Processing of (personal) data by the entity in charge of the online application process

Data protection information for applicants

This Privacy Notice fulfills the obligation to provide information pursuant to Article 13 et seq. of the General Data Protection Regulation (GDPR) and Section 32 of the BSDG (Bundesdatenschutzgesetz — Federal Data Protection Act) where personal data is collected from persons concerned for the purposes of the application process.

Name and contact details of the data controller

CARFAX Europe GmbH

Barthstraße 2-10

80339 Munich Germany

Email: info@carfax.eu

(hereinafter referred to as "CARFAX Europe GmbH," "we," "us").

Name and contact details of the data protection officer

Martin Holzhofer

Holzhofer Consulting GmbH

Lochhamer Str. 31

82152 Planegg

Germany Tel.: +49 (0) 89 1 25 01 56 00

Email: privacy@carfax.de

Purposes for which the personal data is to be processed and the legal basis for processing

Application process: In order to carry out the application process, we, as well as data processors authorized by us, process the following data from you, provided that you have disclosed this data to us during the application process or during the course of the contractual relationship:

Position applied for
Professional qualification
Personal details (first name, surname, address, telephone number, date of birth, place of birth, email address, cell phone number)
Nationality
If necessary, information about the driver's license and/or the vehicle
Information about desired working hours
Desired start date
Information about desired salary
Further information in the résumé (incl. application photo), references from previous employers, certificates

The legal basis is Article 6(1)(b) GDPR. Accordingly, the processing is necessary for the performance or termination of an employment relationship and thus for the fulfillment of an employment contract.

If you consent to the storage of your application in a candidate pool, the purpose of processing the data is to contact you to suggest comparable positions. The legal basis for this is Article 6 (1) (a) of the GDPR. Consent is voluntary and can be revoked at any time via the human resources department.

In the case of an application process with the aim of concluding a service or work contract with you as a freelance employee, we process your data as mentioned above for the purpose of carrying out pre-contractual measures. The legal basis for this is Article 6(1) (b) of the GDPR.

We may conduct interviews via a video conferencing system. These interviews are not recorded. The legal basis for video interviews is Article 6(1) (f) of the GDPR. Interests were weighed up and the conclusion was reached that the interests of the applicants concerned, partly due to the technical and organizational measures taken, do not outweigh the interests of the data controller and that the applicant concerned also has an interest in conducting an initial video interview in order to avoid travel.

Categories of data recipients

To the extent permitted by law, we share personal data externally with:

Lawyers in case of (labor-related) legal advice
Courts

In order to process the personal data for the purposes mentioned here, we appoint the following categories of recipients as data processors as defined by Article 28 of the GDPR:

Hosting and operation of an online video conferencing system
Software service provider for our document management system

Data transfer to third countries

The transfer of personal data to countries outside the European Union or the EEA ("third countries") is only based on:

An adequacy decision by the European Commission as defined by Article 45 of the GDPR.
An approved certification mechanism pursuant to Article 42 of the GDPR together with legally binding and enforceable obligations on the part of the controller or the processor in the third country.
Standard data protection clauses issued by the Commission in accordance with the examination procedure referred to in Article 93 (2) of the GDPR.

At present, in the context of the application process, data will be transmitted to countries outside the EU and the European Economic Area ("third countries") in the following cases:

Transmission of data to Zoom, 55 Almades Boulevard, Suite 600, San Jose, CA 95113 United States in conjunction with the provision and use of our video conferencing system for interviews with applicants.
Transmission of data to Egnyte Inc., 1350 W. Middlefield Road, Mountain View, CA 94043 United States in conjunction with the provision and use of our document management system.
Transmission of data to Indeed Inc., 6433 Champion Grandview Way, Building 1, Austin, TX, 78750 United States as an external applicant portal for accepting applications for job vacancies.

For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. The service provider Indeed is certified under the DPF and thus committed to complying with European data protection principles.

Obligation to provide data

If you apply for a job vacancy or give your consent to be included in our applicant pool, you are to provide the application data as referred to under figure 1. The failure to provide the data would mean that the application process cannot be carried out or inclusion in an applicant pool is not possible.

Scoring

Your personal information will not be used for automated individual decision-making, including profiling, as set out in Article 22 (1) and (4) of the GDPR.

Data sources

CARFAX Europe will process personal data we have received from you over the course of the application process.

Retention period and criteria for determining such a period

Personal data will only be retained for as long as is necessary in order to fulfil the purposes mentioned here or as stipulated by the statutory retention periods. The data will be deleted in accordance with the statutory regulations once the relevant purpose ceases to apply or after the retention periods have expired. In addition, personal data may also be stored for the duration of the exercise or defence of legal claims. Documents from unsuccessful applicants will be kept for up to six months from the day on which our rejection was sent, on the basis of the Allgemeine Gleichbehandlungsgesetz (AGG — General Act on Equal Treatment) and the Zivilprozessordnung (ZPO — Code of Civil Procedure). Your data will then be deleted in accordance with data protection.

In the event of consent to participate in the applicant pool, personal data will be stored for the duration of the consent within the legally permissible framework for a period of no more than 12 months, unless a revocation has been received beforehand.

Rights of the data subject

You have the option to make use of "rights of the data subject" at any time:

Right to access according to Article 15 of the GDPR.
Right to rectification according to Article 16 of the GDPR.
Right to erasure according to Article 17 of the GDPR.
Right to restriction of processing according to Article 18 of the GDPR.
Right to data portability according to Article 20 of the GDPR.
Right to object according to Article 21 of the GDPR.

If you wish to exercise your rights, please address your request by email to privacy@carfax.eu or by post to the above address.

Right to lodge a complaint with a supervisory authority

In addition, you have a right to lodge a complaint with a supervisory authority according to Article 77 (1) of the GDPR. For more information, contact your local supervisory authority. The supervisory authority for CARFAX Europe is

Bayerisches Landesamt für Datenschutzaufsicht (Bavaria DPA)

Postfach 1349

91504 Ansbach Germany

Telephone: +49 (0) 981 53 1300

Email: poststelle@lda.bayern.de

As of: January 2024

Unsolicited Application

Your application

Documents