Otto
Verified“German family dynasty, American cloud underneath.”
- Ownership
- Family-owned
- otto.de GMV
- EUR 7.0bn
- Active customers
- 12.2M
- Core infra
- AWS (US)
77 = midpoint of Control 96 & Data 58
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 14 sourced facts across 9 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
95
otto.de is operated by Otto GmbH & Co. KGaA, incorporated and headquartered in Hamburg, Germany (HRB 188101, AG Hamburg). Fully EU-domiciled, EU-operated and directly within reach of German/EU law. No foreign parent. As of 1 March 2025 the former Otto (GmbH & Co KG) was merged into the KGaA, a German hybrid form built for family businesses.
Why 95? 3 sourced facts · click to expand
Operating entity / data controller for otto.de
otto.de Impressum · as of 2026-06-12
Commercial register & VAT
NorthData / otto.de Impressum · as of 2026-06-12
Legal form realigned to KGaA effective 1 March 2025
Otto Group press release · as of 2025-03-01
Control & Ownership
96
Privately held family business with no public listing and no foreign capital. The Michael Otto Foundation holds the majority of Otto KGaA; voting and corporate leadership stay with the Otto family (Benjamin Otto chairing the Board of Trustees and Shareholders' Council as part of the generational handover, fully effective 1 March 2026). General partner is Verwaltungsgesellschaft Otto mbH, Hamburg. Both voting control and economic majority sit in Germany.
Why 96? 4 sourced facts · click to expand
Majority shareholder
Otto Group press release (legal form change) · as of 2024-11-12
Family retains corporate leadership / voting control
Otto Group press release · as of 2024-11-12
General partner of the KGaA
Otto Group press release footer / Impressum · as of 2026-06-12
No stock-market listing (privately held)
Wikipedia (Otto Group) · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
32
OTTO migrated its customer-facing shop (the in-house 'Lhotse' platform behind otto.de) to AWS and runs 'several hundred' AWS accounts across product teams, by its own engineers' account relying 'primarily on AWS'. That places EU shopping data on a US hyperscaler exposed to the US CLOUD Act, regardless of which region it sits in (very likely AWS Frankfurt eu-central-1, but not publicly confirmed). OTTO encrypts data at rest and in transit. Separately, the privacy policy discloses data transfers to the USA via advertising/analytics partners (Google, Meta, Microsoft, TikTok, etc.). EU-region-on-US-hyperscaler band; nudged up for likely EU residency and encryption.
Why 32? 4 sourced facts · click to expand
otto.de shop platform runs on AWS
OTTO Tech Blog - cloud strategy · as of 2018-12-03
Scale of AWS footprint
OTTO Tech Blog · as of 2018-12-03
Data transfers to the USA via partners (ads/analytics)
otto.de Datenschutz (privacy policy) · as of 2026-06-12
Operations & People
97
Headquartered in Hamburg with a German management board led by CEO Petra Scharner-Wolff; reports in euros; workforce concentrated in Germany and the rest of Europe. Operationally a German company in every meaningful sense.
Why 97? 3 sourced facts · click to expand
Headquarters & management board
otto.de Impressum · as of 2026-06-12
Group workforce & reporting currency
Otto Group Annual Report 2024/25 · as of 2025-02-28
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Which AWS region(s) host otto.de production data — Frankfurt (eu-central-1) only, or others?
If data sits in EU regions the residency story improves materially, but CLOUD Act exposure to a US provider remains regardless of region.
- ?
Has OTTO adopted AWS European Sovereign Cloud or any sovereignty controls since the 2018 migration?
Would meaningfully raise the infra score; current evidence predates the European Sovereign Cloud offering.
- ?
Exact equity split between the Michael Otto Foundation, family members and any non-family limited shareholders post-KGaA conversion.
Confirms whether economic majority is 100% family or partially diluted under the new KGaA share structure.
EU Cloud Sovereignty Framework lens
SEAL was designed to assess cloud service providers; applied here as an analogous jurisdictional mapping for an e-commerce operator, not a certification.
Strategic
Privately owned German family business; strategic control firmly with the Otto family and its foundation, no foreign investor leverage.
Legal & jurisdictional
Incorporated and operated as Otto GmbH & Co. KGaA in Hamburg; fully within German/EU jurisdiction and enforcement.
Data & AI
Customer shop runs on AWS (US hyperscaler) and the privacy policy discloses US data transfers to ad/analytics partners — CLOUD Act exposure.
Operational
HQ Hamburg, German management board, EUR reporting, workforce concentrated in Germany and Europe.
Supply chain
Retail/logistics supply chains are global by nature; not separately audited here for sovereignty exposure.
Technological
Heavy, self-described 'primarily AWS' dependency for the core platform; deliberate vendor lock-in accepted for cloud-native benefits.
Security & compliance
Encrypts data at rest and in transit and operates under GDPR; specific certifications (ISO 27001, C5) not verified in this pass.
Environmental sustainability
Otto Group publishes sustainability commitments, but no sovereignty-relevant environmental metric was verified here.
EU alternatives
Berlin-headquartered EU fashion marketplace, but publicly listed (Frankfurt) with international institutional ownership and also reliant on major cloud providers.
German fashion platform majority-acquired by Zalando in 2025; EU-rooted but consolidating into a listed parent and cloud-hosted.
On ownership and jurisdiction, OTTO is already among the strongest EU options for a large online marketplace; the gap is infrastructure, not control.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology