1. Information on the processing of personal data in the application process
As part of your online application, our company processes the personal data you provide to us contact data, qualification data, content data (such as. name, address, marital status, age, nationality, qualification, resume, work experience, certificates, etc.), to the extent necessary for the application process. In detail, these are
Contact details: Name, address, telephone, mail address
Qualification data: Education/studies, previous employment, professional development, professional qualifications/certificates, job references.
Content data: Cover letter, interview information
If you inform us, we will also store other voluntary given information, such as the characteristic of a severe disability, an equalization with a severely disabled person or other special categories of personal data related to your application, e.g. if you submit a motivational video to us. This video file created in the application process will be added to your application. You also have the option to transfer your resume, which you have published on LinkedIn/Xing, to us. This transferred data will be stored together with your application. A so-called pre-employment screening of your person only takes place in job-oriented networks such as XING or LinkedIN.
Insofar as we use recruiters or you apply via a recruiter, we receive your application data from them.
2. Purpose of the data processing and indication of the legal basis
Our company processes the aforementioned personal data exclusively in accordance with the GDPR and the German Federal Data Protection Act (BDSG). The purpose of the data processing is the implementation of the application process and the establishment of any employment relationship that may follow.
Data processing as part of the application process and to establish the employment relationship in accordance with § 26 (1) BDSG.
The legal basis for this is Art. 88 GDPR in conjunction with. § 26 (1) BDSG, the legal basis for the storage of special categories of personal data is Art. 88 GDPR in conjunction with. § 26 para. 3 BDSG. Your data will not be used for any other purpose. The necessity of data collection and processing results from the specific position for which you are applying, so in the case of positions with a higher degree of confidentiality, higher financial/personal responsibility, further data collection may take place from you or also from authorities if a certificate of good conduct should be necessary. For data minimization reasons, we only collect and process such data once the selection of applicants for the position has been completed, i.e. immediately before or shortly after recruitment.
Data processing on the basis of consent pursuant to Art. 6 Para. 1 lit. a GDPR in conjunction with § 26 (2) BDSG
In some cases, we process your personal data on the basis of a specific and voluntary given consent from you related to a processing purpose named therein, for example in the case of data processing via the Pitch you software (see below). The legal basis for the data processing is then the consent voluntarily given by you for the specific case before the data processing in an informed manner. In particular, we have also informed you about your right of revocation which you might execute at any time.
The consent then serves us as a legal basis, if we want to include you in the applicant pool for futurous possible job offers, or if we carry out your application process with Pitch you (see below).
Data processing based on our legitimate interest according to Art. 6 (1) lit. f GDPR.
We process your personal data on behalf of our legitimate interest or in a legitimate interest of a third party if your interests in not processing your personal data do not outweigh our interests in processing your personal data. This is the case, if we process your data to defend us against legal claims, for example under the General Equal Treatment Act (AGG) in Germany or for evidence purposes in a legal dispute.
3 Recipients of the data
Within our company, your data will only be accessed by those departments or personnel that absolutely need it, to carry out the application process. These are primarily the responsible employee in the HR department and the responsible managers in the hiring department, who got access rights to the relevant applications. All of our employees who have access to application data are also obligated to maintain confidentiality and have received special training.
For certain technical processes of data processings, our company uses the support of external service providers who, as part of the provision of the service owed, may receive access to your personal data or may be able to view it in the event of support; these are, for example, maintenance and hosting service providers, disposal service providers for files or data. We have entered into order processing agreements with these. All our order processors are carefully selected and meet high data protection and data security standards. They are likewise bound to secrecy and privacy as well and only process personal data on behalf of and in accordance with the instructions of our company. They are subject to our regular monitoring.
As part of the application process you will be free to scan the QR code located in the job advertisement and thus applying by using Pitch you a software from SBS Software und Beratung GmbH, represented by the Managing Directors Thorsten Schatz, Gunnar Basner, Alexander Bauer, Bahnhofstraße 7, 95119 Naila, so that your application will be processed with Whats-App in the Version of Business API. For more details on data protection and privacy policy at Pitch you, please visit www.pitchyou.de/pitchyou-dsgvo. Pitch you thus receives the application data listed above under 1
„Information on the processing of personal data in the application process“) contact data, qualification data and content data.
Pitch you processes your personal data in the context of the your application on our behalf in German data centers at Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen. You can find out more about data protection and privacy at Hetzner at data protection (hetzner.com). For the Whats-App Business API, contracts have also been concluded with certified providers of the Business API. (see above data protection at Pitch you).
Pitch you uses Whats-App in the version of Whats-App Business API. This is a more privacy-friendly solution in comparison to the usual Whats-App, because Pitch you does not transmit any personal data to Whats-App via the Whats-App Business API. Nevertheless, you must be aware that if you use for your job application the possibilitiy to send the application via Whats-App Business API, that even in this case Whats-App may also process your personal data sent to us via your private Whats-App profile, so that these personal datas provides through your Whats-App Profile are processed in the USA or other third countries and that US authorities may gain access to your personal data, too. Although the content data of the communication via Whats App is secured via end-to-end encryption according to Whats-App, the access and data processing depends on your configuration and there is a wide variety of data which is nevertheless sent to Meta Ireland Limited and there are at least metadata of the communication with your private Whats-App profile which are stored on US servers. More details about data processing with Whats-App can be found here www.whatsapp.com/legal.
The USA does not have an equal data protection level comparable to the EU. For this reason, we use the opt-in consent function via Pitch you before the application process begins. When you open the home page or scan the link, your voluntary informed consent is therefore obtained with regard to data processing with the Whats App Business API. For this purpose, your IP address will be stored as long as this is necessary for the proof of consent. You can revoke your consent at any time without disadvantage to you vis-à-vis Cenit at datenschutzbeauftragter@cenit.com as well as at Pitch you, see contact details in the imprint of Pitch you. However, the revocation is only for the future, the previous data processing is not affected.
Before the interview process via Whats App, we will additionally check whether you are already 16 years old by entering your date of birth and obtain consent for the Whats App use and confirmation that you have read and understood the terms of use before the interview starts. As far as the age limit is not reached and the consent as well as the confirmation of the knowledge of the terms of use is not given, the interview will be aborted. You will be informed that a short recording of the interview will be made.
An application via Whats App is not mandatory. It is possible for you to choose another application channel at any time. Your data will always be deleted from Pitch you even if the communication is not continued within 24h, the command to end the communication was given by you.
In Whats-App Business API, the data is deleted immediately after it has been transferred to Pitch you.
4. Data transfer to a third country or to an international organization
Data transfer to countries outside the EU/EEA (so-called third countries) or to international organizations only take place if this is necessary for the execution of existing employment or training contracts, or is required by law, or if you have given us your consent. If service providers in third countries are used by us, they will be held accountable in accordance with Art. 44 et seq. GDPR to comply with European data protection standards within the framework of a written contract based on the EU Standard Contracts or the Binding Corporate Rules, unless there is an adequacy decision by the EU Commission.
5 Duration of data storage
If Cenit AG concludes an employment or training contract with you, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. The legal basis for data processing is Art. 88 GDPR in conjunction with. § 26 (1) BDSG. If no employment or training contract is concluded with you as an applicant, the application documents will be deleted no later than 6 months after the conclusion of the application process, provided that no other legitimate interests of our company oppose deletion that allow longer data processing. Furthermore, we will only process and use your data if you have given us your explicit consent to do so and for the period specified therein. If you have given your consent for inclusion in the applicant pool, the data will be stored for a period of 12 months from the date on which you gave your consent. After this period, the data will be deleted.
If an employment contract is concluded, your data will be transferred to the personnel file and processed there within the framework of the existing employment contract in accordance with § 26 (1) BDSG.
6. Data protection rights of the data subjects
Every data subject has the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to object pursuant to Art. 21 GDPR, the right to revocation pursuant to Art. 7 para. 3 GDPR and the right to data portability pursuant to Art. 20 GDPR. With regard to the right of access and the right of erasure, the restrictions pursuant to Sections 34 and 35 BDSG apply. In addition, there is a right to lodge a complaint with a supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG).
Consent given to our company can be revoked in accordance with Art. 88 GDPR in conjunction with. § 26 para. 2 BDSG, Art. 7 para. 3GDPR at any time. This also applies to the revocation of declarations of consent given to us before the applicability of the GDPR, i.e. before May 25, 2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected. If you wish to exercise your right of revocation, this is possible without any formalities; for example, an e-mail to datenschutzbeauftragter@cenit.com is sufficient.
7. Obligation to provide data
As part of the application process, you must provide the personal data that is required for the application process or that we are legally obligated to collect. Without this data, we will generally not be able to invite you for an interview and will have to refuse to conclude an employment or training contract.
8. Existence of automated decision-making (including profiling)
In order to carry out the application process, we generally do not use fully automated decision-making pursuant to Art. 22 GDPR. Profiling is not used by our company either in the application process or in the employment relationship.
