which products you have placed in your shopping basket or the progress of your order process, they enable you to look easily for dealers where you can buy our products (e.g. by showing a map of your surrounding area), or they store whether you agree to the use of cookies and your selection in the cookie settings. These cookies do not collect any information about you that is intended to be used for marketing purposes or that store where you have been on the Internet. These cookies are generally session-specific and expire at the end of your visit to the website (session), unless the respective function requires that they are stored for a longer period (e.g. storing the cookie setting). Deactivating this category of cookies would totally or partially restrict the functions of the website.

ii)    Analytical, security, targeting and advertising cookies

Analytical cookies collect information about how visitors use a website overall, for example which pages they access most often and whether they receive error messages from websites. These cookies do not collect data that could identify their visitors. Data collected with these cookies is not combined with other information about our visitors. All information collected with the help of these cookies is used exclusively to understand and improve the functionality and service on the website. For the analysis of our website we use Google Analytics, a web analysis service of Google Inc. The information about your use of this website generated by the use of Google Analytics is usually transferred to a Google server in the USA and stored there. If IP anonymisation is activated on this website, however, then your IP address is first abbreviated by Google within European Union member states or in other countries that are party to the Agreement on the European Economic Area. Google will use this information to analyse your use of the website in order to compile reports about website activities for the website operators and to provide further services associated with website and Internet usage. Google will also transfer this data to third parties where this is required by law or if third parties process this data on behalf of Google.

5.3.    Security cookies

In order to carefully ensure data security when transferring forms, in certain cases we use the reCAPTCHA service from the company Google Ireland Limited, Google Building, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

This serves primarily to differentiate between human entries, or improper usage by machines and automated processing - so-called bots. The service includes sending the IP address and, if necessary, other data necessary for Google to operate the reCAPTCHA service to Google. Your entries are transferred to Google and processed further there for this purpose. In this case, the different privacy policy of Google Inc. applies. For more information about Google Inc.’s data protection regulations please visit https://www.google.com/intl/de/policies/privacy/ (for German) or https://policies.google.com/privacy/embedded?hl=en-US (for English).

Targeting and advertising cookies are used to tailor advertising to you and your interests in a more targeted manner. They are used to limit how often you get to see the same advert, to measure the efficacy of an advertising campaign and to understand people's behaviour after they have seen an advert. These cookies are generally placed on their pages by advertising networks with the consent of the website operator (i.e. in this case ours). They recognise that a user has visited a website and pass this information on to others, e.g. advertising companies, or adapt their advertising themselves accordingly. They are often linked to a website function provided by that company. We therefore use these cookies to create a link to social networks. These can then reuse the information about your visit to customise the advertising on other websites specifically to you and provide the information about your visit to the advertising networks we use, so that the advertising that potentially really interests you can be presented to you later precisely based on your browsing behaviour. Even in these cases, we do not combine the data collected using these cookies with other information about our visitors.

Deactivating this category of cookies does not impair the functionalities of our website. We currently use this category of cookies from the providers below. You can find out more information about cookies and their descriptions from them and object to the use of cookies directly there:

• Tool: Google AdWords
  • Provider's data protection information: https://www.google.com/intl/en/policies/technologies/ads/
  • Option to object (Opt-out): https://goo.gl/8yAIki
• Tool: Google Analytics Remarketing
  • Provider's data protection information: https://www.google.com/intl/en/policies/technologies/ads/
  • Option to object (Opt-out): https://goo.gl/8yAIki
• Tool: Google Analytics
  • Provider's data protection information:
    https://support.google.com/analytics/answer/6004245?hl=en
  • Option to object (Opt-out): https://tools.google.com/dlpage/gaoptout?hl=en
• Tool: Facebook Advertisement Manager
  • Provider's data protection information: https://www.facebook.com/privacy/explanation
  • Option to object (Opt-out): https://www.facebook.com/help/568137493302217
• Tool: DoubleClick
  • Provider's data protection information: https://www.google.com/intl/en/policies/technologies/ads/
  • Option to object (Opt-out): https://goo.gl/8yAIki 
• Tool: Bing Ads
  • Provider's data protection information: https://advertise.bingads.microsoft.com/en-au/resources/policies/traffic-quality
  • Option to object (Opt-out): https://account.microsoft.com/privacy/ad-settings/
• Tool: LinkedIn Campaign Manager
  • Provider's data protection information: https://www.linkedin.com/legal/privacy-policy
  • Option to object (Opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• Tool: trbo
  • Provider´s data protection information: http://uk.trbo.com/data-privacy/
  • Option to object (Opt-out): https://track2.trbo.com/optout.php?redirect=https%3A%2F%2Fwww.trbo.com%2Fopt-out-english%2F
• Tool: TikTok Pixel
  • Providers data protection information: https://www.tiktok.com/legal/privacy-policy?lang=en 

If you would like to receive further information about these cookies from us instead, please contact us by email at: datapolicy@brita.net. 

5.4.    How do I deactivate Cookies?

You can totally deactivate the analytical, security, targeting and advertising cookies conveniently in our cookie settings. Alternatively, you can also deactivate individual cookies using the links in the table above (objection options). Finally, you can also prohibit the use of any cookies by adjusting the settings for cookies in your browser accordingly. Nonetheless, we would point out that in this case it would inhibit the functionality of our website if technically essential cookies are also blocked.

You can read further information about cookies and the individual providers, e.g. on the website www.youronlinechoices.com. You have the option there of objecting to usage-based online advertising by individual or by all tools. To go directly to the preference manager, please click on the button at the bottom on the left.

6.    Links

We use links to our other Internet presences on third-party websites and services, e.g. on social media channels such as Facebook, Twitter or YouTube. Once you have used these links to leave our website, you should note that we do not have any control over that other website.  Remember, this Privacy Policy is strictly limited to our collection, storage and use of personally identifiable data collected via the website or otherwise in the course of our business, and does not apply to any third parties. Therefore, we cannot be responsible for the protection and privacy of any data which you provide whilst visiting such websites and such websites are not governed by this Privacy Policy. 

7.    Security

We and our service providers take technical and organisational security precautions in order to safeguard your personal data managed by us against accidental or intentional manipulation, loss and destruction, or against access by unauthorised persons. Our data processing systems and security measures are constantly being improved to meet the latest technical developments.
When your personal data is transmitted to us, encryption takes place via a Secure Socket Layer (SSL). Personal data that is exchanged between you and us or another company of the BRITA Group is transmitted via encrypted connections that conform to the current state of technology.

Any information that we no longer use for the purposes contained in this policy is destroyed. The exception to this may be information required for possible data analysis at a future date, or information we are legally required or advised to hold for specific time periods.

We will endeavour to make reasonable efforts to ensure information is stored securely both in electronic and physical forms and to keep this information accurate, up to date, complete and relevant. We ensure only those necessary have access to your personal information.  Physical, electronic and managerial procedures have been put in place to reasonably secure any information collected from misuse, interference or loss, and in order to prevent unauthorised access, modification to or disclosure of that information.  
Of course, our employees and the service providers that we engage are committed to confidentiality.

8.    Your rights to information, rectification, blocking or deletion

In principle, every natural person whose personal data we process, including both Australian and GDPR data subjects, has the following rights in relation to us (i.e. depending on the relevant conditions):

• If you have any questions on the processing of your personal data by BRITA SE, we will be happy to provide you with information about personal data stored about you at any time free of charge (Art. 15 of the GDPR).
• You have a right to the rectification of incorrect data and to have incomplete data completed (Art. 16 of the GDPR).
• You have a right to the blocking / restriction of processing or to the deletion of your personal data that is no longer required or that is stored based on legal obligations (Art. 17, 18 of the GDPR).
• You have a right to the portability of your data in a structured, commonly used and machine-readable format, if you have provided the data to us based on a consent or a contract between you and us (Art. 20 GDPR).
• You have a right to object to the processing of your data for direct marketing at any time (cf. also section 2.5, Art. 21 para. 2 and 3 of the GDPR).
• You have a right to object due to processing based on a legitimate interest (Art. 21, para. 1 of the GDPR). We have referred above to when this right exists (see section 3).
• If you have given your consent to data processing, then you can withdraw this at any time with future effect, i.e. the lawfulness of the data processing remains unaffected up to the time of withdrawal. Once you have withdrawn your consent, you may not be able to use our services any longer.
  

Please contact the address stated below with your concerns. We reserve the right to verify your identity in order to prevent your personal data from being disclosed to unauthorised persons. 

You also have the right to submit a complaint to a supervisory authority for data protection.

Where the disclosure of information to you is restricted by law, is the subject of legal action, or may compromise the privacy of another person, we may be required to withhold your personal data, in which case we will provide reasons why we have refused your request.

9.    Privacy Concerns or Complaints

If you have any queries or concerns about your personal data, or would like to make a privacy or personal information related complaint, please contact our Data Protection Officer at the address below. We will investigate your complaint and aim to ensure that we contact you and that your complaint is resolved within a reasonable time or the time required by the applicable privacy and data protection laws. 

Herr Rechtsanwalt Dr. Karsten Kinast, LL.M.
KINAST Rechtsanwaltsgesellschaft mbH
Nordstraße 17a
D-50733 Köln
E-Mail: DSB-BRITA@kinast.eu
URL: www.kinast.eu

If we are unable to satisfactorily resolve your concerns or complaint, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or the local regulator in your jurisdiction in the Europe, as applicable.    

10.     Amendments

It is necessary to revise the content of this Privacy Policy from time to time. We therefore reserve the right to amend it at any time without notice. We will also publish the amended version of the Privacy Policy here. If you visit us again, you should therefore read through the Privacy Policy once more. 

All changes are effective from the date we post the revised Privacy Policy.  In particular, by continuing to use the website and/or app after the Privacy Policy has been varied or by otherwise providing your information to us, you agree to be bound by the variation.

Version dated 17 March 2026