Skip to main content

Processing of (personal) data by the entity in charge of the online application process

1. General

In the following privacy notice we inform you about how we handle your personal data collected in the course of the online application process.

2. Controllers

Visivo Consulting GmbH (marktguru Austria) and marktguru Deutschland GmbH (Germany) act as controllers within the meaning of data protection law in the context of the application process. Exceptions are explained in this privacy notice.

2.1 Contact

Visivo Consulting GmbH

Weyrgasse 8/11

1030 Vienna, Austria

datenschutz@marktguru.com

marktguru Deutschland GmbH

Sendlinger Straße 23

80331 Munich, Germany

datenschutz@marktguru.de

Data Protection Officer:

Maximilian Hartung

eDSB – Data Protection Officer

SECUWING GmbH & Co. KG | Datenschutz-Agentur.de

Frauentorstraße 9

86152 Augsburg, Germany

epost@datenschutz-agentur.de

2.2 Details of the Joint Controllership

In certain cases, Visivo Consulting GmbH (marktguru Austria) and marktguru Deutschland GmbH (Germany) act as so-called joint controllers.

This means that they jointly determine the purposes and means of the processing of your personal data.

The joint controllers have entered into a corresponding agreement (“Joint Controllership Agreement”). This agreement provides, in particular, for the following:

  • Visivo Consulting GmbH is responsible for informing you of the content of the Agreement on Joint Controllership.

  • You may assert your rights against any of the joint controllers.

  • Visivo Consulting GmbH informs you of the processing of your personal data in this privacy notice.

  • All joint controllers take appropriate technical and organisational measures to ensure an adequate level of protection for personal data processed under the joint controllership.

  • All joint controllers implement appropriate safeguards for the transfer of personal data to countries outside the European Economic Area (EEA).

3. What categories of personal data do we process in the application process?

Personal data means any information relating to an identified or identifiable natural person. When we process personal data, this means that we, for example, collect, store, use, transfer to others or delete it.

If you submit your application with us electronically, i.e. by email or via our web form, we collect and process your personal data for the purpose of handling the application process and carrying out pre-contractual measures.

In particular, this concerns the following data:

•  Name (first and last name)

•  Email address

•  Telephone number

•  LinkedIn profile (optional)

•  Place of residence (optional)

•  Gender (optional)

•  Date of birth (optional)

•  Channel through which you became aware of us (optional)

In addition, you have the option of uploading supporting documents such as a cover letter, your CV and certificates. These may contain further personal data such as date of birth, address, etc.

4. Who receives your personal data, and why?

4.1 Internal recipients of data

Only authorised employees from the HR department or employees involved in the application process have access to your data.

Please note that your data is processed not only by Visivo Consulting GmbH (marktguru Austria), but also by marktguru Deutschland GmbH (Germany). Employees from the HR departments of all companies involved work closely together in recruiting.

For more information, please see the section “Details of the Joint Controllership”.

4.2 Disclosure of data to third parties

As a general rule, we only disclose your personal data to third parties to the extent that this is necessary for the performance of a contract, we or the third party have a legitimate interest in the disclosure, you have given your consent to do so, or this is necessary to comply with a legal obligation.

We may disclose personal data to a third party in particular:

  • if we are obliged to do so in an individual case on the basis of statutory requirements or an enforceable official or judicial order;

  • in connection with legal disputes (to courts or our lawyers) or audits (to auditors);

  • in connection with possible criminal offences, to the competent investigating authorities;

  • in the event of a sale of the business (to the acquirer and its legal and tax advisers).

Where the disclosure is based on consent, the explanation may also be provided when the consent is obtained.

4.3 Disclosure of data to service providers (processors)

We reserve the right to engage service providers in connection with the collection or processing of data. Service providers only receive the personal data from us that they need for their specific task. For example, your email address may be passed on to a service provider in order to contact you by email. Service providers may also be commissioned to provide server capacity. Service providers are generally engaged as so-called processors, who may only process your personal data in accordance with our instructions.

We disclose personal data, among others, to processors based in non-EEA countries. In such cases, before the disclosure we ensure that the recipient either maintains an adequate level of data protection (e.g. on the basis of an adequacy decision of the European Commission for the relevant country pursuant to Art. 45 GDPR, or the conclusion of so-called EU Standard Contractual Clauses between the European Commission and the recipient pursuant to Art. 46 GDPR, including the performance of so-called Transfer Impact Assessments and, where necessary, the implementation of additional safeguards, Module 1 (for recipients that are controllers) or Module 2 (for recipients that are processors)), or that the data subject has given explicit consent.

This concerns third parties and/or processors in the following countries: USA.

With regard to the USA, the European Commission has concluded that an adequate level of data protection exists there, provided that the data recipient participates in the Data Privacy Framework (DPF) and holds a current certification for it. Insofar as the recipients of your personal data are based in the USA and participate in the DPF, we therefore rely on this adequacy decision (Art. 45 GDPR).

In the course of the application process, your personal data is processed on our behalf by the following service providers:

  • IT service provider (technical support), EU/EEA, USA

  • IT service provider (server hosting), EU/EEA, USA

  • IT service provider (job application platform), EU/EEA

The data transmitted as part of your application is transmitted using TLS encryption and stored in a database. This database is operated by Personio GmbH, a provider of HR management and applicant-tracking software (https://www.personio.de/impressum/). In this context, Personio is our processor pursuant to Art. 28 GDPR. The basis for the processing is a data processing agreement between us, as the controller, and Personio.

  • IT service provider (communication tools (email, video calls) and file storage), EU/EEA, USA

  • IT service provider (telephone), EU/EEA

5. Purposes and legal bases for the processing of personal data in connection with applications and the application process

5.1 Application process

We have a legitimate interest in filling vacant positions (Art. 6(1)(f) GDPR). By submitting an application on our recruiting page, you express your interest in taking up employment with us. In this context, you provide us with personal data, which we use and store exclusively for the purpose of processing your job search/application (legal basis: performance of a contract (Art. 6(1)(b) GDPR)). The personal data is generally stored exclusively for the purpose of filling the vacant position for which you applied.

5.2 Inclusion in the talent pool

If you consent to being included in our talent pool after completion of the selection process, we will store your application data until you withdraw your consent. This data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR).

5.3 Further data processing upon employment

If, in the course of the application process, you receive and accept an offer of employment with us, we will store the personal data collected during the application process for at least the duration of the employment relationship. In this case, our employees are provided with a separate comprehensive data protection notice.

6. How long do we store your data?

6.1 Application process

Your data will be stored for a period of six months beyond the end of the application process. This is done in order to comply with legal obligations and/or to defend against any claims arising from statutory provisions. After this period, we are obliged to delete or anonymise your data. In this case, the data is only available to us as so-called metadata, without any direct reference to a specific individual, for statistical evaluations (for example, the proportion of female and male applicants, the number of applications per period, etc.).

6.2 Inclusion in the talent pool

Inclusion in the talent pool is based on your consent, until withdrawn.

6.3 Further data processing upon employment

Our employees are informed separately about the storage and retention periods applicable in the context of employment relationships.

7. Rights of data subjects

Where personal data is processed by us as the controller, you, as the data subject, have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and purpose of the processing. These may include, in particular, the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR). Where the processing of personal data is based on your consent, you have the right, pursuant to Art. 7(3) GDPR, to withdraw that data protection consent at any time.

To exercise your rights as a data subject in relation to the data processed in this online application process, please contact our Data Protection Officer (see Section 2).

8. Final provisions

We reserve the right to amend this privacy notice at any time, so that it continues to comply with current legal requirements or to reflect changes to the application process or similar matters. The new privacy notice will then apply to any further visit to this recruiting page or any further application.

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.