Data Protection Declaration for Candidates

Processing of personal data by the person responsible for the online application procedure.

We provide you with this data protection statement, which relates exclusively to the data collected during the application process, to inform you about how we handle the personal data collected during the application process.

Personal data within the scope of the application process

Personal data is information about personal or factual circumstances of an identified or identifiable natural person. This includes information such as your name, your address, your telephone number and your date of birth, but also data about your specific career, etc., which can be assigned to a specific person with reasonable effort.

Application procedure

We process your applicant data exclusively for the purpose and within the scope of the application procedure in accordance with the legal requirements. The processing of applicant data is carried out to fulfil our (pre-)contractual obligations within the framework of the applicant selection procedure in accordance with Art. 6 Para. 1 lit. b. DSGVO as well as § 26 BDSG, if the data processing is necessary for us, e.g. in the context of legal procedures.

The application procedure requires that applicants send us their application documents. The required applicant data are marked in the online form and otherwise result from the job descriptions. In principle, this includes personal details, address and contact details as well as the documents belonging to the application, such as cover letter, CV and certificates. In addition, applicants can voluntarily provide us with additional information.

By submitting their application to us, applicants agree to the processing of their data for the purposes of the applicant selection procedure in accordance with the type and scope described in this data protection declaration.

Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 DSGVO are voluntarily communicated as part of the application procedure, their processing is additionally carried out in accordance with Art. 9 Para. 2 letter b DSGVO (e.g. health data, severely disabled status or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 DSGVO are requested from applicants as part of the application procedure, their processing is also carried out in accordance with Art. 9 Para. 2 letter a DSGVO (e.g. health data if this is necessary for the exercise of the profession).

Applicants can send us their applications by means of an online form on our website. The data is transmitted to us in encrypted form according to the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form and that applicants must ensure that they are encrypted themselves. We cannot therefore accept any responsibility for the transmission path of the application and therefore recommend that you use an online form or send it by post. In addition to an application via the online form and by e-mail, it is also possible to send us the application by post.

If the application for a job offer is not successful, the applicants' data will be deleted. Applicants' data is also deleted if an application is withdrawn, which applicants are entitled to do at any time.

Subject to a justified revocation by the applicants, the data will be deleted after a period of six months so that we can answer any follow-up questions regarding the application and meet our obligations to provide evidence under the Equal Treatment Act. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.

The following third-party providers are used to carry out the online application procedure:

Used services and service providers:

• Vincere: applicant management system and candidate database. Service provider: HiringBoss Holdings Pte Ltd 120 Robinson Road, #15-01 068193, Singapore Singapore Singapore; website: https://www.vincere.io , privacy policy: https://www.vincere.io/privacy , https://www.vincere.io/termsofservice-old.

Vincere processes the data of candidates on our behalf and on the basis of contractual obligations that provide for compliance with the agreed organisational and technical measures (within the meaning of article 28, paragraph 3, sentence 1 DSGVO). Vincere is used on the basis of our legitimate interests, as well as the interests of the candidates in carrying out a rapid and effective candidate selection process (within the meaning of article 6, paragraph 1, letter f. of the DPA).

• HR4you: Candidate management system and candidate database. Service provider: HR4you GmbH, website: (https://www.hr4you.de ), data protection declaration: https://www.hr4you.de/datenschutz .

HR4you processes the data of the candidates on our behalf and on the basis of contractual obligations, which provide for compliance with the agreed organisational and technical measures (in terms of Art. 28 para. 3 clause 1 DSGVO). The employment of HR4you takes place on the basis of our legitimate interests, as well as the interests of the applicants in the execution of a fast and effective applicant selection procedure (in the sense of article 6 paragraph 1 letter f. DSGVO).

Talent pool

As part of the application process, we offer applicants the opportunity to be included in our "pool of applicants" for a period of one year on the basis of a consent in the sense of Art. 6 para. 1 lit. b. and Art. 7 DSGVO.

The application documents in the applicant pool will be processed solely in the context of future job advertisements and will be destroyed at the latest after the expiry of the period of one year. Admission to the talent pool is voluntary and has no influence on the current application procedure. This consent is voluntary and can be revoked at any time for the future.

Job interviews

We use platforms and applications of other providers (hereinafter referred to as "third-party providers") for the purpose of conducting and planning audio conferences (job interviews). When selecting third-party providers and their services, we observe the legal requirements.

Within this framework, data of the communication participants are processed and stored on the servers of the third party providers, insofar as they are part of communication processes with us. This data may include, in particular, registration and contact data, visual and vocal contributions, as well as entries in chats and shared screen content.

If applicants are referred to the third-party providers or their software or platforms in the course of communication, business or other relations with us, the third-party providers may process usage data and metadata for security, service optimization or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal bases: If we ask applicants for their consent to use the third party providers, the legal basis for processing is consent. Furthermore, their use can be a component of our (pre)contractual services (applicant selection procedure), provided that the use of the third-party providers has been agreed in this context. Otherwise, user data is processed on the basis of our legitimate interest in efficient and secure communication with our communication partners. In this context we would like to refer you additionally to the information on the use of cookies in this data protection declaration.

• Processed data types: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: applicants, users (e.g. website visitors, users of online services).
• Purposes of processing: applicant selection procedure, office and organisational procedures.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO), fulfilment of contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO).

Services used and service providers:

• Teams: messenger and conference software; service providers: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; website: https://www.microsoft.com/de-de/, https://www.microsoft.com/de-de/microsoft-365/microsoft-teams/group-chat-software; privacy policy: https://privacy.microsoft.com/de-de/privacystatement ;

We do not record job interviews.

• Microsoft Bookings: Booking and management of online appointments (job interviews); service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://www.microsoft.com/de-de/microsoft-365/business/scheduling-and-booking-app; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement

Active sourcing

As a personnel consultancy that identifies and approaches potential candidates on behalf of clients, information and data of potential candidates are collected and processed from publicly available sources. The persons concerned are contacted by us and approached about a specific vacancy. In the course of the contact, information on data protection as well as consent for storage is also obtained. Candidates who do not consent to processing or are not contacted by us will be deleted or blocked.

You can find out your rights as a data subject here: https://www.constares.de/datenschutz.html. In addition to this data protection declaration, you can view our general data protection declaration at https://www.constares.de/datenschutz.html.

Status: July 27, 2020