Privacy Information for Candidates
The protection of your personal data is our highest priority. Your personal data is always treated confidentially and processed in accordance with the applicable provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). With the following information, we would like to provide greater transparency and inform you in detail about how we handle your personal data.
1. Name and Contact Details of the Controller
The following entity is responsible for the processing of your personal data within the meaning of the GDPR and the BDSG:
HR-Recruiting Services GmbH
WeWork – Kemperplatz 1
10785 Berlin
Germany
2. Contact Details of the Data Protection Officer
You can contact our Data Protection Officer at the following address:
DataCo GmbH
Sandstraße 33
80335 Munich
Germany
Email: datenschutz@dataguard.de
Phone: +49 (0) 89 7400 458 40
Website: www.dataguard.de
3. Processing of Your Personal Data in the Context of the Recruitment Process
(a) Personal Data Processed by Us
We only process your personal data to the extent that you have expressed interest in our recruitment activities and insofar as such data is relevant to the respective stage of the recruitment process. In this case, it is at your discretion to decide to what extent you provide us with your personal data, including photographs as well as documents containing information/proof of your qualifications, professional background and, where applicable, other important purpose-related data.
We expressly request that you do not provide us with any information regarding your religious beliefs, worldview, political opinions, pregnancy, disability, financial circumstances, race, ethnic origin, gender, age or sexual identity. Even if you provide us with such information, we will not take it into account during the further course of the application process.
(b) Purposes of Data Processing
Within the scope of the recruitment process, your personal data is processed for the following purposes:
› To propose suitable candidates to our clients for the position to be filled. For this purpose, we forward your applicant data to our client.
› To process your applications internally at HR-Recruiting Services GmbH.
› To determine your interest in a new position or a change of employment by briefly describing the vacancy during an initial contact.
› If you have expressed interest in receiving further information – to offer you a contact option outside your work environment.
› If you have expressed interest – to send you an email informing you how and where you can provide your applicant data and submit your application documents.
› To communicate with you by email or telephone – in particular to respond to your inquiries.
› Where applicable, to add your applicant data to our internal suppression list. This will occur if you object to receiving further contact from us. In such cases, before any future contact is made, we will compare personal data with our internal suppression list in order to ensure that the persons listed there are no longer contacted.
(c) Sources from Which Your Personal Data Originates
Your personal data, including:
› Name
› Address
› Email address
› Telephone number
› Professional background data
› Salary data
may originate from the following sources and professional networks:
› LinkedIn Ireland Unlimited Company, Wilton Pl, Dublin, Ireland
› New Work SE (XING), Baumwall 7, 20459 Hamburg, Germany
› HeyJobs GmbH, Paul-Lincke-Ufer 40, 10999 Berlin, Germany
› StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany
› PowerUs GmbH, Urbanstraße 71, 10967 Berlin, Germany
› Perspective Software GmbH, Müggelstraße 22, 10247 Berlin, Germany
› Meta Platforms Ireland Limited, Merrion Road, Dublin 4 D04 X2K5, Ireland
as well as from other publicly accessible professional networks.
(d) Legal Bases for the Processing of Your Personal Data
Processing of Your Personal Data Based on Consent
Where we obtain your consent for the processing of your personal data, such processing is carried out on the basis of Article 6(1) sentence 1 lit. a GDPR in conjunction with Article 7 GDPR.
Processing Based on Legitimate Interests
The legal basis for direct marketing purposes may be Article 6(1) sentence 1 lit. f GDPR, provided that our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data. In addition to the purposes listed under section b., our legitimate interests include:
› Being able to provide you with optimal information about our services by means of direct marketing, in particular regarding the filling of the relevant vacancy;
› Communicating with you, in particular in order to respond to your inquiries via email, telephone and/or fax;
The legal basis for processing activities related to the assertion, exercise or defense of legal claims is likewise our legitimate interest pursuant to Article 6(1) sentence 1 lit. f GDPR.
Processing Based on the Terms and Conditions / User Agreements Agreed Between You and Professional Networks
Where we use your personal data obtained through professional networks for the purpose of contacting you, Article 6(1) sentence 1 lit. b GDPR serves as the legal basis for processing, provided that the professional network is intended to facilitate contact and communication between users and the user has published this data for this purpose.
4. Recipients or Categories of Recipients of Your Personal Data
We transfer your personal data online in encrypted form and only to external recipients if you have given your consent or if this is permitted by law. External recipients of your personal data include in particular:
› Our clients
› Data processors
Your personal data is transferred to the following data processors within the EU / EEA:
› Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park Leopardstown Dublin 18, D18 P521, Ireland
› HRlab GmbH, Reinhardtstraße 85, 10117 Berlin, Germany
According to the European Commission, an adequate level of data protection exists for the transfer of your personal data to the following service provider in the United Kingdom:
Apart from this, your data will not be transferred to any other recipients in insecure third countries.
5. Duration of Storage of Your Personal Data
Your personal data will be deleted as soon as the purposes stated under “Purposes of Data Processing” no longer apply. This is generally the case when we or our clients decide not to further consider your application in the recruitment process. In this case, we reserve the right to retain your applicant data in our applicant database for up to 6 months after receipt of the rejection notice. The legal basis for this is Article 6(1) sentence 1 lit. c GDPR in conjunction with Section 15(4) AGG and Section 224(2) ZPO. Furthermore, your applicant data will be deleted upon termination of the recruitment assignment, unless you have consented to being included in our candidate pool or statutory or contractual retention obligations prevent deletion.
Your application data will be deleted regardless of the stage of the application process if you withdraw the consent previously given. Further information on this can be found under section 8 of this information notice.
If you agree, your application will be included in our candidate pool and considered for future recruitment assignments. If no successful placement occurs within one year after granting your consent, your documents will be deleted unless you withdraw your consent before the expiry of this period. In this case, we will delete your documents immediately upon receipt of your withdrawal.
Your personal data may also be stored beyond this period, particularly in the following cases:
› where contractual, statutory (up to 10 years pursuant to Section 257 HGB and Section 147 AO) or articles-based retention periods prevent deletion;
› for the assertion, exercise or defense of legal claims;
› where this is necessary under European or national laws to fulfill a legal obligation to which we are subject.
6. Your Rights as a Data Subject
Under the General Data Protection Regulation, you are entitled to the following rights, which you may assert against us:
If your personal data is being processed, you have the right to obtain information from the controller about the data stored concerning you (Art. 15 GDPR).
If incorrect personal data is being processed, you have the right to request rectification (Art. 16 GDPR).
Where the legal requirements are met, you may request the deletion or restriction of processing (Art. 17 and 18 GDPR).
If you exercise your right to rectification, deletion or restriction of the processing of your personal data, we will communicate such rectification, deletion or restriction to all recipients of your data (Art. 19 GDPR).
If you have consented to data processing or if a contract for data processing exists and the processing is carried out by automated means, you may also have the right to data portability (Art. 20 GDPR).
Where your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes (Art. 21 GDPR).
Furthermore, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
7. Right to Withdraw Consent
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of the consent before its. withdrawal.
This privacy notice was created with the support of DataGuard