Data Privacy Policy

Implementation of Information Requirements for Website Privacy Policies

Welcome to our website. We would like to inform you about how we process your personal data in accordance with Art. 13 of the General Data Protection Regulation (GDPR).

Controller

The controller responsible for the data collection and processing described in this Privacy Policy is named in the imprint:

Website Created By

Theresa Wedeking & Vanessa Schleusener

Storage of Your IP Address

We store the IP address transmitted by your web browser for a period of seven (7) days, strictly for the purpose of identifying, restricting and eliminating attacks on our website. After seven (7) days, we delete or anonymise your IP address. The legal basis for the processing of this personal data is Art. 6(1)(f) GDPR.

Usage Data

When you visit our website, data generated through the use of the website is temporarily stored on our web server for statistical purposes in order to improve the quality of our website.

This data set contains:

• the page from which the data is requested;
• the name of the data file;
• the date and time of the request;
• the amount of data transferred;
• the access status, for example whether the file was transmitted or not found;
• a description of the type of browser used; and
• the IP address of the requesting computer, shortened to such an extent that re-identification of personal data is no longer possible.

The listed usage data is stored anonymously.

Data Transfer to Third Parties

We transfer your data to service providers that support us in operating our website and the associated processes. Where these service providers process personal data on our behalf, such processing is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR. Our service providers are bound by our instructions and contractual obligations.

Cookies

We use cookies on our website. Cookies are small pieces of data that are stored on and read from your end device. A distinction is made between session cookies, which are deleted when you close your browser, and persistent cookies, which remain stored on your device after your visit has ended.

Cookies may contain data that enables the device being used to be recognised. In some cases, however, cookies only contain information about certain settings that does not constitute personal data.

We use both session cookies and persistent cookies on our website. The data is processed in accordance with Art. 6(1)(f) GDPR and in the interest of optimising or enabling user guidance and improving our website.

Please be aware that you can configure your browser to notify you when cookies are being stored or used on the website you are visiting. This makes the use of cookies transparent to you. You can delete stored cookies at any time through your browser settings and configure your browser to prevent new cookies from being stored. If you refuse or disable cookies, please note that our website may not be displayed optimally and some functions may no longer be technically available.

Data Security

To prevent unauthorised access to your data, we have implemented technical and organisational measures. We use encryption technologies on our website. Your data is transferred to our servers and back via a connection protected by TLS encryption technology. You can recognise an encrypted connection by the lock symbol displayed in your browser’s address bar and by the address beginning with https://.

Your Rights as a User

As a website user, the GDPR grants you certain rights regarding the processing of your personal data:

1. Right of Access (Art. 15 GDPR):
   You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where this is the case, to obtain access to the personal data and the information specified in Art. 15 GDPR.
2. Right to Rectification and Erasure (Art. 16 and Art. 17 GDPR):
   You have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and, where necessary, to have incomplete personal data completed. You also have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds listed in Art. 17 GDPR applies, for example where the data is no longer necessary for the purposes for which it was collected or otherwise processed.
3. Right to Restriction of Processing (Art. 18 GDPR):
   Where one of the conditions set out in Art. 18 GDPR applies, you have the right to obtain restriction of the processing of your personal data, for example by limiting processing to storage while the relevant circumstances are being examined.
4. Right to Data Portability (Art. 20 GDPR):
   In certain circumstances specified in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request transmission of the data to another controller where the applicable legal requirements are met.
5. Right to Object (Art. 21 GDPR):
   Where personal data is processed pursuant to Art. 6(1)(f) GDPR on the basis of legitimate interests, you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.
6. Right to Lodge a Complaint with a Supervisory Authority:
   Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes applicable data protection regulations. The right to lodge a complaint may be exercised in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

Privacy Contact Details

Please contact our Privacy Contact if you have any further questions, suggestions or requests regarding data protection:

Website Privacy Policy – Recruitment

1.1 Online Application

We process your personal data in accordance with applicable data protection regulations pursuant to § 26 BDSG. We process the data you provide in the context of your online application strictly for the purpose of selecting applicants. Data will not be processed for other purposes.

You determine the amount of data you want to send in the context of your online application. Online applications are transferred electronically to our HR department and processed as quickly as possible. The transfer is encrypted. As a rule, applications are forwarded to the Managing Directors. Except for the service providers described in Sections 1.2 and 1.3 of this Privacy Policy, your data will not be transferred to third parties. Your details will be treated confidentially within our company. If the application is unsuccessful, your documents will generally be deleted after six months.

If we may also consider your application for other or future job openings, please indicate this on your application. We will then process your data on the basis of Art. 6 § 1 (a) GDPR.

1.2 Recruitment & Job Applications via HR Works

1.2.1 Processing of Personal Data During the Application Process
If you apply for a position with us, we process the personal data that you provide to us as part of your application. This may include, in particular, your name, contact details, CV, qualifications, professional experience, certificates, references and any other information you voluntarily provide in connection with your application.

We process your personal data exclusively for the purpose of carrying out the recruitment and selection process and for deciding whether to establish an employment relationship with you.

1.2.2 Use of HR Works
We use HR Works, an applicant management and recruitment platform, to manage our recruitment process.

When you apply for a position through our website, the personal data you enter and submit as part of your application is transmitted to and processed through HR Works on our behalf.

HR Works supports us with the receipt, administration and management of applications and, where applicable, communication with applicants. Your personal data is processed by HR Works in accordance with our instructions and applicable data protection laws.

1.2.3 Purpose and Legal Basis
We process your personal data for the purposes of:

• receiving and reviewing your application;
• assessing your suitability for the position;
• communicating with you during the recruitment process;
• organising and conducting interviews;
• making recruitment decisions; and
• taking steps prior to entering into an employment relationship.

The legal basis for processing your personal data in connection with the application process is Article 6(1)(b) of the General Data Protection Regulation (GDPR) and, where applicable, Section 26(1) of the German Federal Data Protection Act (BDSG), insofar as the processing is necessary for the decision to establish an employment relationship.

Where processing is based on your consent, the relevant legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

1.2.4 Recipients of Your Personal Data
Your application data may be accessed by those employees and representatives within our organisation who are involved in the recruitment process and require the information to perform their duties. Your application data is also processed through HR Works, which we use as a service provider for applicant management. Where required by applicable data protection law, we have entered into an appropriate data processing agreement with the service provider and have implemented appropriate technical and organisational measures to protect your personal data.

If personal data is transferred to recipients outside the European Union or the European Economic Area, such transfers will only take place in accordance with the applicable legal requirements and appropriate safeguards under data protection law.

1.2.5 Retention of Application Data
We retain your personal data only for as long as necessary to complete the recruitment process or to comply with applicable legal obligations.

If your application is unsuccessful, your application data will generally be deleted six months after completion of the recruitment process, unless there is a legal basis for retaining the data for a longer period or you have expressly consented to longer storage.

If you are hired, relevant information from your application may be transferred to your personnel file and subsequently processed in accordance with the data protection provisions applicable to employees.

1.2.6 Your Data Protection Rights
Subject to the applicable legal requirements, you have the right to:

• request access to the personal data we hold about you;
• request the correction of inaccurate or incomplete personal data;
• request the deletion of your personal data;
• request restriction of the processing of your personal data;
• object to certain processing of your personal data; and
• request data portability where the applicable legal requirements are met.

If the processing of your personal data is based on your consent, you may withdraw your consent at any time. To exercise any of these rights, please contact us using the contact details provided below or on our general contact page. You also have the right to lodge a complaint with a competent data protection supervisory authority.

1.3 Use of AI Systems and Cloud Services in the Application Process

As part of the application process, we may use artificial intelligence (AI) systems, in particular Large Language Models (LLMs) and AI agents, as supporting tools. Their use is limited in particular to the recording, structuring and summarisation of application documents and comparable administrative processing activities.

AI systems are not used to assess, rank or automatically pre-select applicants. Decisions within the application process are made exclusively by authorised persons.

External cloud-based service providers and platforms may also be used for AI-supported processing. In this context, personal data contained in application documents may be processed by such service providers on our behalf. We only use services whose use complies with applicable data protection requirements.

Where data is processed outside the EU/EEA in connection with AI-supported processing, such processing takes place only on the basis of appropriate safeguards in accordance with the GDPR (Chapter V, Art. 44 et seq.), for example by means of EU Standard Contractual Clauses.