Applicant Management Privacy Notice
in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR)
We process your personal data exclusively in line with the statutory provisions. We process data that you have sent us in connection with your application in order to assess your suitability for the position being advertised (or, as appropriate, for other current vacancies at our company) and to conduct the application process. This covers the following categories of personal data:
(1) Contact details (first and last name, address)
(2) Communication information (telephone number, cell number, fax number, email address, language of communication)
(3) Personal details (date of birth, place of birth, nationality, marital status, gender)
(4) Personal details relevant to the job (desired working location and hours, availability, salary expectations, willingness to relocate and travel, work permit)
(5) Details of qualifications (school-leaving qualifications, training/degree, language and other professional skills)
(6) Details of the appraisal and assessment done as part of the application process
(7) Details of your career to date, CV, training and work certificates, proof of qualifications)
(8) Application photograph
(9) Application history (consent to data storage, inclusion in applicant/talent pool)
A. Controller and Data Protection Officer
The controller in respect of the processing of your personal data is:
Managing Directors: Dr. Thomas Burgstaller, Matthias Burgstaller, Oliver Sowa
Tittlinger Straße 39, 94034 Passau, Germany
You can find more information about the company, details of authorized representatives, and other contact options on the “Legal Information” page on our website:
You can contact our Data Protection Officer, Christian Volkmer from Projekt 29 GmbH & Co. KG, Ostengasse 14, 93047 Regensburg, Germany, by email at:
B. Purpose and legal basis for processing personal data
The primary legal basis is Section 26 GDPR in the version valid as of May 25, 2018 in conjunction with the GDPR standards listed below.
Section 26 GDPR permits the processing of data required to make a decision on entering into an employment relationship.
1. Processing data for the purposes of entering into and implementing a contract (Article 6 (1) (b) GDPR)
Personal data is used in applicant management to enter into contracts establishing employment relationships. With regard to the abovementioned categories of personal data:
(1) Personal contact
(2) Applicant communication, entering into contact in the event of suitable vacancies
(3) Planned employment
(4) Comparing the requirements of the role with the applicant’s expectations
(5) Comparing the requirements of the role with the applicant’s skills and expectations
(6) Comparing the requirements of the role with the applicant’s skills and expectations, preventing complaints
(7) Comparing the requirements of the role with the applicant’s skills
(8) Communication with the applicant
2. Processing data based on your consent (Article 6 (1) (a) GDPR)
Insofar as we have obtained your consent to process personal data for specific purposes, the processing of this data is lawful. This applies to your written consent to your application documents being included in the applicant/talent pool for filling subsequent vacancies. All staff tasked with filling vacancies can access your personal data in the applicant/talent pool in order to send you details of vacancies that match your applicant profile.
You may withdraw your consent at any time after it has been given. This also applies to withdrawing declarations of consent that we received from you before the GDPR came into force, i.e. before May 25, 2018. Withdrawing consent takes effect for the future and does not affect the lawfulness of the data processed up until the withdrawal.
3. Processing data based on balancing interests (Article 6 (1) (f) GDPR)
Should the data be required for legal proceedings after the application process has ended, it may be processed based on the criteria set out in Article 6 GDPR and particularly to safeguard legitimate interests in accordance with Article 6 (1) (f) GDPR. Our interest in this case lies in defending claims.
C. Categories of recipients / Disclosure of personal data (Article 30 (1) (2) (d) GDPR)
Your application data will be reviewed by the HR department once your application has been received. Suitable applications will then be passed on internally to the departmental staff responsible for the respective vacancy, after which the next steps will be agreed. Within our company, the staff and offices that require your data in order to fulfill the abovementioned purposes (see B. Purpose and legal basis for processing personal data) are able to access it.
D. Transmitting personal data to a third country
No transmission of data to third countries is envisaged.
E. Duration of storage of personal data and its erasure
We store your data for the abovementioned purposes (see B. Purpose and legal basis for processing personal data). Your data will be processed for the first time from when it is collected insofar as you or a third party communicate it to us. We will erase your personal data after six months following the end of the application process. If you have consented to your personal data being stored for longer, we will erase it at the end of the agreed period.
F. Rights of the data subject / Your rights
You can contact our company and our Data Protection Officer if you have any questions or complaints about privacy or data protection. You have the right to information under Article 15 GDPR. The relevant contact details are listed in section A. of this Privacy Notice.
You also have the following rights:
Right to information:
You can demand information from us as to whether and to what extent we process your data.
Right to rectification:
If we process your data and it is incomplete or incorrect, you can demand from us at any time that we rectify it or complete it.
Right to erasure:
You can demand from us that we erase your data if we are processing it unlawfully or the processing of your data impinges unduly on your legitimate interests. Please note that there may be reasons not to erase the data immediately, for example in order to comply with statutory data retention provisions.
Regardless of the exercising of your right to erasure, we will erase your data completely and without delay as long as there is no transactional or statutory obligation to retain the data.
Right to limitation of processing:
- You can demand that we limit the processing of your data if:
- you dispute that the data is correct and allow us enough time to check that the data is correct;
- the processing of the data is unlawful, but you refuse to allow it to be erased and instead demand that its use be limited;
- we no longer require the data for the intended purpose, but you still need this data to assert or defend legal claims; or
- you have objected to the processing of the data.
Right to data portability:
You can demand from us that we make the data you have provided to us available in a structured, common, machine-readable format and that you can transmit this data to a different controller without hindrance from us provided:
- we are processing this data on the basis of your revocable approval or to fulfill a contract between us; and
- the data is being processed with the help of automated procedures.
If it is technically feasible, you can demand that we transmit your data directly to a different controller.
Right to object:
If we are processing your data on the basis of legitimate interests, you can object to this at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can establish that there are compelling legitimate grounds for processing the data that outweigh your interests, rights, and freedoms or that processing the data serves to assert, exercise, or defend legal claims.
You can also contact the competent supervisory authority.
Contact details of the competent supervisory authority:
Address and contact details of the Bavarian data protection authority (Bayerischer Landesbeauftragter für den Datenschutz)
Bayerischer Landesbeauftragter für den Datenschutz
P.O. Box 22 12 19, 80502 Munich, Germany
Bayerischer Landesbeauftragter für den Datenschutz
Wagmüllerstraße 18, 80538 Munich, Germany
Phone: +49 (0)89 212672-0
Fax: +49 (0)89 212672-50
Right to withdraw consent
You may withdraw your consent at any time after it has been given (see Section B. 2. Processing data based on your consent).
G. Automated decision-making
No automated decision-making, including profiling, is carried out in order to enter into a contract.
H. Data sources
We process personal data that we receive from you as part of your application. We also process personal data that we are legally permitted to obtain from the Internet.
I. Amendment clause
Our data processing and the legal situation are subject to change, meaning that we will amend our data protection and privacy information from time to time. You will be notified of the amendments in good time.
Valid as of May 25, 2018