Processing of (personal) data by the entity in charge of the online application process

Privacy Notice for Applicants

1. General

We provide this privacy notice to inform you about how we process your personal data as part of the application process. This notice applies to applications you submit via our recruiting page or our Personio application form, or by email.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, your contact details, information about your professional background, and the application documents you submit.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

rayon GmbH
Schulterblatt 36
20357 Hamburg
Phone: +49 40 28530963-0

Commercial register entry: HRB 188975, Register court: Amtsgericht Hamburg

3. Data Protection Officer

You can reach our Data Protection Officer at:

Nextwork GmbH, represented by Marco Peters
Email: datenschutz@nextwork.de

4. What data do we process?

As part of your application, we process in particular the following personal data, insofar as you provide it to us:

First and last name and, where applicable, further contact details,
email address and, where applicable, phone number,
information about the desired position and your possible start date,
information about your professional background, education, qualifications, and work experience,
cover letter, CV, references, and other application documents,
information from our communication with you as well as interview notes, insofar as these are necessary for the application process,
data for the administration and documentation of the application process, for example application status and timestamps.

As a matter of principle, please do not send us any special categories of personal data within the meaning of Art. 9 (1) GDPR unless these are necessary for the application process. Should such data be processed in exceptional cases, this will only take place insofar as it is legally permissible and necessary for the application process.

5. Purposes and legal bases of the processing

We process your personal data for the following purposes:

to assess your application and your professional and personal suitability for the advertised position,
to conduct and document the application process,
to communicate with you, in particular to arrange and conduct interviews,
to decide on the establishment of an employment relationship and to prepare a possible employment contract,
to fulfill legal obligations as well as to assert, exercise, or defend legal claims.

The legal basis for processing your application data is Section 26 (1) sentence 1 of the Federal Data Protection Act (BDSG). Insofar as the processing is necessary for carrying out pre-contractual measures, Art. 6 (1) (b) GDPR may additionally be relied upon. Insofar as we process data to fulfill legal obligations or to assert, exercise, or defend legal claims, this is done on the basis of Art. 6 (1) (c) or (f) GDPR.

Providing the data required for the application is voluntary. However, without this data we cannot process your application, or can only process it to a limited extent.

6. Processing by Personio

To conduct the application process, we use the recruiting software of Personio SE & Co. KG, Seidlstraße 3, 80335 Munich. Personio processes your application data on our behalf and on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The data you submit is transmitted using TLS encryption and stored in the recruiting platform. Personio provides us with the technical platform for managing applications, communicating during the application process, and enabling collaboration among the persons involved in the process.

Personio may engage additional sub-processors to provide its services. A current overview of the sub-processors used, as well as further information on data protection and security, is made available by Personio in the customer account and in the Personio Trust Center: https://trust.personio.com/. 

Insofar as personal data is processed outside the European Economic Area in the course of providing the services, this is only carried out in compliance with the requirements of Art. 44 et seq. GDPR. In particular, adequacy decisions of the European Commission or appropriate safeguards such as standard data protection clauses are used.

7. Who receives your data?

Within our company, access to your application data is granted only to those persons who are involved in the preparation, conduct, and decision-making of application processes and who require the corresponding authorization for this. This may include, in particular, persons from the HR department as well as the managers and team members responsible for the respective position.

Data is disclosed to further recipients only where this is necessary for the application process, legally permitted, or legally required. Your application data is not transmitted for advertising purposes.

8. How long do we store your data?

As a matter of principle, we store your personal data only for as long as necessary to conduct and complete the application process.

If your application is not successful, we generally store your application data for six months after completion of the application process or after notification of the rejection decision. This storage serves in particular to enable us to examine possible claims under the General Equal Treatment Act (AGG) and to assert, exercise, or defend any legal claims.

After this period expires, your application data will be deleted, unless longer storage is required due to a specific legal dispute, for the assertion, exercise, or defense of legal claims, or due to statutory retention obligations.

If you are hired by us, such application data may be transferred to our employee records where it is necessary for carrying out the employment relationship. Application documents that are not required will be deleted as soon as they are no longer needed for the application process and the employment relationship. Separate privacy notices apply to employee data.

9. No solely automated decision-making

No solely automated decision-making within the meaning of Art. 22 GDPR takes place as part of the application process. The final decision on your application is made by duly authorized persons.

10. Technical data and cookies on the recruiting page

When visiting the recruiting page, technically necessary data may be processed and cookies may be used that are required for the secure and functional operation of the page. This privacy notice primarily concerns the processing of your application data by us. For processing that Personio carries out under its own data protection responsibility when technically operating the recruiting page, the privacy notice of Personio applies additionally: https://www.personio.de/datenschutzerklaerung/. 

Insofar as optional analytics, marketing, or tracking technologies are used on the recruiting page, we will inform you about this separately and, where necessary, obtain your consent.

11. Your data protection rights

Subject to the statutory requirements, you have the following rights:

Right to information about the data stored about you (Art. 15 GDPR),
Right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
Right to erasure of your data (Art. 17 GDPR),
Right to restriction of processing (Art. 18 GDPR),
Right to data portability, insofar as the statutory requirements are met (Art. 20 GDPR),
Right to object to the processing, insofar as the statutory requirements are met (Art. 21 GDPR).

Insofar as we process your personal data on the basis of your consent, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

To exercise your rights, you can contact the controller or our Data Protection Officer. You can find the contact details in sections 2 and 3.

12. Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint about the processing of your personal data with a data protection supervisory authority. The competent authority is in particular:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Phone: +49 40 428 54-4040
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de/ 

13. Currency and amendment of this privacy notice

We may adapt this privacy notice if legal requirements, our application process, or the technical systems we use change. The version of this privacy notice valid at the time applies to your renewed visit to our recruiting page or a renewed application.

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.