DATA PRIVACY NOTICE FOR THE ONLINE APPLICATION PROCEDURE
1. Name and contact details of the controller
The entity which determines the purposes and means of the processing of personal data (controller) pursuant to GDPR and the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) is:
ElectronicPartner Handel SE
Mündelheimer Weg 40
2. Contact details of the data protection officer
Please contact our data protection officer if you have any questions about data protection:
ElectronicPartner Handel SE
Data Protection Officer
Mündelheimer Weg 40
3. Processing purposes and legal bases
Personal data is processed for the purpose of taking steps prior to entering into an employment relationship. The legal basis is Art. 6 (1) b) GDPR in conjunction with section 26, sub-section 1 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). In some cases you will have provided your consent to the processing of your personal data pursuant to Art. 6 (1) a) and 7 GDPR in conjunction with section 26 BDSG. If your data is processed on the basis of your consent you have the right to revoke your consent with future effect at any time.
Sometimes processing is necessary for the purposes of the legitimate interests pursued by us or by a third party (e.g. one of our subsidiaries). Such a legitimate interest exists, in particular, if the processing of your personal data is necessary for the investigation of criminal offences (in this case the legal basis is Art. 6 (1) f) GDPR in conjunction with section 26, sub-section 1, sentence 2 BDSG) or in an intra-group data exchange process for administration purposes (in this case the legal basis is Art. 6 (1) f) GDPR).
If you voluntarily provide certain categories of data to us during the application process as set out in Art. 9 (1) GDPR, they will be processed for the purpose of exercising rights or carrying out obligations in the field of employment and social security and social protection law (e.g. briefing of the disabilities officer as per Social Insurance Code (SGB) IX, section 81) pursuant to Art. 9 (2) b) GDPR in conjunction with section 26, sub-section 3 BDSG. If you voluntarily provide special categories of personal data as defined in Art. 9 (1) GDPR in the application process they will be processed exclusively in accordance with Art. 9 (2) a) GDPR in conjunction with section 26, sub-section 3, sentence 2 and sub-section 2 BDSG (e.g. health data if this is necessary to perform the job function).
The provision of personal data is not prescribed by law. You are not under any legal obligation to provide your personal data to us. However, if you do not provide the necessary personal data to us we will not be able to consider your application.
4. Processing of personal data
The personal data concerning you that we process depend on whether you only visit our website, or whether you send us a message or job application.
4.1 Website visit
When you visit our website we collect and process the following data:
• Your internet service provider
• Referrer URL (previously visited website)
• Your browser type and operating system
• Your IP address
• Requested files, transferred data volume, downloads/file exports
• Name of accessed websites, including data and time of access
• Screen size
• Plug-ins used
We store these data pursuant to Art. 6 (1) f) GDPR for the purpose of technical security (in particular, to prevent attempts to hack into our web servers).
4.2 Contact form
If you send inquiries to us via a contact form, the information you provide in the inquiry form, including the contact data you provide in the form, is stored by us for the purpose of handling the inquiry and dealing with any subsequent questions. The legal basis is Art. 6 (1) b) GDPR. These data are not transferred to other parties or used for other purposes.
4.3 Online application form
When you use our online application form the personal data that you provide is only processed for the purpose of the effective and correct implementation of the application process, and in order to contact you during the application process. To process your application we need diverse personal data. The data which are absolutely necessary to process your application are designated as mandatory fields on the application form (e.g. first name and surname, e-mail address). The entries in all other fields are voluntary and optional. The legal basis is Art. 6 (1) b) GDPR.
We process your IP address because it is technically necessary to do so and for the purpose of legal protection. The legal basis is Art. 6 (1) f) GDPR.
Without the personal data requested in the mandatory fields we will not be able to check your application documents. Our application system is therefore programmed to prevent you submitting application documents without the necessary personal data.
We can also process personal data concerning you for the defence of legal claims asserted against us during the application process. The legal basis is Art. 6 (1) f) GDPR. Legitimate interest would be, for instance, a duty of evidence in proceedings under the German Equality of Treatment Act (AGG).
If we enter into an employment relationship with you, we may process the personal data already received from you for the purpose of executing or terminating the employment relationship, or for the purpose of complying with a law, a collective wage agreement or a company agreement, or the ensuing rights and obligations of employee interest representation, pursuant to section 26 (1) BDSG.
4.4 Post and e-mail applications
Written applications and e-mail applications will be stored in our system for the duration of the selection process and treated in the same way as applications received via the online application form.
Please remember that e-mail applications must be sent to us in unencrypted format.
4.5 Processing of special categories of personal data
If you voluntarily provide special categories of personal data as defined in Art. 9 (1) GDPR in the application process (e.g. data concerning health or ethnic origin), they will be processed exclusively in accordance with Art. 9 (2) b) GDPR. If we request special categories of personal data as defined in Art. 9 (1) GDPR in the application process they will be processed additionally in accordance with Art. 9 (2) a) GDPR (e.g. health data if this is necessary to perform the job function).
5. Duration of storage
We store your data for the above purpose until the application process has concluded and the relevant periods have expired – and, at the latest, six months after receiving the decision. We can also store your application data for longer in order to check your profile against other job vacancies. In this case, we will write to you and request your consent before the relevant period expires.
You may withdraw your consent at any time with future effect and without stating a reason to one of the contacts provided.
If you have given your consent to the extended storage of your personal data, we will include your data in our applicant pool. The data in the pool is either erased after one year or we will contact you after one year requesting your consent to store them for a longer period. If you do not provide your consent the data will be deleted.
6. Recipients of personal data
When we receive your application data they will be internally transferred to the department or group company where the vacant position exists after being reviewed by our HR department. All recipients of your application data will treat them as absolutely confidential.
We use an external service provider’s recruiting tool in the application process. Data and documents which are collected via the application form are also transferred to our service provider, where they are stored and processed on our behalf. We have concluded a processor contract with the recruiting tool provider to ensure that the data are processed in compliance with all relevant legal requirements.
We do not otherwise transfer your personal data to third parties unless we are required to do so by law (e.g. transfer to external bodies such as supervisory authorities or criminal investigation authorities).
7. Transfers to third countries
We do not transfer personal data to third countries or international organisations.
8. Data subject rights
When personal data concerning you is processed you have the following rights as the data subject pursuant to GDPR.
8.1 Right of notification
You can request confirmation from the data controller of whether personal data concerning you are being processed by us.
If personal data concerning you is being processed, you can request the following information from the controller:
• the purposes for which the personal data are being processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed;
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• the existence of the right to obtain from the controller rectification or erasure of personal data concerning you, the right to restriction of processing by the controller or the right to object to processing;
• the right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data if the personal data were not collected from the data subject.
8.2 Right to rectification
You have the right to obtain the rectification of personal data concerning you and the supplementation of incomplete personal data from the data controller. The data controller will comply without undue delay.
8.3 Right to restriction of processing
When one of the following applies you have the right to obtain from the controller restriction of processing:
• if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
• if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• if the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims or;
• if you have objected to processing pursuant to Article 21 (1) GDPR pending the verification of whether the legitimate grounds of the controller override your grounds.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If you have obtained restriction of processing pursuant to the above the data controller will inform you before the restriction of processing is lifted.
8.4 Right to erasure
8.4.1. Erasure obligation
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- You withdraw your consent on which the processing is based according to Article 6 (1) a), or Article 9 (2) a) GDPR, and where there is no other legal ground for the processing.
- You object to the processing pursuant to Article 21 (1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 (2) GDPR.
- The personal data concerning you have been unlawfully processed.
- The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
- The personal data have been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.
8.4.2. Information to third parties
Where the controller has made the personal data public and is obliged pursuant to Article 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to obtain erasure does not apply if the processing is necessary
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health in accordance with Article 9 (2) h) and i) as well as Article 9 (3) GDPR;
- for the establishment, exercise or defence of legal claims.
8.4.4. Notification obligation
If you have exercised your right of any rectification or erasure of personal data or restriction of processing vis-a-vis the controller, the controller is required to communicate any rectification, erasure or restriction of processing of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to obtain information from the controller about those recipients.
8.5 Right to data portability
You have the right to receive your personal data which you have provided to a controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data had been provided, where
- the processing is based on consent pursuant to Article 6 (1) a) GDPR or Article 9 (2) a) GDPR or on a contract pursuant to Article 6 (1) b) GDPR; and
- the processing is carried out by automated means.
In exercising this right to data portability you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This may not adversely affect the rights and freedoms of others.
8.6 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you on the basis of Article 6 (1) e) or f) GDPR; including profiling based on those provisions.
The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data for such marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 202/58/EC, you may exercise your right to object by automated means using technical specifications.
8.7 Right to revoke consent
When personal data is processed because you have provided your consent, you have the right to revoke that consent at any time. This does not affect the lawfulness of processing up to the time of revocation.
8.8 Right to lodge a complaint with a supervisory authority
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right at any time to lodge a complaint with the competent supervisory authority. The supervisory authority where the complaint is lodged informs the complainant about the status and outcome of the complaint process, including the right to an effective judicial remedy pursuant to Article 78 GDPR.
9. Legal requirements
The provision of personal data is not prescribed by law. You are not legally required to provide your personal data to us. If you do not provide us with the necessary personal data we will not be able to consider your application in the selection process.