Thank you very much for your interest in our company and for visiting our website. Below, you will see the individual segments of our Data Privacy Notice:
1. Name and Address of the Controller
2. Name and Address of the Data Protection Officer
The duties of the corporate data protection officer are performed by Dominik Mikulovic.
3. Scope of Personal Data Processing
We process the personal data of data subjects only insofar as it is required to provide this website and for services as a company. We process personal data after having received the consent of the data subject or based on legal provisions that allow us to process such data.
4. Legal Basis for Personal Data Processing
Legal basis for the processing of personal data is Art. 6(1) point (b) of the GDPR of the EU. It is necessary for the performance of the contracts concluded with the data subject. That also applies to processing activities necessary for realising measures prior to entering into a contract.
If the processing is necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1) point (d) of the GDPR serves as the legal basis for processing.
If the processing is necessary for the purposes of the interests pursued by our company or by a third party, we us Art. 6(1) point (f) of the GDPR as legal basis for the processing.
5. Erasure of Data and Retention Period
The data subject’s personal data will be erased or blocked once the purpose of storage ceases to apply. The data will also be blocked or erased once a retention period specified by the aforementioned standards expires, unless further retention of the data is required for the conclusion or performance of a contract.
6. Use of Google Maps
a) Description and scope of data processing
b) Legal basis for data processing
The legal basis for personal data processing using cookies is Art. 6 (1) point (f) of the GDPR.
c) Purpose of data processing
d) Retention period, objection and erasure option
8. Use of the XING Share Button
Our website uses a service of XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany: it uses the “XING Share Button”.
The currently valid data protection information regarding the “XING Share Button”, as well as further information, are available at the following website: https://www.xing.com/app/share?op=data_protection
9. Data protection in applications and in the application process
a) Description, categories and scope of data processing
We process data associated with your job application. These might be general data on your person (such as e.g. name, address and contact data), information on your professional qualification and education or information on your advanced professional training or other information that you transfer in connection with your application. Such processing can also be made electronically. In addition, we may also process any professional information that you have made available publicly, such as e.g. your profile in professional social media networks.
b) Legal basis and purpose of the data processing
We process these personal data for the purpose of your application with regard to an employment relationship with us to the extent this is required for the decision on the establishment of such employment with us. Legal basis is Sec. 26(1) in conjunction with (8) sentence 2 of the BDSG [German Federal Data Protection Act].
Furthermore, we are entitled to process your personal data if this is required for the defence against legal claims asserted against us arising from the application procedure. Legal basis shall be Article 6(1) point (f) of the GDPR and the legitimate interest is, for example, the burden of proof in proceedings according to the Allgemeines Gleichbehandlungsgesetz (AGG) [German General Equal Treatment Act].
Should an employment relationship between you and us be established, then we will be entitled to further process the personal data already obtained from you in accordance with Sec. 26(1) of the BSDG for the purposes of the employment relationship if this is required for the implementation or termination of the employment relationship or the execution or fulfilment of the rights and obligations of the representation of interests of the employees resulting from a law or collective agreement, a company or work agreement (collective agreement).
c) Retention period
We store your personal data for as long as this is required for the decision on your application. Should an employment contract not be concluded between you and us, then we may still store your data if this might be required in order to defend against any future rights. However, your application documents will be deleted two months after the announcement of the decision on refusal, unless a longer storage period is required for the defence in any legal disputes.
10. Rights of Data Subjects
a. Right of access
You can request a confirmation from the controller whether we process personal data relating to you.
If such processing takes place, you can request the controller to provide you with the following information:
(1) the purposes of personal data processing;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipients to which the personal data relating to you have been or are to be disclosed;
(4) the envisaged period for which the personal data concerning you will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request from the controller rectification or erasure of personal data or a right to restriction of processing of personal data concerning you by the controller or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data is not collected from the data subject, any available information as to its origin;
(8) the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) of the GDPR and - at least in those cases - meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to obtain access to information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 of the GDPR relating to the transfer.
b. Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data related to you is incorrect or incomplete. The controller must perform rectification immediately.
c. Right to restriction of processing
You have the right to obtain restriction of processing of the personal data concerning you where one of the following applies:
(1) if you contest the accuracy of the personal data relating to you for a period that enables the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
(3) if the controller no longer needs the personal data for the purposes of processing, but you need them to assert, exercise or defend legal claims, or
(4) if you have objected to processing pursuant to Art. 21(1) of the GDPR, pending the verification whether the legitimate grounds of the controller override your legitimate grounds.
Where processing of the personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where processing has been restricted pursuant to the aforementioned conditions, you will be notified by the controller before the restriction is lifted.
d. Right to erasure
a) Erasure obligation
You may demand the controller to erase your personal data without undue delay and the controller is obliged to erase such data without undue delay where one of the following grounds applies:
(1) the personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
(2) you withdraw your consent on which the processing is based according to Art. 6(1) point (a) or of Art. 9(2) point (a) of the GDPR, and where there is no other legal ground for the processing;
(3) you object to the processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) of the GDPR;
(4) the personal data concerning you has been unlawfully processed;
(5) your personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
(6) the personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) of the GDPR.
b) Information to Third Parties
Where the Controller has made your personal data public and is obliged pursuant to Art. 17(1) of the GDPR to erase them, the Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copies or replications of those personal data.
The right to erasure does not apply to the extent that processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9(2) points (h) and (i) as well as Art. 9(3) of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) of the GDPR insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the establishment, exercise or defence of legal claims.
e. Right to Information
If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis the controller, the latter is obliged to notify all recipients, to whom your personal data have been disclosed, of such rectification or erasure of the data or restriction of processing, unless this proves to be impossible or produces disproportionate burdens.
You have the right vis-à-vis the controller to be informed of such recipients.
f. Right to data portability
You have the right to receive any personal data related to you that has been provided by you to the controller in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided, where
(1) the processing is based on consent pursuant to Art. 6(1) point (a) of the GDPR or Art. 9(2) point (a) of the GDPR or on a contract pursuant to Art. 6(1) point (b) of the GDPR; and
(2) the processing is carried out by automated means.
In exercising such right, you further have the right to have the personal data concerning you transmitted directly from one controller to another controller, where technically feasible. This must not adversely affect the rights and freedoms of other persons.
The right to data portability does not apply to any personal data processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
g. Right to object
You have the right to object, on grounds relating to your particular situation, at any time, to any processing of your personal data which is based on Art. 6(1) point (e) or (f) of the GDPR, including profiling based on those provisions.
The controller no longer processes your personal data, unless the controller demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to any processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
In the context of the use of information society services - and notwithstanding Directive 2002/58/EC - you may exercise your right to object by automated means using technical specifications.
g. Right to withdraw the consent given under data protection laws
You have the right to withdraw your declaration of consent under data protection laws at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
i. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
The supervisory authority with which the complaint has been lodged informs the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy according to Art.
Competent supervisory authority in Bavaria: https://www.lda.bayern.de/de/index.html