Privacy policy information for applicants

Information about data protection relating to our processing of applicant data pursuant to Article (Art.) 13, 14 and 21 of the General Data Protection Regulation (GDPR)

1. Controller responsible for the data processing and contact details

2. Purposes and legal basis for processing your data

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Data Protection Act (BDSG) and other applicable data protection regulations. Details below. Further details concerning the purposes for data processing can be found in the respective contract documents, forms, a declaration of consent and other information you have been provided with.

2.1 Purposes for the performance of a contract or to take steps prior to entering into a contract (Art. 6 Para. 1 b GDPR)

Your personal data is processed for the purpose of processing your application in reply to a specific job advertisement or as a speculative application and in this connection in particular for the following purposes: Examination and assessment of your suitability for the position to be filled, performance and behaviour assessment to the extent permitted by law, where necessary for the registration and authentication for the application via our website, where necessary for the creation of the contract of employment, verifiability of transactions, orders and other agreements and for quality control with appropriate documentation, measures to meet general due diligence obligations, statistical evaluations for business management, travel and event management, travel booking and travel expense report, authorisation and identity card management, cost recording and controlling, reporting, internal and external communication, billing and tax assessment of company benefits (e.g. canteen meals), payment via company credit card, health and safety, contract-related communication (including appointments) with you, assertion of legal claims and defence in legal disputes; ensure IT security (including system and plausibility tests) and general safety, including building and plant security, ensure and enforce house rules with appropriate measures and with video surveillance as appropriate to protect third parties and our employees and to prevent criminal acts and preserve evidence of criminal acts; ensure integrity, prevention and investigation of criminal acts; authenticity and availability of data, control by supervisory boards or supervisory authorities (e.g. audit).

2.2 Purposes for the safeguarding of legitimate interests of ourselves or third parties (Art. 6 Para. 1 f GDPR)

Besides the actual performance of the contract or steps prior to entering into a contract, we process your data when this is necessary to safeguard legitimate interests of ourselves or third parties. Your data is only processed if you do not have overriding interests against such processing, in particular for the following purposes: Measures for the further development of existing systems, processes and services; comparisons with European and international anti-terrorist lists beyond the legal requirements; enhancement of our data, among other things by using or researching data in the public domain where necessary; benchmarking; development of scoring systems or automated decision-making processes; building and plant security (e.g. with entry controls and video surveillance) going beyond the general due diligence obligations; internal and external investigations, security checks;

2.3 Purposes on the basis of your consent (Art. 6 Para. 1 a GDPR)

Your personal data can also be processed for specific purposes on the basis of your consent (e.g. obtaining references from former employers or use of your data for future vacancies). Normally this can be withdrawn at any time. You are informed separately in the corresponding text of the consent of the purposes and of the consequences of withdrawal or refusal to give consent.

The withdrawal of any consent is only with effect for the future. Any processing which took place before the withdrawal of consent is not affected by this and remains lawful.

2.4 Purposes for compliance with statutory requirements (Art. 6 Para. 1 c GDPR) or in the public interest (Art. 6 Para. 1 e GDPR)

Like anyone else involved in economic activity, we too are subject to a number of legal obligations. These are primarily statutory requirements (e.g. the Works Constitutions Act (Betriebsverfassungsgesetz), Social Security Code (Sozialgesetzbuch), commercial and tax laws), but there are also regulatory requirements and other requirements of public authorities (e.g. professional association). The purposes of processing include where necessary the checking of age and identity, fraud and money laundering prevention (e.g. comparisons with European and international anti-terrorist lists), the company health management, ensuring health and safety, meeting control and reporting obligations under tax law and the archiving of data for purposes of data protection and data security and for purposes of auditing by tax consultants/accounts, tax and other authorities. In addition, personal data may need to be disclosed in the course of regulatory/legal actions for the purpose of collection of evidence, criminal prosecution or assertion of claims under civil law.

3. The data categories processed by us, where we process data not obtained directly from you, and its origin

Where this is necessary for the contractual relationship with you and the application made by you, we process data obtained reliably from other bodies or other third parties. We also process personal data which we have reliably obtained or acquired from public sources (e.g. commercial and association register, civil register, press, internet and other media), if this is necessary and we are allowed to process this data under the statutory regulations.

Relevant personal data categories may be in particular:

• Address and contact data (registration and similar data, e.g. e-mail address and telephone number)
• Information about you in the internet or in social networks

4. Recipients or categories of recipients of your data

Your data is received in our company by those internal positions or organisational units who need your data to meet our contractual or legal obligations (such as managers and line managers who are looking for a new employee or are assisting in the recruitment decision, accounts department, company doctor, health and safety, where applicable employee representatives etc.) or in the handling and realisation of our legitimate interests. Your data will only be disclosed to external bodies

• for purposes where we are required by law or are entitled to provide information, report or disclose data (e.g. tax authorities) or the disclosure of data is in the public interest (see No. 2.4);
• if external service providers process data on our behalf as contract data processors or in undertaking a function (e.g. banks, external computer centres, travel agency/travel management, printers or data disposal companies, courier services, post office, logistics);
• on the basis of our legitimate interest or the legitimate interest of the third party for the purposes stated under No. 2.2 (e.g. to public authorities, credit agencies, lawyers, courts, experts, group companies and committees and supervisory bodies);
• if you have given us your consent to disclose to third parties.

We will also not disclose your data to third parties unless we inform you of this separately. If we instruct a service provider to perform contract data processing, your data will be subject there to the security standards specified by us to provide your data with adequate protection. In all other cases the recipients may only use the data for the purposes for which it has been disclosed to them.

5. Length of time your data is stored

We process and store your data in principle for the duration of your application. This also includes the initiation stage of a contract (pre-contract legal relationship).

We also have to meet various retention and documentation obligations defined in the German Commercial Code (HGB) and the German Tax Code (AO). The retention and documentation periods specified in these are up to ten years after the end of the contractual relationship or the pre-contract legal relationship. If we do not employ you, your original application documents will be returned to you after six months. Electronic data will be deleted accordingly after six months. If we want to store your data for longer for future vacancies or you have posted your data in an applicant pool, the data will be deleted at a later date; you will be informed of the details in connection with the respective process.

If the data is no longer required to meet contractual or legal obligations and rights, this will be routinely deleted, unless its - temporary - further processing is necessary in order to fulfil the purposes listed under No. 2.2 due to an overriding legitimate interest of our company. Such an overriding legitimate interest will exist for example if deletion is not possible or is only possible at an unreasonably high cost due to the particular method of storage. In these cases we can also store your data and use it to a limited extent as necessary after the end of our contractual relationship for a period consistent with the purposes. In these cases there will be a restriction of processing instead of deletion. In other words, the data will be blocked by appropriate measures against otherwise usual use.

6. Processing of your data in a third country or by an international organisation

Data is transmitted to bodies in countries outside of the European Economic Area EU/EEA (so-called third countries) if this is necessary to meet a contractual obligation towards you (e.g. application for a job abroad), if this in the legitimate interests of ourselves or a third party or if you have given us your consent for this.

Your data may also be processed in a third country in connection with the use of service providers to perform contract data processing. If the EU Commission has not confirmed that the third country concerned has an adequate level of data protection, we ensure in accordance with the EU data protection requirements with appropriate contracts that your rights and freedoms will be adequately protected and guaranteed. You can ask the company Data Protection Officer or the personnel department responsible for you for information on the appropriate or adequate guarantees and how and where a copy of these can be obtained.

7. Your data protection rights

Under certain conditions, you can assert your data protection rights against us.

Every data subject has the right to information pursuant to Art. 15 GDPR, the right to correction pursuant to Art. 16 GDPR, the right to deletion pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data portability pursuant to Art. 20 GDPR. In the case of the right to information and the right to deletion, the restrictions of §§ 34 and 35 BDSG apply. The data subject also has the right to complain to a data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG).

Your request to exercise your rights should preferably be addressed in writing to the address specified above or directly to our Data Protection Officer.

8. Data you need to provide

You only need to provide us with the data which is required for processing of your application or for a pre-contract relationship with us or which we are required by law to collect. Without this data we will as a rule not be able to execute this application and selection process further. If we also ask for data from you, you will be informed separately of the voluntary nature of the disclosures.

9. Existence of automated individual decision-making (including profiling)

We do not use a purely automated decision-making procedure pursuant to Article 22 GDPR. If we use such a procedure in the future in individual cases, we will inform you of this separately, if this is required by law.

Our information about data protection relating to our data processing pursuant to Articles (Art.) 13, 14 and 21 GDPR may be amended from time to time. We will publish all amendments on this site. We will keep older versions for you to view in an archive.

Data Protection Information for Applicants of 25 May 2018, Version No. 1