1. Who is responsible for the processing of your personal data?
The GP+S Consulting GmbH, Nehringstraße 2, 61352 Bad Homburg v.d.H., (hereinafter referred to as "we") is the responsible data controller pursuant to the EU General Data Protection Regulation (GDPR).
Tel: +49 6172 - 4 95 56 0
Fax: +49 6172 - 4 95 56 125
2. Who is the responsible Data Protection Officer?
For all questions related to the processing of your personal data and the exercise of your rights under the GDPR, please contact our Data Protection Officer. You can reach our Data Protection Officer at: firstname.lastname@example.org
3. For what purposes and on what legal basis do we process personal data?
We process your personal data in order to be able to match your professional and project experience with the requirements of the clients and to offer you projects that suit your skills.
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the purpose of establishing, implementing and fulfilling contracts as well as for implementing pre-contractual measures. Pursuant to Article 6 para. 1 letter b GDPR, the processing of personal data is lawful if the disclosure is required for the establishment or execution of a contract or for the implementation of pre-contractual measures.
Where required and permitted by law, we may process your data beyond the actual purpose of the contract, if it is necessary for compliance with a legal obligation to which we are subject (Article 6 para. 1 c GDPR). In addition, processing may be carried out by us or third parties to protect our legitimate interests (Article 6 para. 1 f GDPR). We will inform you separately about this, stating the legitimate interest, as required by law.
4. What types of personal data do we process?
We process data related to your possible placement as freelancer. This may include general personal data (such as name, date of birth, gender, address and contact details), photography, nationality, details of your qualifications and education, project experience, CVET information or other information that you have submitted to us in your application. You may also voluntarily provide us with additional information that you consider relevant to a project assignment at any time. We may also process your publicly available job-related information, such as a profile on professional social media networks.
5. How do we collect personal data?
We collect personal data about you either direct from you, e.g. via your CV or project profile sent to us by email, or via social media networks, such as LinkedIn or XING.
6. How do we use your personal data?
The placement of freelance consultants to match specific client requests for support is one of our core business processes. Below we have described how we use and process your personal data for this purpose in detail:
- We store (and update as required) your data (transmitted by you or from other sources, such as Xing) in our database so that we can identify projects suited to your qualifications and contact you in connection with corresponding project enquiries.
- Only after a project-specific consultation about the nature and scope and your consent, will we transfer your personal data to potential clients in the form of a GP+S consultant profile.
7. Who receives my personal data?
We may transfer your personal data to companies affiliated with us, to the extent permitted by the purposes and legal bases set forth in Section 3.
In addition, we may also pass on your data to potential clients, as required, and only with your consent (see Section 6).
8. Do you intend to transfer my data to a third country?
Transfer to a third country is not intended.
9. How long will your data be stored?
We will delete your personal data from our systems if we have not had any contractual related contact with you for three years. After this time, your data is unlikely to be relevant to the purpose for which it was collected. We will contact you again at the end of the three years to update or delete your data with your consent. Where necessary, we process and store your personal data for the duration of our commercial relationship, which includes, for example, the establishment and execution of a contract or for the fulfilment of the contractual purpose.
In addition, we are subject to various storage and documentation obligations, which include the German Commercial Code (HGB) and the German Fiscal Code (AO). The deadlines for storage and documentation range from two to ten years.
Finally, the storage period is also determined by the statutory limitation periods, which is usually three years according to §§ 195 et seq. of the German Civil Code (BGB). In some cases, it may go up to thirty years.
10. Which are your rights?
As a freelancer who would like to be placed by GP+S in a project assignment, you have the following data protection rights, depending on the situation in your individual case, which you may exercise with us or our Data Protection Officer at any time using the contact details provided in clauses 1 and 2:
a. Right of withdrawal
If the processing of your personal data occurs on the basis of your consent pursuant to Article 6 para. 1 letter a GDPR, you have the right to withdraw your consent at any time. We will then no longer process such personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or if the processing is required to establish, exercise or defend legal claims. Please note that the withdrawal is only effective for future processing. Processing that occurred before the withdrawal will not be affected.
Please send requests for withdrawal to: email@example.com.
You have the right to obtain information about your personal data processed by us and to demand access to your personal data and copies of this data. This includes information concerning the purpose of the processing, the category of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed, where possible, the envisaged period of the data storage or, if that is not possible, the criteria for determining that period. Pursuant to Article 20 GDPR, you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format or to request the transfer of said data to another data controller.
You have the right to obtain rectification without undue delay. You have the right to demand the completion of incomplete personal data, including by means of a supplementary statement, taking into consideration the purposes of the processing.
d. Right to object
If your personal data is processed in accordance with Article 6 para. 1 letter f GDPR, you have the right to file an objection at any time against the processing of this data due to personal circumstances that may arise. We will then no longer process such personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing is required to establish, exercise or defend legal claims.
Please send objection to: firstname.lastname@example.org.
e. Right to erasure
You have the right to demand that we erase personal data about you without undue delay. We are obliged to erase personal data about you without undue delay if one of the following reasons applies:
- The personal data is no longer required for the purpose for which it was collected or otherwise processed.
- You file an objection to the processing in accordance with clause 10 c above and there are no overriding legitimate reasons for the processing.
- The personal data was processed unlawfully.
- The erasure of the personal data is necessary to comply with a legal obligation in accordance with European Union Law or the national law in the member state which we are governed by.
This does not apply if processing is required:
- to fulfil a legal obligation that requires processing under European Union Law or the national law in the member state which we are governed by.
- to assert, exercise or defend legal claims.
f. Right to restriction of processing
You have the right to demand that we restrict the processing of your personal data if one of the following conditions applies:
- you contest the accuracy of the personal data about you; this restriction shall apply for a period of time that enables us to verify the accuracy of your personal data;
- the processing is unlawful and you opposed the erasure of the personal data and requested the restriction of their use instead;
- we no longer need the personal data for processing purposes, but you require them for the establishment, exercise or defence of legal, or
- you have filed an objection against the processing in accordance with clause 9 c above, pending the verification whether our legitimate reasons override yours.
In the event that processing has been restricted in accordance with this subparagraph (g), such personal data may only be processed – apart from storage thereof – with your consent or for the purpose of establishing, exercising or defending legal claims or protecting the rights of another natural or legal person, or for significant public interest reasons of the European Union or a Member State.
If you have effected a restriction on the processing of your data, we will inform you before the restriction is lifted.
g. Right to lodge a complaint
You have the right to lodge a complaint with a regulatory authority, in particular in the Member State of your place of residence or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy, if you consider that the processing of your personal data infringes the provisions of the GDPR.
Publication date: 04.12.2019