Skip to main content

Processing of (personal) data by the entity in charge of the online application process


Privacy Notice pursuant to Art. 12 et seq. GDPR for applicants


Dear Madam,

Dear Sir,

Dear applicant,

due to the legal regulations of the European General Data Protection Regulation (hereinafter referred to as “GDPR”) we are obliged to provide you with comprehensive information about the processing of your personal data within the scope of your application, which we are very happy to do.

Data protection and the handling of your personal data is very important to us, so that we always ensure that your personal data is processed properly.

If you have any questions about your applicant data and its processing, our data protection officer will be happy to answer them at any time. He is not subject to any instructions, is independent in his position and legally obliged to maintain secrecy and confidentiality, so that you can contact him in confidence.

With regard to the processing of your personal data within the scope of your application process, we would like to inform you of the following:

I. Identity and contact details of the controller

Your contact point as controller within the meaning of the GDPR and other national data protection regulations of the member states as well as other provisions of data protection law is:

     GOPA Worldwide Consultants GmbH

     Hindenburgring 18

     61348 Bad Homburg

     Germany

     Tel.: +49 6172 930 0

(hereinafter “we”, “us” or “our”)


II. Contactdetails of the data protection office

Our data protection officer can be contacted at the following address:

     MAGELLAN Compliance GmbH
     Nördliche Münchner Straße 27A, 82031 Grünwald, Germany
     Tel.: +49 89 5880316-40
     Email address: privacy_gopa_group@magellan-legal.de

III. Data processing within the application proces

1. Legal basis

i. Personal data
Insofar as we obtain your consent for the processing of personal data, Art. 6 (1) lit. a GDPR, Art. 88 (1) GDPR and § 26 (2) Bundesdatenschutzgesetz (BDSG) is the legal basis.

In the processing of personal data, which is necessary for hiring decisions, Art. 6 (1) lit. b GDPR, Art. 88 (1) GDPR and § 26 (1) BDSG, § 611a Bürgerliches Gesetzbuch (BGB) is the legal basis.

Insofar as the processing of personal data is necessary to comply with a legal obligation to which we are subject, Art. 6 (1) lit. c GDPR is the legal basis.

In the event that vital interests of you or another natural person make it necessary to process personal data, Art. 6 (1) lit. d GDPR is the legal basis.

If the processing is necessary to safeguard a legitimate interest of ours or of a third party and if your interests, fundamental rights and freedoms do not override the former, Art. 6 (1) lit. f GDPR is the legal basis for the processing.

ii. Special categories of personal data
Insofar as we obtain your consent for the processing of special categories of personal data (Art. 9 (1) GDPR) such as religious affiliation, nationality and health data, Art. 9 (2) lit. a GDPR is the legal basis.

If the processing of special categories of personal data is necessary to enable us to exercise our rights under labor law, social security and social protection law and to comply with our obligations in this respect, the legal basis for processing is Art. 9 (2) lit. b GDPR, Art. 88 (1) GDPR and § 26 (3) BDSG.

If the processing of special categories of personal data is necessary for the protection of vital interests, the legal basis for the processing is Art. 9 (2) lit. c GDPR.

If the processing relates to special categories of personal data which have manifestly been made public by you, the legal basis is Art. 9 (2) lit. e GDPR.

If the processing of special categories of personal data is necessary for the purposes of preventive or occupational medicine or for the assessment of the working capacity of the employee, the legal basis is Art. 9 (2) lit. h GDPR.

2. Purpose

Your personal data will be processed for the purpose of establishing the employment relationship, in particular for the fulfilment of contractual, legal, if applicable, collective agreement and social security obligations.

3. Duration of storage

Your personal data are erased or blocked as soon as they are no longer necessary to achieve the purpose for which they were stored. Furthermore, data may be stored if this has been provided for by the European or national legislator in Union regulations, laws or other regulations to which we are subject. Data will also be erased or blocked if a storage period prescribed by the aforementioned standards expires, unless it is necessary to continue storing the data in order to conclude or fulfil a contract.
Afterwards we store your data for the following periods, among others:
  • Application files and application data will be stored for up to 6 months after the decision not to appoint a candidate, on the basis of the burden of proof of discrimination according to the legal term of §§ 21 (5), 22 Allgemeines Gleichbehandlungsgesetz (AGG).
  • Application documents will otherwise be stored until the dissolution or termination of the employment relationship.

4. Objection and rectification option

The processing of your personal data within the application process is mandatory for the establishment of the employment relationship. Consequently, there is no possibility to object.

If the processing of your personal data is based on consent, you have the possibility to withdraw your consent at any time.

IV. Defending and enforcing legal claims

1. Legal basis 

The legal basis for the processing of your personal data in the context of legal defense and enforcement is Art. 9 (2) lit. f and Art. 6 (1) lit. f GDPR.

2. Purpose 

The purpose of processing your personal data in the context of defending and enforcing legal claims is the defence of unjustified claims and the legal enforcement of claims and rights.

3. Duration of storage

The data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected.

4. Objection and rectification option

The processing of your personal data in the context of defending and enforcing legal claims is absolutely necessary for the defence and enforcement thereof. Consequently, you cannot object to this.

V. Categories of recipients

Within our company, the following offices and departments receive personal data that they need to fulfil the aforementioned purposes. In some cases, we use various types of service providers and transfer your personal data to other trusted recipients. These can include:
  • human resources department
  • possible superiors of the applicant concerned
  • other departments
  • financial accounting
  • works council
  • data protection officer
  • severely disabled representatives
  • equal opportunities officer
  • controlling/auditing
  • integration office in case of severe disability
  • banking institutions
  • insurance companies
  • external service providers
  • document shredder
  • IT service provider
  • lawyers, courts, tax consultant

VI. Your rights

You have the following rights against us:

1. Right of access

You have the right to access as to whether or not and, if so, which personal data related to you are being processed by us. Is this the case, we will additionally give you access to the following:
(1) the purpose of the processing,
(2) the categories of data,
(3) the recipients of your personal data,
(4) the envisaged period of storage or the criteria used to determine the envisaged period of storage,
(5) any other rights you have,
(6) where we have not obtained the personal data from you: any available information as to their source, and
(7) if available: the existence of automated decision-making and any information about the logic involved, as well as the significance and the envisaged consequences of the processing.

2. Right to rectification

You have the right to rectification and/or completion of the personal data that is being processed by us, if it is inaccurate or incomplete.

3. Right to restriction of processing

You have the right to restriction of processing of your personal data, provided that one of the following applies:
(1) we verify the accuracy of your personal data being processed by us,
(2) the processing of your personal data is unlawful,
(3) you need the personal data being processed by us for the purpose of prosecution when we no longer need your personal data for the purpose of processing, or
(4)you have objected to the processing of your personal data and we are in the process of verifying your objection.

4. Right to erasure

You have the right to erasure of your personal data, provided that one of the following grounds apply:
(1) we no longer need your personal data for its original purpose,
(2) you withdraw your consent and there is no other legal ground for processing your personal data,
(3) you object to the processing of your personal data and, unless it is about direct marketing, there are no overriding grounds for further processing,
(4) the processing of your personal data is unlawful,
(5) the erasure of your personal data is required by law, or
(6) your personal data have been collected in relation to the offer of information society services when you were a minor.

5. Right to notification

If you have asserted your right to rectification, erasure of data or restriction of processing, we will communicate any rectification, erasure of data or restriction of processing to any recipients of your personal data.

6. Right to data portability

You have the right to receive your personal data processed by us on the basis of your consent or for the performance of a contract in a structured, commonly used and machine-readable format as well as to transmit them to another controller. If it is technically feasible, you have the right to have them directly transmitted from us to another controller.

7. Right to object

You have the right to object to the processing of your personal data on particular grounds. If this is the case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.
If your personal data is being processed for the purpose of direct marketing, you have the right to object at any time.

8. Right to withdraw

You have the right to withdraw your consent given to us at any time. The withdrawal of the consent does not affect the lawfulness of the processing carried out based on the consent before your withdrawal.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, if you believe that the processing of your personal data by us violates the provisions of the GDPR.
The competent supervisory authority for us is:

     Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
     The Hessian Commissioner for Data Protection and Freedom of Information
     Gustav-Stresemann-Ring 1
     65189 Wiesbaden
     Tel.: 0611-1408 0
     Email address: poststelle@datenschutz.hessen.de

If you have any questions, please do not hesitate to contact our data protection officer at any time.

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.