Data privacy policy for job applicants (m/f/d) in accordance with Art. 13 and 14 GDPR

What does this data privacy policy concern?

In order to be able to offer you optimal employment opportunities, we need to process certain information about you. The WAY Group* takes the protection of your privacy very seriously. In this data privacy policy, you will be informed about the processing of your personal data by us in the course of the application process in accordance with Art. 13 and Art. 14 GDPR.

The purpose of processing your data as part of the application process is to fill a vacancy in our group of companies or with one of our cooperation partners. Individual companies of the WAY Group act as personnel service providers with the aim of arranging for specialists and experts to work in a wide range of industries and project tasks within the meaning of § 1 (1) AÜG (the German Personnel Services Law).

The term processing includes the collection, storage, use, transmission or deletion of personal data. Personal data (hereinafter also referred to as “data”) means any information relating to an identified or identifiable natural person, the so-called data subject. This includes information such as your name or address.

We will start by informing you as to who is responsible for data processing, hereinafter called the data controller, and who you can contact if you have any questions regarding the processing of your personal data. This is followed by a description of the individual data processing procedures. At the end of this privacy policy, you will be informed about your rights as a data subject.

The legal basis for data protection can be found in the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Telemedia Data Protection Act (TTDSG).

Who is the relevant data controller?

Depending on the type and contractual partner of the employment relationship, one of the following WAY Group companies is responsible for collecting and processing your personal data:

WAY Business Solutions GmbH

WAY People+ GmbH

WAY Engineering GmbH

WAY HR Professionals & Experts GmbH

WAY Digital Solutions GmbH

Company headquarters and contact details of all data controllers**:

Frankfurter Ring 150
80807 Munich
Germany

Phone: +49 (0) 89 264831-600
E-mail: info@waygroup.de

For the efficient implementation and management of the application process, the companies of the WAY Group* jointly determine the purposes and means of processing personal data in the application process in certain cases. They then act as joint controllers within the meaning of data protection law.

Please contact us if you would like to know more about these jointly controlled processing activities, receive a summary of the roles and responsibilities of the joint controllers, and/or exercise your data protection rights in relation to jointly controlled processing of your personal data.

Has a data protection officer been appointed?

We have appointed a data protection officer who works for the companies of the WAY Group in accordance with Art. 37 ff GDPR. Their contact details are as follows:

aigner business solutions GmbH
Goldener Steig 42
94116 Hutthurm
Phone: +49 8505 91927-0
E-mail: datenschutz@waygroup.de

Pursuant to Art. 38 (4) GDPR, data subjects may consult the data protection officer on all matters relating to the processing of their personal data and the exercise of their rights under this Regulation.

Will your data be transferred?

The data processed by us in the application process will not transferred to third parties. Data might only be transferred, if you give us your consent, or on the basis of other legal bases mentioned in Art. 6 (1) GDPR. For example, we may be obliged to pass on your data to certain public bodies, such as tax authorities or law enforcement authorities, in order to fulfil legal obligations in accordance with Art. 6 (1) lit. c GDPR. Data may also be transferred on the basis of our legitimate interest in accordance with Art. 6 (1) lit. f GDPR (e.g. to lawyers, tax consultants, authorities, etc.).

In addition, we rely on external service providers, such as hosting providers or IT service providers for technical support, to offer our products and services. These processors are carefully selected and regularly reviewed by us. In addition, we enter into a contractual agreement with the service providers for the processing of data in accordance with Art. 28 GDPR (“DPA”) if this is necessary. This is a contract prescribed by data protection law that guarantees that your data will only be processed in accordance with our instructions and in compliance with the GDPR.

Where is your data processed?

If service providers based in a third country (i.e. outside the European Union or the European Economic Area) are used for data processing in the job application process, personal data may be transferred to these third countries and processed there. We would like to point out that there may not be an equivalent level of data protection in third countries. Before transferring data, we ensure that the European Commission has found this third country to provide an adequate level of data protection or that other suitable guarantees, such as EU standard contractual clauses (“SCCs”) and binding corporate rules (“BCRs”), are in place for correct data processing in the destination country.

The zvoove Recruit software is hosted by an external provider. Your data is processed on the hosting provider’s servers. Data may also be transferred to the USA. The data transfer to the USA is also based on SCCs and the use of a hosting provider that is certified in accordance with the “Data Privacy Framework”.

Purposes of processing: Management of technical infrastructure

Legal basis: legitimate interest in a reliable presentation of the job application process (Art. 6 (1) lit. f GDPR in conjunction with Art. 28 GDPR and Art. 46 (2) lit. c GDPR)

Services used and service providers: Hosting service of Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft “)). Further information from Microsoft on the subject of data protection and Azure can be found at: http://azure.microsoft.com/de-de/support/trust-center/privacy/ . The Microsoft Products and Services Data Protection Addendum (“DPA”) with attached standard data protection clauses (“SCCs”) are available at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?year=2021 .

Where does the personal data that is processed come from?

Your personal data is collected when you provide it to us during the application process in your application documents, in video or telephone interviews or in personal conversations.

What personal data is processed?

We process all data which you transmit to us in the course of the job application process. This includes the following categories of data:

Contact details,
such as first name, surname, address, telephone number and e-mail address;

Details of professional background and education,
such as job title, professional position, references, certificates and degrees;

Other information provided,
such as application photos, date of birth, nationality, information on language skills, hobbies and interests.

General log data, so-called server logs,
such as notifications of successful retrieval, the date and time of retrieval.

Special categories of personal data within the meaning of Art. 9 GDPR may also be included in the processing. This may include personal data relating to health, religious or philosophical beliefs, party or trade union membership. In addition, submitted application photos may contain personal data that is covered by the special categories of personal data. For example, information on racial and ethnic origin and health status. The sole purpose of processing this special data is to use your job application information to fill vacancies. We will not include this special information in decisions unless we are legally obliged to do so. If you do not wish this special personal data to be processed, you are free to submit new application documents that have been cleansed of this data. This procedure has no consequences for the prospects of your application.

When may we process your data?

The processing of personal data is only lawful if at least one of the following conditions is met:

the data subject has consented to the processing of their personal data for one or more purposes;
the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
the processing is necessary for the date controller in order to fulfil a legal obligation under EU-law or the law of a member state;
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
the processing is necessary for the decision on the establishment of an employment relationship or, after the establishment of an employment relationship, for its implementation or termination or for the exercise or fulfilment of the rights and obligations of an employee representative body (works council) arising from a law, a collective agreement or a works agreement (collective agreement).

What data is processed and why?

I. The storage and proper management of your data as part of the job application process within the job applicant management software zvoove Recruit serves to fill a vacancy in our group of companies or with one of our cooperation partners. The data processing is carried out for the purpose of establishing an employment relationship.

a) Application for a specific job advertisement
We publish job advertisements on our homepage and on various job portals. If you are interested in such a job offer, you can apply to us for this specific vacancy. Your application data will then only be used for the application process for this specific position and processed in accordance with Art. 6 (1) lit. b GDPR and § 26 BDSG. The job profile will be compared with your provided information including your personal data.

b) Unsolicited application
You have the option of sending an unsolicited job application to our company without reference to a specific job advertisement. These applications are also reviewed by our company and go through the job application process. Your application data will then only be used for the application process and will be processed in accordance with Art. 6 (1) lit. b GDPR and § 26 BDSG.

II. Regardless of whether you are applying for a specific vacancy or sending an unsolicited application, you can choose to enter your application data in our applicant pool for up to two years. This enables us to compare your provided information with other vacancies and, if necessary, to consider you for a vacant position. Your data will only be stored with your express consent. If you decide to be included in the applicant pool, your data will be processed on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR in the manner described here. You have the right to withdraw your consent to the storage of your data at any time. Withdrawing your consent has no negative impact on the application process for a specific position. After you withdraw your consent, your data will no longer be used as part of the application process and will be deleted from our applicant pool.

III. Furthermore, we process your data in accordance with Art. 6 (1) lit. f GDPR if this is necessary for a legitimate interest and your rights do not outweigh this legitimate interest.

Processing on this basis comes into consideration in particular if you are to be employed by one of our cooperation partners within the framework of temporary employment. As part of the application process, it is then necessary to transfer certain data to them. In the case of recruitment, the legitimate interest in the transfer is the creation of employment opportunities for you and the performance of our business activities.

In addition, general log data, so-called server logs, are automatically processed on the basis of Art. 6 (1) lit. f GDPR. If illegal use of the software is suspected, the log files can be checked and evaluated retrospectively. In order to be able to react as quickly as possible to possible errors, such as problems with the display and implementation of content, so-called error logs are created on the same basis.

IV. The processing of your data in our company may also be necessary to fulfil a legal obligation to which we are subject in accordance with Art. 6 (1) lit. c GDPR. An example of this is the fulfilment of statutory retention obligations.

How is your data processed?

We use the job application management software zvoove Recruit for data processing in the job application process.

As soon as you click on the “Send application” button, your data will be transmitted to us SSL-encrypted and processed in the job application management software. If we receive an application by e-mail, we will enter your data manually in the job application management software. Your data is stored in encrypted form in a database for which we are responsible, and which is operated by a processor.

The administration of your application data as well as communication and scheduling take place within the above-mentioned software.

With the help of a CV parser, CVs can be automatically scanned and all the information generated from them can be transferred (to the candidate portal and the skills database). The applicant matching tool makes it possible to evaluate candidates. An algorithm can be used to automatically compare requirements, qualifications and skills. The necessary skills can be defined individually or taken from the German Federal Employment Agency’s (“Bundesagentur für Arbeit”) skills catalogue.

Are you obliged to provide us with your data?

You are under no legal or contractual obligation to provide us with your data. However, the transmission of your data is necessary in order to be considered for a vacant position. There is no obligation to consent to having your data stored in the applicant pool. Without this consent, however, we cannot consider your data beyond the application process for a specific position.

When will your data be deleted?

If the processing is based on your consent, we will process your data for as long as you have given us your consent and have not revoked it (see the information on the applicant pool).

Personal data is deleted after the statutory and contractual retention periods have expired. If personal data is not subject to any retention periods, it will be deleted as soon as the stated purposes no longer apply.

If your application is not successful, your data will be deleted four months after the end of the application process.

If you are employed by our company, your application documents will be transferred to your personnel file and are then subject to the corresponding retention periods.

If we are permitted to store and process your data on the basis of a declaration of consent, your data will be stored until you withdraw your consent.

Are automated decision-making measures used?

We do not use automated processing to decide on your application – we do not use profiling, also.

What rights do you have?

Right to information
As a data subject, you have the right to request information free of charge from us as the data controller as to whether and which of your personal data is being processed by us. For this purpose, we will provide you with an overview of the processing purposes, the categories of personal data processed and the respective recipients or categories of recipients.

Rights to rectification, erasure and restriction of processing
In accordance with Art. 16 GDPR, the data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject also has the right to request the completion of incomplete personal data.

Pursuant to Art. 17 GDPR, the data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, provided that no other legal requirement precludes such erasure.

In accordance with Art. 18 GDPR, the data subject has the right to request the restriction of processing if

the accuracy of the personal data is contested,
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
the data subject objects to the processing pursuant to Art. 21 GDPR.

Right to data portability
You have the right to receive the personal data that you have provided to us from our company in a structured, commonly used and machine-readable format. If you wish to transfer this data to another controller, this transfer may not be hindered by us.

Right of objection
If we process your personal data on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right to object to the processing of your personal data at any time. Our company will then no longer process your personal data unless it can demonstrate compelling legitimate grounds that outweigh the interests, rights and freedoms of the data subject.

Right of withdrawal
If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to withdrawal.

Right of appeal
If you are of the opinion that the processing of your personal data in our company violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You can contact the relevant supervisory authority or our data protection officer.

Status of the data privacy policy
Constant development makes it necessary to adapt our data privacy policy from time to time. We reserve the right to make corresponding changes at any time. This data privacy policy has been updated in 11/2023

** For data protection inquiries, in particular for the exercise of your rights under the General Data Protection Regulation, please contact us using the contact details provided, stating the respective controller. If you are not sure which of our companies is responsible for processing your data, we will be happy to help you.