1. Controller and Contact Details of the Data Protection Officer
Responsible for the processing is
(hereinafter referred to as the “Company”)
You can reach our data protection officer at
– Data protection officer –
2. Information on the Processing of Personal Data
2.1. Data categories
Within the framework of the application procedure, we process the following categories of personal data:
- Personal data (first and last name, date of birth, address, school-leaving certificate)
- Communication data (telephone number, mobile number, fax number, e-mail address)
- Data on assessment and evaluation in the application procedure
- Data on education (school, vocational training, civil/ military service, studies, doctorate)
- Data on previous professional career, training and work certificates
- Information on other qualifications (e.g. language skills, PC skills, voluntary work)
- Application photo
- Details of the desired salary
- Application history
- Social media links (link to Xing or LinkedIn profile, if data transfer from these profiles was selected)
- Data in connection with the establishment of the connection if you apply via our website (e.g. IP address)
- Identification data of the Internet browser used
Personal data that you provide us with in the context of your application will be stored and used exclusively for the purpose of processing your application and, if applicable, for the purpose of the subsequent employment relationship.
If your application has convinced us, but we cannot consider you for a vacancy, we would be pleased to store your documents in our talent pool. In this case, we will contact you and ask for your consent to be included in the Talent Pool. If you give your consent, we may contact you again if there are suitable job advertisements that match your profile.
You also have the option of agreeing to your application being forwarded to other companies within the Group. In such a case, we will also contact you and ask for your consent to forward your personal data to the competent offices of other companies for the purpose of initiating the application procedure in the respective companies.
2.3. Legal Basis for Data Processing
The processing of your personal data in the context of the application procedure takes place on the basis of Art. 6 para. 1 lit. b DSGVO (establishment and execution of a contract) as well as § 26 para. 1 sentence 1 BDSG.
The storage and processing of your data in the talent pool as well as the forwarding to other companies within the group of companies is based on your consent in accordance with Art. 6 Para. 1 lit. a DSGVO. You can revoke this consent at any time with effect for the future.
3. Transfer of Data
Your data will be made available to the responsible employees in the Human Resources Department and to the employees or managers of the department(s) responsible for the position for which you have applied. In the case of a speculative application, your documents will be made available to the relevant employees in the Human Resources department and to the relevant employees or superiors of the relevant departments for which your application might be of interest.
We do not forward your applicant data to affiliated subsidiaries or parent companies unless your application also relates to these companies or you have given us permission to do so.
We also use contract processors (e.g. IT service providers). Your data will be passed on to these companies in strict compliance with the obligation of secrecy and the requirements of the DSGVO. The processors commissioned by us may only process the data for us and not for their own purposes. The responsibility for data processing in these cases remains with us.
Data will also be passed on if we are obliged to do so by law and/or official or court orders.
4. Transfer of Personal Data to Third Countries
Our company is part of a group of companies in which personnel responsibilities can extend beyond national borders. For this reason, responsible superiors in the USA may also have access to your applicant data. This data processing is necessary to decide whether to establish an employment relationship.
The legal basis for any processing activities is your explicitly declared consent, which you have given via the cookie banner. Your consent justifies such data processing exceptionally on a case-by-case basis in accordance with Art. 49 para. 1 lit. a GDPR. Please note that the level of data protection in the USA is not comparable to that in the EU and EEA. In particular, it is possible that state authorities may access your personal data on the basis of legal authorizations without us or you being informed. There are no comparable possibilities for our own legal enforcement in the USA, so that this does not seem promising.
5. Storage Period for Applicant Data
If no employment relationship is established, the application documents will be deleted six months after our rejection. The legal basis for storage in this regard is Art. 6 para. 1 lit. f DSGVO. It is in our legal interest to defend ourselves against any claims arising from the General Equal Treatment Act (“AGG”).
6. Data Security
Our employees and the service companies commissioned by us are obliged to maintain secrecy and comply with the provisions of the applicable data protection laws. The company takes appropriate technical and organizational security measures to protect your personal data from loss, alteration, destruction and access by unauthorized persons or unauthorized disclosure. Our security measures are constantly improved in line with technological developments.
7. Rights of Data Subjects
Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restrict processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. In the case of the right of access and the right to erasure, the restrictions pursuant to Sec. 34 and 35 German Data Protection Act (BDSG) apply. In addition, there is a right of appeal to a competent data protection supervisory authority (Art. 77 GDPR in conjunction with Sec. 19 BDSG).
You can revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before 25 May 2018. Please note that the revocation is only effective for the future.
You also have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data relating to you, in particular on the basis of Art. 6 para. 1 letter f GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms. This includes in particular that the processing is necessary for the assertion, exercise or defence of legal claims.
Furthermore, you have the right according to Art. 22 GDPR not to be subject to a fully automated decision making process. As a matter of principle, we do not use any fully automated decision-making process to establish, implement or terminate the business relationship. Should we use these procedures in individual cases (e.g. to improve our products and services), we will inform you separately about this and about your rights in this regard, provided this is required by law.
8. Obligation to Provide Data
Within the scope of the application you must provide those personal contract data which are necessary for the application procedure or which we are legally obliged to collect. Without this data we are not able to carry out the application procedure.
The same applies to visiting our online offer and the collection of usage data. Without the collection of usage data, we and our service providers are not able to provide you with our online offer.
We do not automatically process your personal data in such a way that it has legal effect on you or in a similar way that it significantly affects you.