Data protection information for applicants (M/F/D)
Our handling of your data and your rights
Information in accordance with Art. 13, 14, 21 of the General Data Protection Regulation (GDPR)
The following information provides you as an applicant (m/f/d) with an overview of the processing of your personal data by us and your rights.
1) Who is responsible for data processing and who can I contact?
The responsible body is the
Notary Dr. Benjamin Schmitz
Posthof 6
53783 Eitorf
02243/88050
info@notar-eitorf.de
Our Data Protection Officer You can reach us at:
GDI Gesellschaft für Datenschutz und Informationssicherheit mbH
Mr. Dipl.-Inform. Olaf Tenti
Körnerstr. 45, 58095 Hagen
Phone: +49 (0) 2331/356832-0
E-Mail: datenschutz@gdi-mbh.eu
2) What sources and data do we use?
We process data that you send us as part of your application or that we have received from third parties (e.g. the Federal Employment Agency) with your permission. This processing takes place to initiate an employment relationship and therefore necessarily before an employment contract is concluded.
In particular, the following personal data and categories of data are processed for the purposes mentioned in section 3:
- Personal data (e.g. first name, surname, address, contact details, marital status)
- Data on your qualifications (e.g.: Educational and professional qualifications, certificates, language skills, additional qualifications)
- Data on your curriculum vitae (e.g.: Type, start, end, location and duration of school education, training, studies, further training and professional activities)
- Other documents submitted and resulting information
- Account details in the context of cost reimbursement, if applicable
We may also process personal data about you that we have obtained from publicly accessible sources (e.g. information in social networks such as Xing or LinkedIn).
3) What do we process your data for (purpose of processing) and on what legal basis?
In the following, we will inform you what we process your data for and on what legal basis.
3.1) Purposes of the employment relationship
We process your data to decide on the establishment of an employment relationship with you. The legal basis for processing is therefore Art. 88 GDPR in conjunction with Section 26 (1) of the Federal Data Protection Act (BDSG).
We would like to assess all applicants solely on the basis of their qualifications and therefore ask you to refrain from providing information on racial and ethnic origin, political opinions, religious or ideological beliefs or trade union membership, genetic data, biometric data for the unique identification of a natural person, health data or data on sex life or sexual orientation in your application wherever possible.
3.2) Based on your consent
If you have given us your consent to the processing of personal data, in particular the processing of any special categories of personal data provided, we process the data provided in accordance with Art. 6 para. 1 lit. a GDPR or, in the case of special categories of personal data, Art. 9 para. 2 lit. a GDPR.
This applies in particular to your possible consent to the further storage of the data in an applicant pool even in the event that your current application is rejected in the event that we have a renewed need at a later date.
Consent can be withdrawn at any time with effect for the future. Processing that took place before the revocation is not affected by this. A revocation can be sent to the office named under point 1.
We may also use your data on the basis of a balancing of interests to protect our legitimate interests or those of third parties (see Art. 6 para. 1 lit. f GDPR). This can be done in particular for the following purposes:
- General business management
- Assertion of legal claims and defense in legal disputes
- Prevention and investigation of criminal offenses
- Ensuring IT security and IT operations
Our interest in the respective processing arises from the respective purposes and is otherwise of an economic nature (efficient fulfillment of tasks, sales, avoidance of legal risks).
3.4) In the context of cost reimbursement
If we have promised you reimbursement of costs, e.g. for travel expenses to a job interview, we will process your account data to reimburse these costs. The legal basis is the fulfillment of our promise to reimburse costs within the meaning of Art. 6 para. 1 lit. b GDPR.
4) Who receives my data?
Your data will only be passed on if a legal basis permits this. The data mentioned under point 2 will be transmitted to public bodies and institutions if there is a legal obligation to do so or if you have given your consent to this transmission. Such public authorities may include, in particular, the tax authorities, the customs administration, but also the trade supervisory authorities.
Within our company, only those departments receive your data that need it to fulfill our contractual and legal obligations or to fulfill their respective tasks
Furthermore, personal data may be transmitted for the purpose of and within the scope of order processing (Art. 28 GDPR), in particular to IT service providers.
5) How long will the data be stored?
We process your personal data for the selection of a suitable candidate for the vacant position. The data will then be deleted, at the latest when no more civil law claims can be asserted against us, which may arise in particular from the General Equal Treatment Act. If we do not delete the data immediately, we will block the data.
6) Is data transferred to a third country?
Your data will only be transferred to countries outside the European Economic Area - EEA (third countries) if and insofar as this is necessary for the execution of the contractual relationship or required by law (e.g. accounting, administration) or if you have given us your consent.
If we use software from providers based in third countries or software from providers with subcontractors/service providers in third countries as part of the application process, your data or parts of your data may be transferred to third countries (e.g. to the USA), depending on the purpose of processing.
An adequacy decision within the meaning of Art. 45 para. 3 GDPR exists for the USA. As a result, personal data can now be transferred from the EU to companies and organizations in the USA that have certified themselves for the EU-U.S. Data Privacy Framework without the need for further protective measures. This adequacy decision thus serves as the basis for the transfer of data to the service providers we use in the USA.
If there is no adequacy decision within the meaning of Art. 45 para. 3 GDPR or the company or organization in the USA has not certified itself for the EU-U.S. Data Privacy Framework, we conclude standard data protection clauses issued by the EU Commission within the meaning of Art. 46 para. 2 lit. c GDPR with the respective service providers/providers to protect your data. Furthermore, some of our service providers have implemented binding corporate rules (BCR) within the meaning of Art. 47 GDPR for their group of companies or the same group of companies, which have been approved by the respective competent supervisory authority.
7) What other data protection rights do I have?
You have the right to information (Art. 15 GDPR, § 34 BDSG), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR, § 35 BDSG), to restriction of processing (Art. 18 GDPR), to object (Art. 21 GDPR) and to data portability (Art. 20 GDPR) under the respective legal requirements.
You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR, Section 19 BDSG).
8) To what extent is there automated decision-making in individual cases?
We do not use automated decision-making in accordance with Art. 22 GDPR to decide on the establishment of an employment relationship with you. Should we use these procedures in individual cases, we will inform you of this separately if this is required by law.
9) To what extent will my data be used for profiling?
We do not process your data with the aim of evaluating certain personal aspects (so-called "profiling").
10) Do I have an obligation to provide data?
You are neither legally nor contractually obliged to provide personal data as part of the application process. We would like to point out that our ability to assess your skills and knowledge depends on the data you provide. If you do not provide any data, our assessment may not reflect your actual suitability for the position to be filled, which means that you may not be considered for employment.
As part of any recruitment process, we collect certain data that we need to fulfill the contract (e.g. to pay the salary) or that we are legally obliged to collect (e.g. social security data).
11) What rights of objection do I have? (Art. 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
The objection can be made informally and should preferably be addressed to the contact options listed under point 1.
Status: September 25, 2024