10.1 Job Applications
We offer website visitors the opportunity to submit job applications to us (e.g., via e-mail, via postal services on by submitting the online job application form). Below, we will brief you on the scope, purpose and use of the personal data collected from you in conjunction with the application process. We assure you that the collection, processing and use of your data will occur in compliance with the applicable data privacy rights and all other statutory provisions and that your data will always be treated as strictly confidential.
Scope and purpose of the collection of data
If you submit a job application to us, we will process any affiliated personal data (e.g., contact and communications data, application documents, notes taken during job interviews, etc.), if they are required to make a decision concerning the establishment or an employment relationship. The legal grounds for the aforementioned are § 26 GDPR according to German Law (Negotiation of an Employment Relationship), Art. 6(1)(b) GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6(1)(a) GDPR. You may revoke any consent given at any time. Within our company, your personal data will only be shared with individuals who are involved in the processing of your job application.
If your job application should result in your recruitment, the data you have submitted will be archived on the grounds of § 26 GDPR and Art. 6(1)(b) GDPR for the purpose of implementing the employment relationship in our data processing system.
Data Archiving Period
If we are unable to make you a job offer or you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application procedure (rejection or withdrawal of the application).
Afterwards the data will be deleted, and the physical application documents will be destroyed. The storage serves in particular as evidence in the event of a legal dispute. If it is evident that the data will be required after the expiry of the 6-month period (e.g., due to an impending or pending legal dispute), deletion will only take place when the purpose for further storage no longer applies.
Longer storage may also take place if you have given your agreement (Article 6(1)(a) GDPR) or if statutory data retention requirements preclude the deletion.
Admission to the applicant pool
If we do not make you a job offer, you may be able to join our applicant pool. In case of admission, all documents and information from the application will be transferred to the applicant pool in order to contact you in case of suitable vacancies.
Admission to the applicant pool is based exclusively on your express agreement (Art. 6(1)(a) GDPR). The submission agreement is voluntary and has no relation to the ongoing application procedure. The affected person can revoke his agreement at any time. In this case, the data from the applicant pool will be irrevocably deleted, provided there are no legal reasons for storage.
The data from the applicant pool will be irrevocably deleted no later than two years after consent has been granted.
10.2 Notes on the general handling of data from business partners
Processing purposes and legal basis
Your personal data will be processed in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other relevant data protection regulations. The processing and use of individual data depend on the agreed or requested service. Our contractual documents, forms, consent forms and other information provided to you (e.g. on the website or in the terms and conditions) can provide further details and supplements on the processing purposes.
Consent (Art. 6 (1) (a) GDPR)
If you have given us consent to process personal data, the respective consent is the legal basis for the processing mentioned there. You can revoke consent at any time with effect for the future.
Fulfillment of contractual obligations (Art. 6 (1) (b) GDPR)
We process your personal data for the execution of our contracts with you. Furthermore, your personal data is processed for the implementation of measures and activities in the context of pre-contractual relations.
Fulfillment of legal obligations (Art. 6 (1) (c) GDPR)
We process your personal data if this is necessary to fulfill legal obligations (e.g. commercial, tax laws).
Furthermore, we may process your data for:
- the prevention of fraud and money laundering
- the prevention, combating and investigation of terrorist financing and crimes that endanger assets
- the fulfillment of control and reporting obligations under tax law
- archiving data for data protection and data security purposes
- auditing by tax and other authorities
In addition, the disclosure of personal data may become necessary in the context of official/court measures for the purpose of gathering evidence, criminal prosecution or enforcement of civil claims.
Legitimate interest of us or third parties (Art. 6 (1) (f) GDPR)
We may also use your personal data on the basis of a balance of interests to protect the legitimate interest of us or third parties. This is done for the following purposes:
- for advertising or market research, if you have not objected to the use of your data
- for obtaining information and exchanging data with credit agencies, if this exceeds our economic risk
- for the limited storage of your data, if deletion is not possible or only possible with disproportionate effort due to the special nature of storage
- for comparison with European and international anti-terrorism lists, if this goes beyond the legal obligations
- for the further development of services and products as well as existing systems and processes
- for the disclosure of personal data as part of due diligence, e.g. in the case of company sales
- for the enrichment of our data by using or researching publicly available data
- for statistical evaluations or for market analyses
- for benchmarking
- for the assertion of legal claims and defense in legal disputes that are not directly related to the contractual relationship
- for the development of scoring systems or automated decision-making processes
- for internal and external investigations and/or security audits
- for the possible listening in or recording of telephone conversations for quality control and training purposes
- for certifications of private law or official matters
- for securing and exercising our house rights through appropriate measures (e.g. video surveillance)
Categories of personal data processed by us
We process the following data:
- personal data (name, date of birth, place of birth, nationality, marital status, occupation/industry and similar data)
- contact details (address, email address, telephone number and similar data)
- payment/Coverage confirmation for Bank and Credit Cards
- Information about your financial situation (creditworthiness data including scoring, i.e. data for assessing the economic risk)
- Customer and supplier history
In addition, we process personal data from public sources (e.g. Internet, media, press, trade and civil registers).
We also process personal data that we have legally obtained from third parties (e.g. mailing list providers, credit agencies) if necessary for the provision of our services.
Who receives your data?
We share your personal data within our company with those departments that require your data to comply with contractual and legal obligations or to pursue our legitimate interests.
In addition, the following entities/bodies may receive your data:
- Contract processors commissioned by us (Art. 28 GDPR) service providers for supporting activities, distributors and other responsible bodies within the meaning of the GDPR, especially in the areas of, e.g. IT services, logistics and printing services, external computer centres, support/maintenance of data processing/IT applications, archiving, document processing, data destruction, marketing, auditing services, credit institutions
- Public authorities and institutions in the event of a legal or official obligation under which we are obliged to disclose, report or share data or the disclosure of data is in the public interest
- Bodies and institutions on the basis of our legitimate interest or the legitimate interest of a third party (e.g. shared with public authorities, credit agencies, debt collection, lawyers, courts)
- other bodies for which you have given us your consent for the transfer of data
Transfer of your data to a third country or an international organisation
A transfer of data to countries outside the European Union (EU) or the European Economic Area (EEA), so-called third countries, takes place if it is necessary for the execution of an order/contract from or with you, if it is required by law (e.g. tax reporting obligations), if it is in the legitimate interest of us or a third party or if you have given us your consent.
In this context, the processing of your data in a third country may also take place in connection with the involvement of service providers as part of commissioned processing.
If there is no EU Commission decision on an adequate level of data protection for the country in question, we ensure that your rights and freedoms are adequately protected and guaranteed in accordance with EU data protection requirements by means of appropriate contracts and measures. We will provide you with the relevant detailed information upon request.
How long do we store your data?
We process your personal data during the entire course of our business relationship as necessary; this also includes the initiation and performance of a contract.
In addition, we are subject to various retention and documentation obligations that are set out in the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The retention and/or documentation periods specified there are up to ten years beyond the end of the business relationship or the pre-contractual legal relationship.
Ultimately, the retention period is also determined in line with statutory limitation periods, which under section 195 et seq. of the German Civil Code (BGB) are generally three years but may be up thirty years in certain cases.
To what extent is automated decision-making used in individual cases (including profiling)?
We do not use purely automated decision-making procedures as referred to in Article 22 GDPR. Should we use these procedures in individual cases, we will inform you separately provided we are required to do so by law.
