Verarbeitung personenbezogener Daten durch die für das Online-Bewerbungsverfahren verantwortliche Stelle
we want you to feel comfortable about the protection of your personal data in the course of your work and application. We take the protection of your personal data very seriously. Compliance with German and European data protection regulations is a matter of course for us. As a result, the protection of your personal data is our top priority. In accordance with the requirements of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), we hereby inform you about the processing of personal data collected about you and your rights.
As an employee, you should be aware that we as an employer process some of your personal data and are in most cases legally or contractually obliged to do so. With the following information, we would like to inform you about how we handle your personal data in detail:
- Name and contact details of the controller
Responsible for the processing of your personal data within the scope of the employment relationship is the
Ecovacs Europe GmbH
Holzstraße 2
40221 Düsseldorf
Deutschland
Contact:
Phone: +49 (0) 211 5380 4300
Fax: +49 (0) 211 5380 4301
E-Mail: info@ecovacs-europe.com
- Contact details of the data protection officer
The designated data protection officer is
DataCo GmbH
Dachauer Str. 65
80335 München
datenschutz@dataguard.de
Tel.: +49 (0) 89 7400 45840
www.dataguard.de
- Processing of personal data
Evidence of school, university and professional qualifications, e.g. certificates
b. Data processing purposes
Within the framework of the employment relationship, your personal data will be processed for the following purposes:
- Implementation of pre-contractual measures (initiation of the employment relationship)
- Establishment, implementation and termination of the employment relationship
- Accounting for your expenses and remuneration (in particular the preparation of expense calculations and pay slips)
- Documentation of your employment relationship (especially in our personnel file)
- Communication (telephone, e-mail, video conferences)
- Fulfilment of our employment contract, legal, collective agreement. Wage tax or social security obligations
- Assertion, exercise or defence of legal claims arising from the employment relationship
- Archiving for the protection of our legal claims and compliance with statutory retention obligations even after the end of the employment relationship
- Data destruction and deletion after the purpose of archiving no longer applies.
c. Legal basis of data processing
Processing on the basis of consent - Art. 6 (1) (1) lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 (1) GDPR in conjunction with § Section 26 (2) BDSG
If you consented to the processing, your data will be processed in accordance with Art. 6 (1) (1) lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 (1) GDPR in conjunction with § Section 26 (2) BDSG. Example for this is often consent to the publication of names and/or photos on the Internet/Intranet/flyers/etc.
Establishment, implementation and termination of the employment relationship, Art. 88 (1) GDPR in conjunction with Section 26 (1) BDSG, Art. 6 (1) (1) lit. b GDPR
We process your data for the purpose of establishing, implementing and terminating the employment relationship. Required for the employment relationship are usually name and address for the employment contract.
Legal obligations - Art. 6 (1) (1) lit. c GDPR
Where necessary, we are legally obliged to process your personal data. The legal basis for data processing in this case is Art. 6 (1) (1) lit. c GDPR. Our legal obligations arise in particular from the following regulations:
- Section 312 of the Social Code III (SGB III) - Certificate of employment vis-à-vis the Federal Employment Agency
- Section 28a of the Social Code IV (SGB IV) - Duty to register with the authorities
- Section 198 Social Code V (SGB V) - Obligation to register with authorities for employees subject to compulsory insurance
- Section 16(2) Working Hours Act (ArbZG) - Recording of working hours
- Sections 49, 50(2) Youth Employment Protection Act (JArbSchG) - information and submission of records to authorities
- Section 17 Minimum Wage Act (MiLoG) - Recording of working hours
- Section 27 Maternity Act (MuSchG) - Obligation to notify and keep records to supervisory authorities
- Section 17c Temporary Employment Act (AÜG) - preparation and keeping available of documents
- [please specify any other legal obligations to which you are subject].
Processing on the basis of legitimate interest - Art. 6 (1) (1) lit. f GDPR
Insofar as the processing is carried out to protect a legitimate interest of us or a third party and your interests or fundamental rights and freedoms do not outweigh the first-mentioned interest, Art. 6 (1) (1) lit. f GDPR serves us as the legal basis for the data processing. Our legitimate interest results in particular from the following reasons:
- assertion, exercise or defence of legal claims
- in the context of personnel, IT or other matters
Processing of special categories of personal data for the exercise of rights pursuant to Art. 6 (1) (1) c GDPR, Art. 9 (2) lit. b GDPR, Art. 88 (1) GDPR in conjunction with Section 26 (3) BDSG.
Insofar as the processing of special categories of personal data is necessary so that we can fulfil the rights and obligations arising from labour law, social security law and social protection, your data will be processed in accordance with Art. 9 (2) lit. b GDPR, Art. 88 (1) GDPR in conjunction with Section 26 (3) BDSG.
Processing of special categories of personal data on the basis of your consent pursuant to Art. 9 (2) lit. a GDPR
If you have consented to the processing of special categories of personal data, such as health data, religious affiliation or nationality, your data will be processed in accordance with Art. 9 (2) lit. a GDPR.
Processing of special categories of personal data that have been made public - Art. 9 (2) lit e GDPR
Insofar as special categories of personal data are processed which you have obviously made public, your data will be processed in accordance with Art. 9 (2) lit. e GDPR.
Processing for the purpose of asserting, exercising or defending legal claims or in the case of acts of the courts - Art. 9 (1) lit. f GDPR
Where necessary, your data will be processed for the purpose of asserting, exercising or defending legal claims or in the case of acts of the courts.
Processing of special categories of personal data for the purposes of preventive health care, occupational medicine or assessment of the employee's ability to work - Art. 9 (2) lit. h GDPR
Insofar as special categories of personal data are processed for the purposes of preventive health care, occupational medicine or for the assessment of the employee's ability to work, your data will be processed in accordance with Art. 9 (2) lit. h GDPR.
- Recipients or categories of recipients of the personal data
In the course of processing your personal data, we may disclose your personal data to the following recipients. We only transfer your personal data to external recipients if you have consented or if this is permitted by law. External recipients of your personal data are in particular:
- Banks
- Authorities (e.g. tax offices, Federal Employment Agency, job centres, pension insurance institutions, courts)
- Health insurance companies
- Affiliated companies
- Payroll offices
- Tax consultants
- Attorneys
- Processors such as agencies and software providers for video streaming or video conferencing
The transfer of data to the above-mentioned recipients takes place for accounting purposes, for the fulfilment of our contractual, legal, collective bargaining or social security obligations and for the assertion of legal claims. The data will also be transferred to the following order processors: the data controller, the data processor, the data processor of the data subject, the data processor of the data subject, the data processor of the data subject, the data processor of the data subject.
In addition, your data will be transferred to the following processors:
- Personio
- Transfer of personal data to a third country
Your personal data will not be transferred to third countries outside the European Union or the European Economic Area and this is not planned.
In principle, the personal data collected and generated during the provision of relevant products and services are stored on our servers in the European Union. As the providers of our software solutions, among others, offer their products and/or services on a global basis based on available resources and servers, your personal data may be transferred to or accessed from other jurisdictions outside the European Union and the European Economic Area. In particular, personal data will be transferred to the third country China und the US within the meaning of Art. 15 (2) GDPR. In order to ensure the necessary level of protection in the event of data transfer to a third country, contractual measures are agreed for this purpose. The software provider has its registered office in the United States of America, which has not been recognised as providing an adequate level of data protection. In order to ensure appropriate guarantees for the protection of the transfer and processing of personal data outside the EU, the transfer of data to and processing of data by our service providers is carried out on the basis of appropriate guarantees pursuant to Art. 46 et seq. GDPR, in particular by concluding so-called standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR.
- Duration of the storage of personal data
We will delete your personal data as soon as the purposes for storing it mentioned in section 3 no longer apply, you object to the use of your personal data (see section 9) or you withdraw your consent. However, your personal data may also be stored beyond this, in particular in the following cases:
- if there are still outstanding obligations from the contractual relationship
- if a deletion conflicts with contractual, legal (in particular from HGB, StGB and AO) or statutory retention periods
- for the assertion, exercise or defence of legal claims
- if this is required under European or national law to fulfil a legal obligation to which we are subject.
The following storage periods in particular result for us from statutory provisions:
- §§ 199 German Civil Code (BGB) -30 years (documents relating to liability cases).
- § 18a Occupational Pensions Act (BetrAVG) - 30 years (documents relating to occupational pensions.
- Section 147 (1), (3) of the German Fiscal Code (AO) - up to 10 years (documents relevant to taxation, travel plans for business trips)
- Section 257, subsection 1, no. 1, subsection 4, Commercial Code (HGB) - 10 years (payroll records)
- Section 41, subsection 1, Income Tax Act (EStG) - 6 years (salary accounts, travel expense reimbursements)
- Section 28f Social Security Code IV (SGB IV) - 5 years (remuneration records with reference to social security)
- Section 13 First Ordinance on the Implementation of the Home Work Act (HAGDV 1)) - 3 years (home work remuneration records)
- Section 7 (2) Temporary Employment Act (AÜG) - 3 years (temporary employment - business records of the hiring agency)
- Section 16 (2) Working Hours Act (ArbZG) - 2 years (working time records)
- Section 50 (2) Youth Employment Protection Act (JArbSchG) - 2 years (records)
- Section 17 (1) Minimum Wage Act (MiLoG) - 2 years (working time in the case of minimum wages under the Minimum Wage Act)
- Section 27 (5) Maternity Act - 2 years (maternity protection records)
Your data will be stored on a restricted basis if the storage is solely for the purpose of fulfilling a retention obligation.
- Data Subject Rights
You have the following rights under the GDPR:
- If your personal data is processed, you have the right to obtain information from the controller about the data stored about you (Article 15 GDPR).
- If inaccurate personal data is processed, you have the right to rectification (Article 16 GDPR).
- If the legal requirements are met, you may request the erasure or restriction of processing (Art. 17 and 18 GDPR).
- If you have consented to the data processing or if there is a contract for data processing and the data processing is carried out with the help of automated procedures, you may have the right to data portability (Art. 20 GDPR).
- If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
- Furthermore, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information. You can reach this authority at
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Telefon: 0211/38424-0
Fax: 0211/38424-999
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (e) GDPR (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) and Art. 6 (1) (f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data), Art. 21 (1) GDPR. This also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate interests for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
The objection can be made without any formalities. |
- Right to withdraw consent
If you consented to the processing by the data controller, you can withdraw your consent at any time for the future. The lawfulness of the data processing carried out on the basis of the consent until the withdrawal is not affected by this.
- Obligation to provide the data
You are obliged to provide your data. This obligation arises from ... (law, e.g., § 14 UstG, § 6 IfSG or contract).
If you do not provide the required data
- the contract with you cannot be concluded
The decision-making process is automated.
- Sources of the data
We use data that you provide to us for the purpose of the employment relationship.
This includes, but is not limited to, information about your identification (such as your name and contact details), your qualifications (educational, academic and professional), your position and attendance with us, to document your employment (such as your personnel file), to account for your expenses and pay (such as your bank details, expense claims and payslips) and to comply with reporting obligations in connection with the employment (such as your health insurance, national insurance number and tax identification number).
Other sources:
We also receive some data from other sources as required by law. Example: By providing your tax identification number, we retrieve your current wage and church tax characteristics from the tax authorities.
This information must be provided before the intended further processing.
The purpose of a processing operation regularly results from the information in the processing directory and from the data collection form.
This information obligation applies to cases where the public sector body subsequently intends to further process the data for a purpose other than that stated at the time of collection. It does not apply if the data are transferred to a third party for the same purpose as stated at the time of collection.
If the data are transferred to a third party or another data controller at the latter's request, the recipient may be obliged to provide information.