The information in this notice applies to the processing of personal data of all types of job applications and is intended to inform you in particular about the scope of the processing, the processing purposes, recipients, legal bases, storage periods and your rights.
“Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, for example, your name, address or e-mail address. “Processing" of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
I. Name and Address of the Controller
"Controller" means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
II. Data Protection Officer
Dr. Christian Rauda
Attorney and board-certified specialist for IT law
III. Purposes for which the personal data are to be processed and the legal basis for the processing
Your personal data will be processed for the purpose of personnel selection to fill open positions, i.e. to initiate an employment contract. The necessity and the scope of the data collection are assessed, among other things, according to the position to be filled. If your desired position involves the performance of particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements, more extensive data collection may be necessary. The legal basis for this is Section 26 (1) of the German Federal Data Protection Act (BDSG).
In certain cases, we process your data to protect a legitimate interest. Such an interest exists, for example, if your data is required for the assertion, exercise or defense of legal claims in the context of the application process (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes. The legal basis in such cases is Art. 6 (1) lit. f) GDPR.
We process your personal data on the basis of consent given by you for inclusion in our talent pool, i.e. we store the application documents beyond the current application process for consideration in subsequent application processes.
The legal basis for processing when consent is given is Art. 6 (1) lit. a); 9 (2) lit. a) GDPR, § 26 (2) BDSG.
If we base data processing on your consent, you have the right to revoke your consent at any time with effect for the future. You can send the revocation by e-mail to email@example.com. The lawfulness of the processing of your data up to the time of the revocation remains unaffected.
IV. Categories of personal data that are processed
- The following data or categories of data are processed in order to carry out the application procedure:
- General applicant data (first name, last name, title, e-mail address, telephone number, address, date of birth, citizenship)
- Qualification data (cover letter, letter of motivation, curriculum vitae, previous activities, professional qualifications and skills)
- Voluntary information, such as an application photo, details of severely handicapped status or other information that you voluntarily provide to us in your application or upload voluntarily
- additional questions depending on the respective job advertisement (e.g. driver's license, portfolio)
- communication between you and us as well as comments and evaluations written about you in the course of your application process
- further data/categories of data, e.g. publicly accessible, job-related data, e.g. a profile at professional social media networks such as XING or LinkedIn. Special categories of personal data: If you provide information in your application documents that contains special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. information that allows conclusions to be drawn about your sexual orientation; information about your health; information that allows conclusions to be drawn about your ethnic origin or your religion), we will also only process this data within the legally permissible scope.
V. Recipients or categories of recipients of the personal data
Your data is mainly processed by our HR department and our management. In some cases, however, specialist departments or divisions are also involved in the processing of your data.
We use New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany, (hereinafter "New Work") as an external service provider. New Work operates the Prescreen e-recruiting system under the domain *.jobbase.io (hereinafter "jobbase.io"), on which companies can post job advertisements and receive and manage applications. Within the scope of these activities, New Work processes personal data only on our behalf of and for our purposes is therefore a processor within the meaning of Art. 4 No. 8 GDPR.
Jobbase.io is the central platform for our applicant management. When you use our online form, your personal data is recorded directly in jobbase.io.
In addition, you can also send your applications to us via our e-mail address firstname.lastname@example.org or by post. In the case of a postal or e-mail application, your data can also be transferred to the e-recruiting system.
1. Data processed when accessing Jobbase.io
When accessing the domain jobbase.io, your internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is collected by New Work:
- Date and time as well as duration of access,
- browser type/version,
- operating system used,
- URL of the previously visited website,
- amount of data transferred,
- GeoIP lookup based on the IP address (Internet Protocol address)
- name of the retrieved files,
- http status code (e.g. "request successful"),
- and URL of the accessed web page,
- type of access (GET, POST).
The legal basis for the processing of the data is Art. 6 (1) lit. f GDPR.
This data is technically necessary to offer the functions of the e-recruiting system and to ensure its stability and security. It is stored by New Work for a period of 12 months. Data for which further retention is necessary for evidentiary purposes is exempt from deletion until final clarification of the respective incident.
This cookie is used to identify the user while using Prescreen. The cookie is mandatory for correct functionality. The cookie loses its validity when the browser is closed.
Until the browser window is closed (session cookie)
This cookie is used to restore an expired session. The cookie is mandatory for correct functionality.
VI. Intention of the controller to transfer the personal data to a recipient in a third country or an international organization
There is no data transfer outside the EU.
VII. Duration for which the personal data are stored or, if this is not possible, the criteria for determining this duration
We store your personal data for as long as is necessary for the decision on your application. Insofar as an employment relationship between you and us was not formed, we may continue to store data insofar as this is necessary for the defense against possible legal claims. As a rule, your data will be deleted within six months after the end of the application process.
If no employment relationship is established, but you have given us your consent for the further storage of your data ("talent pool"), we will store your data until your consent is revoked, but for no more than three further years. If there is a specific reason, we may also store your data for a longer period for the purpose of defending against possible legal claims.
If you withdraw your application before the end of the application process or delete your data and your account with Prescreen, the stored data will be blocked for the period of the application process that is still ongoing and will finally be deleted after six months after the end of the application process.
If you no longer use your candidate profile at Prescreen and have not given your consent to longer data storage in the talent pool, the data will be deleted within six months after the end of the last active application process.
You yourself can delete your candidate profile and your application documents at Prescreen at any time or submit a request for deletion or have the processing restricted.
VIII. Your Rights
If personal data of applicants - i.e. of you - are processed, they are data subjects within the meaning of the GDPR and they are entitled to rights vis-à-vis the data controller. In detail:
- You may request information about whether and which personal data we process about you. We will then inform you what data is involved, for what purposes the data is processed, to whom this data is disclosed, how long the data is stored and what other rights you have in relation to this data.
- In addition, you have the right to have your data corrected or deleted. You may also request that we provide any personal data you have provided to us in a structured, commonly used and machine-readable format either to you or to a person or company of your choice.
- If we base data processing on your consent, you have the right to revoke your consent at any time with effect for the future. You can send the revocation by e-mail to email@example.com. The lawfulness of the processing of your data up to the time of the revocation remains unaffected.
- You also have the right not to be subjected to a decision based exclusively on automated processing - including profiling - which produces legal effects vis-à-vis you. In the context of the application process, we do not use exclusively automated processing for decision-making.
- You also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. e GDPR (data processing in the public interest) or on the basis of Art. 6 (1) lit. f GDPR (data processing for the purposes of safeguarding a legitimate interest); this also applies to profiling based on this provision. In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
- In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.
To exercise your rights, you can contact us by e-mail at firstname.lastname@example.org. We will process your requests promptly and in accordance with the legal requirements and inform you of the measures we have taken or will take.
Effective August 2021