Privacy Notice Applicants / Candidates

We process your personal data in accordance with the provisions of the GDPR, the German Federal Data Protection Act (BDSG) and other applicable data protection regulations. You will find details under the following explanations.

2.1 Candidate profile

Before applying for an open vacancy, it is necessary to create your own candidate profile. This profile will only be visible to us when you apply for an open vacancy. You can make changes or additions to your candidate profile yourself at any time.

2.2 Purposes in the context of pre-contractual measures (cf. Art. 6 (1) b, Art. 9 (2) b GDPR, § 26 BDSG)

This data protection notice is issued in connection with the application procedure. Your personal data is processed in order to decide on the establishment of an employment relationship with you and to process it. This may also include the performance of an assessment, which especially may include the creation of a personality profile as part of a personality test. Although the evaluation of the personality test is initially automated, the content is then checked by the people involved in the recruitment process. The evaluation can then be included in the decision on whether to establish an employment relationship with you. The evaluation will be handed over to you personally. If personal hand over is not possible, it will be sent to you by post or made available to you by digital means. Of course, we will ensure the best possible digital hand over from an IT-Security perspective according to the state of the art. As part of the application process, your personal data may also be viewed by employees of various specialist departments at national and international level, but only to the extent that this – as mentioned – serves to establish the employment relationship with you.

2.3 Purposes within the scope of legitimate interests of us or third parties (cf. Art. 6 (1) f GDPR)

We process your personal data if it is necessary to protect the legitimate interests of us or third parties, unless there are no overriding interests on your part (including fundamental rights and freedoms) that speak against such processing. Our purpose-oriented interests can be in particular:

• Internal administrative purposes;
• Statistical evaluations for corporate management;
• Measures for controlling and optimizing business processes;
• Measures for the further development of services and products;
• Identification of recruited employees for distribution of bonus;
• Testing and optimization of procedures for demand analysis;
• Comparison with national as well as European and other international sanctions lists as part of our compliance program to determine critical data (screening), insofar as this goes beyond the legal obligations. The comparison depends to a large extent on the matter in question and the circumstances of the individual case, i.e. on the risk forecast and the safety relevance of the specific activity;
• Enrichment of our data, among other things by using or researching publicly available data to the extent necessary;
• Active Sourcing (direct approach of candidates),
• Benchmarking (especially comparison of the recruitment figures of the countries and the respective recruitment period. The benchmarking is anonymous);
• Assertion of legal claims and defense in the event of legal disputes which are not directly attributable to the contractual relationship;
• Building and plant security, securing and exercising the rights of the building by taking appropriate measures (e.g. access controls) and, if necessary, by video surveillance to protect third parties and our employees and to prevent criminal offences and to secure evidence for the investigation of criminal offences, insofar as this goes beyond the general duty of care;
• Further development of existing systems and processes;
• Internal and external investigations, security checks;
• Obtaining and maintaining certifications of a private or official nature for internal administrative purposes.

2.4 Purposes within the scope of your consent (cf. i.a. Art. 6 (1) a GDPR)

We process your personal data – in each case only based on your consent – for the following purposes:

• In the context of an active application to establish the employment relationship, insofar as processing cannot already be based on Art. 6 (1) b GDPR, Art. 9 (2) b GDPR, § 26 (1) and (3) BDSG;
• Replacement of vacancies that have become vacant again, for which you originally applied, as well as for worldwide vacancies including inclusion in a talent pool to which PAUL HARTMANN AG Group companies have access at national and international level. In the last-mentioned case, we will contact you via the email address and/or phone number you have provided us with, if there is a corresponding open vacancy;
• Messages in the form of "job alerts". The basis for these alerts is your application for a specific vacancy, in the context of which you have also created your candidate profile. The specific name of the open vacancy for which you have applied serves as a keyword. You can add or delete individual "job alerts" at any time;
• Messages about career opportunities. You will be considered for customized marketing campaigns – generated by the system – if you are visible in our talent pool at the same time. Such marketing campaigns can refer to current job fairs, for example, where you can get more information about career opportunities;
• Active Sourcing - direct approach, addressed to you as a candidate.

You are not obliged to give your consent and there are no legal disadvantages for not granting your consent. You can withdraw your consent at any time in your career profile. In principle, the withdrawal of a consent is only effective for the future. Processing that took place before the withdrawal is not affected and remains lawful.

2.5 Purposes to meet legal requirements (cf. Art. 6 (1) c GDPR or purposes in the public interest (cf. Art. 6 (1) e GDPR)

Like everyone who is involved in the economic process, we are also subject to a variety of legal obligations. These are primarily legal requirements (e.g. Works Constitution Act, Social Security Code, commercial and tax laws, German Fiscal Code), but also, where applicable, regulatory or other official requirements (e.g. employers' liability insurance association). The purposes of the processing may include identity and age verification, fraud and money laundering prevention (e.g. comparison with European and international anti-terrorist lists), company health management and ensuring occupational safety. In addition, the disclosure of personal data may become necessary within the scope of official/judicial measures for the purpose of gathering evidence, criminal prosecution or the enforcement of civil law claims.

Insofar as it is necessary for the decision on the establishment of an employment relationship with you, we process, in addition to the personal data received directly from you, any personal data that may have been lawfully received from third parties (see Art. 14 GDPR). This may include personal data received from external service providers such as headhunters, professional network operators or social networks (e.g. LinkedIn or Xing).

Relevant personal data might be:

First name and surname, if applicable maiden name, gender, residential address, contact data, date of birth, place of birth, nationality, religious affiliation, marital status, job description, callable contact data, start / end of employment, educational background (school, studies, training etc.) and professional development, title, residence permit / work permit and its period of validity, data from identification document, qualifications (driver's license, first-aider, knowledge of foreign languages etc.) Status information (mainly pupil or student), information about certificates and qualifications, severe disability (e.g. for holiday entitlement or job description), honorary position / active membership in a club (sports etc.), information about previous employment relationships, criminal records (e.g. for security-relevant functions), photos, bank records (for travel expense accounting).

In the single application process we basically only process your personal data within the company. Within our company, those internal departments or organizational units receive your personal data insofar as they need it to fulfil the purpose and within the scope of processing. Internal data recipients are obliged in each case to use your personal data only to the aforementioned extent.

If we transfer your personal data to other persons and companies (third parties), e.g. to service providers who provide our recruiting services or at least support us, or grant them other access to the personal data, this is only done on the basis of a legal permission. If we commission third parties to process personal data on the basis of a so-called "data processing agreement" and thereby secure the necessary powers of influence or control with regard to the processing and use of the personal data, this is done on the basis of Art. 28 GDPR. However, we remain responsible to you for the legality of the data processing.

First, we would like to point out that we do not delete your personal data but make it anonymous. After the anonymization process has been carried out, a reference to your person no longer exists and cannot be restored. The data protection regulations are then no longer applicable. We use the anonymized data in particular for evaluation purposes.

In principle, we process or store your personal data for the duration of the direct contact within the framework of active sourcing, for the duration of an active application process and for the duration of your activity in the candidate profile.

Application process

Your personal data in connection with a specific application will be made anonymous at the latest 6 months after the application process has been completed (beginning especially by refusal). If we only have your application documents in paper form, we will return them to you after the end of the application procedure to our credit.

Candidate profile

The anonymization of your personal data stored in the candidate profile is done automatically in case of inactivity of 6 months (no login was made for 6 months). You will be informed about this in advance by email. By logging in again, the period is automatically extended by a further 6 months. The prerequisite in each case is that there is no active application. If you set up a "deletion" in your candidate profile yourself, the anonymization will take place automatically 6 months after setting up.

Exclusion anonymization, withdrawal

The above-mentioned information on the anonymization does not apply if, among other things, legally prescribed retention periods prevent immediate deletion – here anonymization – (cf. Art. 17 (3) GDPR) and/or another case of Art. 17 (3) GDPR exists and/or a new purpose justifies further processing.

We would like to point out that the withdrawal of a consent granted by you for the purposes mentioned in No. 2.4 above only has the effect that the respective processing (e.g. sending of "Job Alerts") is stopped by us. No personal data will therefore be anonymized by withdrawing.

A transfer of data to entities (e.g. subsidiaries) in countries outside the European Economic Area EU/EEA (so-called third countries) takes place in particular if it is necessary for the decision on the establishment of an employment relationship with you. The processing of your personal data in a third country may also take place in connection with the use of service providers in the context of processing orders.

Unless the EU Commission has decided on an adequate level of data protection in the country concerned, we guarantee - in accordance with Article 13 (1) f of the GDPR - that your rights and freedoms are protected in the case of transfers in accordance with Articles 46, 47 or 49 (1) subparagraph 2 of the GDPR by providing suitable and appropriate guarantees. Information on the suitable or appropriate guarantees and the possibility of how and where to obtain a copy of them can be obtained on request from the Data Protection Department (see contact details data protection under no. 1 above) or the Human Resources Department responsible for you.

• You have the right to withdraw your consent to the processing of your personal data in accordance with Art. 7 (3) GDPR at any time with effect for the future. Processing that took place before the withdrawal therefore remains lawful.
• In accordance with Art. 15 GDPR, you can request information about your personal data processed by us.
• In accordance with Art. 16 GDPR, you can demand the immediate correction of incorrect or incomplete personal data stored by us.
• In accordance with Art. 17 GDPR, you can request the deletion (here anonymization) of your personal data stored by us in accordance with the conditions stated therein, unless legally prescribed retention periods prevent immediate deletion – here anonymization – (see Art. 17 (3) GDPR) and/or another case of Art. 17 (3) GDPR exists and/or a new purpose justifies further processing.
• Pursuant to Art. 18 (1) GDPR, you may request the restriction of data processing if one or more conditions pursuant to Art. 18 (1) GDPR lit. a to d are met.
• In accordance with Art. 20 (1) GDPR, you can receive the personal data processed by us in a structured, common and machine-readable format and transfer this personal data to another person responsible without hindrance from us.
• In addition, you can object to the processing of your personal data in accordance with Art. 21 (1) GDPR. In the event of an objection, we will terminate the processing of your personal data. However, the right of objection only applies in the event of special circumstances arising from your personal situation. In addition, compelling reasons worthy of protection that speak in favour of processing may prevail. Furthermore, certain processing purposes may conflict with your right of objection.
• According to Art. 21 (2) GDPR, you have the right to object to the processing of personal data concerning you for the purpose of direct marketing at any time without further conditions. This also applies to profiling, insofar as it is connected with such direct marketing. If you object, your personal data will no longer be processed for these purposes (cf. Art. 21 (3) GDPR).
• Without prejudice to any other administrative or judicial remedy, you also have the right to appeal to the competent supervisory authority (see Art. 77 GDPR) if you believe that the processing of your personal data violates data protection provisions. In this context, however, we would ask you to address any complaints first to the contact details given under (1) above.

You only need to provide personal data that is necessary for the decision on the establishment of the employment relationship or that we are legally obliged to collect (e.g. to provide evidence to authorities). Without this personal data, we will generally not be able to carry out the application process. If we request additional personal data from you, you will be informed separately about the voluntary nature of the information.

We do not use purely automated decision-making procedures in accordance with Art. 22 GDPR. Should we nevertheless use such a procedure in individual cases in the future, we will inform you of this separately if this is required by law.