Data protection declaration

(8) Own services

8.1 Handling of applicant data

We offer you the opportunity to apply to us (e.g. by e-mail, post or via online application form). In the following, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

8.2 Application portal (online application form)

Our online application portal is technically managed by our service provider
d.vinci HR-Systems GmbH
Nagelsweg 37-39
20097 Hamburg (hereinafter: d.vinci)

d.vinci only provides software and computing capacity and does not otherwise influence the application process. This is commissioned processing in accordance with Art. 28 DSGVO.

The operation of our career pages is realized by so-called widgets provided by d.vinci or a portal created directly via d.vinci. These establish a direct technical connection to d.vinci as soon as you call up these pages. Thereby, an automatic data transfer takes place via your internet browser for technical operation and maintenance purposes. The following data is stored at d.vinci:

• Date and time of access
• Browser type and version
• Operating system used
• URL of the previously visited web page
• Amount of data sent
• IP address of the access

This data is stored at d.vinci exclusively for technical reasons and is not assigned to a specific person at any time. The legal basis is Art. 6 para. 1 p. 1 lit. f DS-GVO.

d.vinci HR-Systems GmbH is obliged by contract to ensure the protection of your personal data with technical and organizational measures. Thus, your data is stored in a secure operating environment that is not accessible to the public. Your data is encrypted during transmission using so-called Transport Layer Security (TLS). This means that communication between your computer and the data servers used takes place using a recognized encryption method.

8.2.1 Scope and purpose of data collection

If you send us an application, we will process your associated personal data (e.g. contact and communication data, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is Section 26 BDSG under German law (initiation of an employment relationship), Art. 6 (1) lit. b DSGVO (general contract initiation) and – if you have given your consent – Art. 6 (1) lit. a DSGVO. The consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data submitted by you will be stored in our data processing systems on the basis of Section 26 BDSG and Art. 6 (1) lit. b DSGVO for the purpose of implementing the employment relationship.

8.2.2 Data retention period

If we are unable to make you a job offer, if you reject a job offer or withdraw your application, we reserve the right to retain the data you have provided on the basis of our legitimate interests (Art. 6 Para. 1 lit. f DSGVO) for up to 6 months from the end of the application process (rejection or withdrawal of the application).

The data is then deleted and the physical application documents destroyed. Retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued storage no longer applies.

A longer storage can also take place if you have given a corresponding consent (Art. 6 para. 1 lit. a DSGVO) or if legal storage obligations oppose the deletion.

8.2.3 Inclusion in the applicant pool

If we do not make you a job offer, it may be possible to include you in our applicant pool. In the event of inclusion, all documents and details from the application will be transferred to the applicant pool in order to contact you in the event of suitable vacancies.

Inclusion in the applicant pool takes place exclusively on the basis of your express consent (Art. 6 para. 1 lit. a DSGVO). The provision of consent is voluntary and is not related to the current application process. The data subject may revoke his or her consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless there are legal reasons for retention.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.

8.2.4 Jobspreader Analytics

Jobspreader Analytics allows us to analyze our job ads including the application form and optimize them in terms of playout, content and online application process. Jobspreader Analytics is a software that allows us to perform simple, but precisely tailored usage analyses for our Jobspreader job campaigns.

Jobspreader Analytics is used to record how many users (not which ones) have accessed our careers website from a job advertisement distributed via the Jobspreader. It also records how many of these users (not which ones) started an application process on the careers site and how many users (not which ones) also completed this process, i.e. sent an application.

Using this information, we can see how job campaigns distributed via the job spreader in the placed environments with their content affect potential applicants and to what extent the career site and/or mobile career app motivates the applicant gained through the job spreader to start the application process on the site. Finally, we can also see how high the bounce rate is within the application process on the site or application. All of these insights gained with Jobspreader Analytics contribute to being able to quantitatively and qualitatively assess the Jobspreader campaign in terms of environments, content, and processes, and to optimize it if necessary

Within Jobspreader Analytics, four cookies are set that process the following information:

• Js_clid – This cookie sets a randomly assigned random jobspreader click ID. Based on this ID, it can be recognized that a – not: which – user reached the career page via an ad that was placed via the job spreader. This means that the jobspreader click ID, the corresponding job URL (from the job ad) and the current timestamp (to ensure uniqueness) are noted. This cookie is stored for 30 days and deleted after this period.
• js_startqueue – This cookie is used to track the click of a user – not: which – on the “start application” button. Here the jobspreader click ID, the current job URL and the current timestamp (to ensure uniqueness) are processed. Afterwards, the cookie is deleted.
• js_endqueue – This cookie is used to track the click of a user – not: which – in terms of the end of the application process (“End Application”). Here the jobspreader click ID, the current job URL and the current timestamp (to ensure uniqueness) are processed. The cookie is then deleted.
• js_end – This cookie is used to end this analysis upon the termination of the application process detected with the js_endqueue cookie. Before that, once again the Click -ID, the current job URL and the current timestamp (to ensure uniqueness) are processed, as well as the information that the application and this analysis is finished. So then all cookies are deleted.

In addition, we note how often the page on which Jobspreader Analytics is installed is called up (we recognize this by whether and thus how often the Jobspreader Analytics script is loaded) and how often a cookie is also loaded. From this we can see in what percentage of cases cookies are blocked per se by ad or script blockers from the user.

In addition, the IP address of the user is processed for a short time, as this is technically mandatory. However, the IP address is deleted immediately afterwards and not processed further.

a. No processing of personal data within the meaning of the GDPR

No personal data is processed with Jobspreader Analytics.

Although the IP address is mentioned as an example of a personal data in recital 30 of the GDPR, this does not mean that it always qualifies as a personal data in the sense of Art. 4 No. 1.

According to the legal definition from Art. 4 No. 1 GDPR, data is personal if it contains information that relates to an identified or identifiable person. To answer this question, the knowledge that the controller must have in order to be able to assign information to a natural person must be taken into account.

In principle, IP addresses can be traced and can therefore be personal data. In the so-called Breyer ruling in 2016, the ECJ ruled that (dynamic) IP addresses are only personal data if the website operator has means at its disposal that can reasonably be used to identify a person on the basis of his or her IP address. Legally enforceable means would also be considered for such identification by the website operator.

We do not have such means at our disposal. As a result, no personal data in the form of the IP address is processed in these specific cases

b. Processing of information pursuant to Section 25 (2) No. 2 TTDSG

Cookies that “store information” that is “absolutely necessary” may be stored without a user’s consent.

Simple cookies that assign a non-personally identifiable session ID in order to perform a simple digital usage analysis can be considered necessary within the meaning of Section 25 (2) no. 2 TTDSG.

Such simple digital usage analyses give us, as the company using them, an overview of the visitor flows on our own pages and applications. In this case, it shows which job ads are attracting interest in which environments, which job ads are actually triggering applications and to what extent, and whether the application form is guiding users well through the process or whether there are cancellations due to technical or ergonomic difficulties.

In this respect, the use of simple cookies for simple usage analyses, as in the present case, is necessary within the meaning of Section 25 (2) no. 2 TTDSG.