We are pleased that you are interested in applying for a career at GP+S. In the following, we explain how we process the personal data submitted in your application and provide other relevant data protection information.
1. Who is responsible for the processing of your personal data?
The GP+S Consulting GmbH, Nehringstraße 2, 61352 Bad Homburg v.d.H. (hereinafter referred to as "we") is the responsible data controller pursuant to the EU General Data Protection Regulation (GDPR).
Tel: +49 6172 - 4 95 56 0
Fax: +49 6172 - 4 95 56 125
2. Who is the responsible Data Protection Officer?
For all questions related to the processing of your personal data and the exercise of your rights under the GDPR, please contact our Data Protection Officer. You can reach our Data Protection Officer at: email@example.com
3. For what purposes and on which legal basis do we process personal data?
We process personal data about you in order to process your job application insofar as it is necessary for us the reach a decision about offering you an employment contract. The legal basis for this is Art. 88 GDPR in conjunction with § 26 para. 1 and para. 8 sent. 2 German Federal Data Protection Act (BDSG).
Furthermore, we can process personal data about you as far as this is required to defend any legal claims made against us arising from the application process. The legal basis for this is Article 6 para. 1, letter f GDPR; the legitimate interest for this is establishing burden of proof in proceedings in accordance with the General Equal Treatment Act (AGG).
If an employment contract is agreed between you and us, we can continue to process the personal data you have submitted to us for your job application in accordance with § 26 para. 1 of the Federal Data Protection Act if this is required for the execution or termination of the employment contract or to exercise or fulfil rights and obligations in the representation of the employee’s interests arising from legislation or a wage agreement, a works agreement or service agreement (collective agreement).
4. What types of personal data do we process?
We process data related to your application. This may include general personal data (such as name, address and contact details), details of your qualifications and education, CVET information or other information that you have submitted to us in your application. We may also process your publicly available job-related information, such as a profile on professional social media networks.
5. What other sources do we use to collect personal data about you?
Apart from the data you provide us, we may also collect personal data about you from StepStone (provided you have an active profile) or from any inactive or partially active profile you disclose to us during the application process.
6. Who receives my personal data?
We may transfer your personal data to companies affiliated with us, to the extent permitted by the purposes and legal bases set forth in clause 3. Personal data is processed on our behalf on the basis of contracts pursuant to Article 28 GDPR, in particular by host providers or providers of applicant management systems.
We process your application via StepStone. Thus, StepStone Deutschland GmbH and its subcontractors, who you will find at www.stepstone.de/ueber-stepstone/rechts-hinweise/general-geschaeftsbedingungen, may also be recipients.
7. Do you intend to transfer my data to a third country?
Transfer to a third country is not intended.
8. How long will your data be stored?
We store your personal data for as long as it is necessary to decide on your application. If your application is not successful, we may still continue to store data to the extent required to defend against any potential legal claims. In the event an employment relationship between you and us does not materialise, the application documents will be deleted within a maximum of 6 months after completing the application process, unless prolonged storage is required due to litigation.
9. Which are your rights?
As an applicant for a position at GP+S, you have the following data protection rights, depending on the situation in your individual case, which you may exercise with us or our Data Protection Officer at any time using the contact details provided in clauses 1 and 2:
You have the right to obtain information about your personal data processed by us and to demand access to your personal data and copies of this data. This includes information concerning the purpose of the use, the category of data used, the recipients thereof and persons authorised to access it and, where possible, the planned duration of the data storage or, if that is not possible, the criteria for determining this duration. Pursuant to Article 20 GDPR, you have the right to receive the personal data you provided to us in a structured, commonly used machine-readable format or to request the transfer of the said data to another data controller.
You have the right to request rectification of any incorrect personal data concerning you. You have the right to demand the completion of incomplete personal data, including by means of a supplementary statement, taking into consideration the purposes of the processing.
c. Right to object
If your personal data is processed in accordance with Article 6 para. 1 letter f GDPR, you have the right to file an objection at any time against the processing of this data due to personal circumstances that may arise. We will then no longer process such personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing is required to assert, exercise or defend legal claims.
d. Right of withdrawal
If the processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal. You can contact us or our Data Protection Officer at any time using the contact details above.
e. Right of erasure
You have the right to demand that we erase personal data about you immediately. We are obliged to erase personal data about you without delay if one of the following reasons applies:
- The personal data are no longer in relation to the purposes for which they were collected or otherwise processed.
- You file an objection to the processing in accordance with clause 9 c above and there are no overriding legitimate reasons for the processing.
- The personal data was processed unlawfully.
- The erasure of the personal data is necessary to comply with a legal obligation in accordance with European Union Law or the national law in the member state which we are governed by.
This does not apply if processing is required:
- to fulfil a legal obligation that requires processing under European Union Law or the national law in the member state which we are governed by.
- to assert, exercise or defend legal claims.
f. Right to restriction of processing
You have the right to demand that we restrict the processing of your personal data if one of the following conditions applies:
- you contest the accuracy of the personal data about you; this restriction shall apply for a period of time that enables us to verify the accuracy of your personal data;
- the processing is unlawful and you opposed the erasure of the personal data and requested the restriction of their use instead;
- we no longer need the personal data for processing purposes, but you require them for the establishment, exercise or defence of legal claims, or
- you have filed an objection against the processing in accordance with clause 9 c above, pending the verification whether our legitimate grounds override yours.
In the event that processing has been restricted in accordance with this subparagraph (f), such personal data may only be processed – apart from storage thereof – with your consent or for the purpose of establishing, exercising or defending legal claims or protecting the rights of another natural or legal person, or for significant public interest reasons of the European Union or a Member State.
If you have effected a restriction on the processing of your data, we will inform you before the restriction is lifted.
g. Right to lodge a complaint
You have the right to lodge a complaint with a regulatory authority, in particular in the Member State of your place of residence, employment or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy, if you consider that the processing of your personal data infringes the provisions of the GDPR.
10. Need to provide personal data
The provision of personal data is neither statutorily nor contractually mandatory, nor are you obliged to provide personal data. However, the provision of personal data is required to enter into a contract of employment with us. This means that if you do not provide us with your personal data when applying, we will not be able to hire you.
11. No automated decision-making
There is no automated decision on a case-by-case basis as defined in Article 22 GDPR, i.e. the decision on your application is not based on automated processing.
Publication date: 04.12.2019