Processing of (personal) data by the entity in charge of the online application process
Processing of (personal) data by the entity in charge of the online application process
Data protection information for applicants
This Privacy Notice fulfills the obligation to provide information pursuant to Article 13 et seq. of the General Data Protection Regulation (GDPR) and Section 32 of the BSDG (Bundesdatenschutzgesetz — Federal Data Protection Act) where personal data is collected from persons concerned for the purposes of the application process.
Name and contact details of the data controller
CARFAX Europe GmbH
Barthstraße 2-10
80339 Munich Germany
Email: info@carfax.eu
(hereinafter referred to as "CARFAX Europe GmbH," "we," "us").
Name and contact details of the data protection officer
Martin Holzhofer
Holzhofer Consulting GmbH
Lochhamer Str. 31
82152 Planegg
Germany Tel.: +49 (0) 89 1 25 01 56 00
Email: privacy@carfax.de
Purposes for which the personal data is to be processed and the legal basis for processing
Application process: In order to carry out the application process, we, as well as data processors authorized by us, process the following data from you, provided that you have disclosed this data to us during the application process or during the course of the contractual relationship:
- Position applied for
- Professional qualification
- Personal details (first name, surname, address, telephone number, date of birth, place of birth, email address, cell phone number)
- Nationality
- If necessary, information about the driver's license and/or the vehicle
- Information about desired working hours
- Desired start date
- Information about desired salary
- Further information in the résumé (incl. application photo), references from previous employers, certificates
The legal basis is Article 6(1)(b) GDPR. Accordingly, the processing is necessary for the performance or termination of an employment relationship and thus for the fulfillment of an employment contract.
If you consent to the storage of your application in a candidate pool, the purpose of processing the data is to contact you to suggest comparable positions. The legal basis for this is Article 6 (1) (a) of the GDPR. Consent is voluntary and can be revoked at any time via the human resources department.
In the case of an application process with the aim of concluding a service or work contract with you as a freelance employee, we process your data as mentioned above for the purpose of carrying out pre-contractual measures. The legal basis for this is Article 6(1) (b) of the GDPR.
We may conduct interviews via a video conferencing system. These interviews are not recorded. The legal basis for video interviews is Article 6(1) (f) of the GDPR. Interests were weighed up and the conclusion was reached that the interests of the applicants concerned, partly due to the technical and organizational measures taken, do not outweigh the interests of the data controller and that the applicant concerned also has an interest in conducting an initial video interview in order to avoid travel.
Categories of data recipients
To the extent permitted by law, we share personal data externally with:
- Lawyers in case of (labor-related) legal advice
- Courts
In order to process the personal data for the purposes mentioned here, we appoint the following categories of recipients as data processors as defined by Article 28 of the GDPR:
- Hosting and operation of an online video conferencing system
- Software service provider for our document management system
Data transfer to third countries
The transfer of personal data to countries outside the European Union or the EEA ("third countries") is only based on:
- An adequacy decision by the European Commission as defined by Article 45 of the GDPR.
- An approved certification mechanism pursuant to Article 42 of the GDPR together with legally binding and enforceable obligations on the part of the controller or the processor in the third country.
- Standard data protection clauses issued by the Commission in accordance with the examination procedure referred to in Article 93 (2) of the GDPR.
At present, in the context of the application process, data will be transmitted to countries outside the EU and the European Economic Area ("third countries") in the following cases:
- Transmission of data to Zoom, 55 Almades Boulevard, Suite 600, San Jose, CA 95113 United States in conjunction with the provision and use of our video conferencing system for interviews with applicants.
- Transmission of data to Egnyte Inc., 1350 W. Middlefield Road, Mountain View, CA 94043 United States in conjunction with the provision and use of our document management system.
- Transmission of data to Indeed Inc., 6433 Champion Grandview Way, Building 1, Austin, TX, 78750 United States as an external applicant portal for accepting applications for job vacancies.
For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. The service provider Indeed is certified under the DPF and thus committed to complying with European data protection principles.
Obligation to provide data
If you apply for a job vacancy or give your consent to be included in our applicant pool, you are to provide the application data as referred to under figure 1. The failure to provide the data would mean that the application process cannot be carried out or inclusion in an applicant pool is not possible.
Scoring
Your personal information will not be used for automated individual decision-making, including profiling, as set out in Article 22 (1) and (4) of the GDPR.
Data sources
CARFAX Europe will process personal data we have received from you over the course of the application process.
Retention period and criteria for determining such a period
Personal data will only be retained for as long as is necessary in order to fulfil the purposes mentioned here or as stipulated by the statutory retention periods. The data will be deleted in accordance with the statutory regulations once the relevant purpose ceases to apply or after the retention periods have expired. In addition, personal data may also be stored for the duration of the exercise or defence of legal claims. Documents from unsuccessful applicants will be kept for up to six months from the day on which our rejection was sent, on the basis of the Allgemeine Gleichbehandlungsgesetz (AGG — General Act on Equal Treatment) and the Zivilprozessordnung (ZPO — Code of Civil Procedure). Your data will then be deleted in accordance with data protection.
In the event of consent to participate in the applicant pool, personal data will be stored for the duration of the consent within the legally permissible framework for a period of no more than 12 months, unless a revocation has been received beforehand.
Rights of the data subject
You have the option to make use of "rights of the data subject" at any time:
- Right to access according to Article 15 of the GDPR.
- Right to rectification according to Article 16 of the GDPR.
- Right to erasure according to Article 17 of the GDPR.
- Right to restriction of processing according to Article 18 of the GDPR.
- Right to data portability according to Article 20 of the GDPR.
- Right to object according to Article 21 of the GDPR.
If you wish to exercise your rights, please address your request by email to privacy@carfax.eu or by post to the above address.
Right to lodge a complaint with a supervisory authority
In addition, you have a right to lodge a complaint with a supervisory authority according to Article 77 (1) of the GDPR. For more information, contact your local supervisory authority. The supervisory authority for CARFAX Europe is
Bayerisches Landesamt für Datenschutzaufsicht (Bavaria DPA)
Postfach 1349
91504 Ansbach Germany
Telephone: +49 (0) 981 53 1300
Email: poststelle@lda.bayern.de
As of: January 2024