Data privacy notice for job applicants of SEFE GmbH

March 2023

The following information describes how and for what purpose SEFE Securing Energy for Europe GmbH and SEFE Mobility GmbH, Markgrafenstraße 23, 10117 Berlin (hereinafter also “We”) processes the personal data of their applicants.

Personal data is, according to Art. 4 No. 1 of the General Data Protection Regulation (GDPR), any information relating to an identified or identifiable natural person.

1. RESPONSIBILITY FOR DATA PROCESSING AND CONTACT DETAILS

The data controller responsible for processing personal data within the meaning of Article 4 No. 7 GDPR for the job applications to SEFE Securing Energy for Europe GmbH is

SEFE Securing Energy for Europe GmbH
Markgrafenstraße 62
D-10969 Berlin
Germany
Telephone: +49 30 20195 0
Email: personal@sefe.eu

Jointly responsible data controller for processing personal data within the meaning of Art. 4 No. 7 GDPR for the job applications to SEFE Mobility GmbH are

SEFE Mobility GmbH, Markgrafenstraße 62, 10969 Berlin
Telephone: +49 30 20195 0
Email: personal@sefe.eu

SEFE Securing Energy for Europe GmbH, Markgrafenstraße 62, 10969 Berlin
Telephone: +49 30 20195 0
Email: personal@sefe.eu

You can reach the data protection officer at SEFE Securing Energy for Europe GmbH, attn: data protection officer, Markgrafenstraße 62, 10969 Berlin, or at dataprivacy@sefe.eu.

2. TYPE OF PROCESSED DATA

We process your personal data as part of your application, in case you provide this personal data with your application documents or in the further course of the application process.

Data processing includes the following categories of personal data if they are necessary for the purposes set out in Section 4:

• Master data (e.g. title, last name, first name, email address, telephone number, zip code and city),
• Application data (e.g. information about previous activities in the group, period of notice, salary expectations),
• Special data categories (Article 9 GDPR) that you voluntarily provide with your application,
• Data on your education,
• Data about your non-professional interests,
• Other data that you voluntarily provide to us as part of the application process, e.g. data contained in your application letter, CV or job references,
• Communication data: content of personal email or telephone conversations and other data that arise when We exchange data with you (e.g. when raising queries or using the contact form),
• Information on how you became aware of us or, if applicable, the name and data of the career fair through which you contacted us,
• Data on who recommended you, in the case of the internal referral scheme where employees can suggest other employees,
• Data that is needed to support the application process in IT systems (e.g. language settings, general settings, technically necessary cookies),
• Statements on data protection:
  • Consent to the processing of personal data,
  • Declarations on the revocation of a consent given by you,
  • Declarations of objection against the processing of personal data,
  • Statements on how to exercise your rights of access, rectification, erasure, restriction of processing and data portability, including the information you provide to us when exercising your rights.
• Internal applicant number,
• If applicable, job number.

In addition, if applicable and required by national legislation, We may also process other data:

• Test results or certificates (e.g. eye test, police clearance certificate).

As a rule, We do not process any personal data that We have received from third parties. However, when We work with third parties, such as head-hunters and recruitment agencies, they provide your applicant data to us.

3. PURPOSES OF DATA PROCESSING AND LEGAL BASIS

Our recruitment management takes place electronically via a Recruiting Management System. You can access the Recruiting Management System via a link on the job advertisement and/or our company website.

If you apply via a recruitment service provider or a job agency that places job advertisements on our behalf, your application may reach us via the recruiting portals of these partners.

We process your personal data for various purposes in compliance with the relevant data protection regulations, in particular the GDPR and national data protection laws. Basically, the purposes for which We process your data are the following:

• Processing of data relating to the employment relationship, i.e. to fulfil contractual obligations or to carry out pre-contractual measures (Art. 6 Para. 1 lit. b GDPR),
• To protect legitimate interests (Art. 6 Para. 1 lit. f GDPR),
• After your prior consent (Art. 6 Para. 1 lit. a GDPR) and/or
• To fulfil legal obligations (Art. 6 Para. 1 lit. c GDPR).

If you provide special categories of personal data in accordance with Art. 9 GDPR, data processing will take place on the basis of Art. 9 Para. 2 lit. b GDPR for the purpose of carrying out the obligations and exercising specific rights in the field of employment and social security and social protection law.

In detail, We process your personal data for the following purposes and on the legal basis specified in each case:

a) Application process and contract initiation including communication with you

Data or categories of data processed: Master data; application data; information on how you became aware of us; data about your education; data about your non-professional interests; other data that you voluntarily provide to us as part of the application process; communication data.

Legal basis: Art. 6 Para.1 lit. b GDPR, §26 Federal Data Protection Act (BDSG)

b) When concluding an employment contract with us: Transfer of the data to the personnel file of the individual concerned. This serves as a check for abuse and as a basis for the subsequent professional development of the individual concerned.

Data or categories of data processed: Master data; application data; information on how you became aware of us; data about your education; data about your non-professional interests; other data that you voluntarily provide to us as part of the application process; communication data.

Legal basis: Art. 6 Para.1 lit. b and f GDPR.

c) Assertion of legal claims and defense against legal disputes

Data or categories of data processed: Master data; any personal data that is the subject of the legal claim or dispute.

Legal basis: Art. 6 Para.1 lit. f GDPR.

d) Management of declarations of consent and revocation in relation to data privacy

Data or categories of data processed: Master data, privacy declarations.

Legal basis: Art. 6 Para.1 lit. a and c GDPR.

e) Objection management (management of objections related to data privacy issues).

Data or categories of data processed: Master data, privacy consent and objection declarations.

Legal basis: Art. 6 Para.1 lit. c GDPR.

f) Management of data subjects' rights (handling data subjects' requests for access, rectification, erasure, restriction of processing and data portability in order to exercise data subjects' data protection rights).

Data or categories of data processed: Any data or category of data that is the subject of the specific request.

Legal basis: Art. 6 Para.1 lit. c GDPR, if applicable, Article 9 GDPR.

g) Access management in the Recruiting Management System

Data or categories of data processed: Logging of data for security measures and ensuring appropriate measures are taken to secure your data.

Legal basis: Art. 6 Para.1 lit. f GDPR.

h) Information you voluntarily provide to us to give us a better picture of your profile

Data or categories of data processed: Any data that you voluntarily share with us.

Legal basis: Art. 6 Para.1 lit. a GDPR, if applicable, Article 9 GDPR.

i) Further data processing within the framework of national legislation

Data or categories of data processed: Data that must or may be processed under national law: e.g. police clearance certificate.

Legal basis: Art. 6 Para.1 lit. c and f GDPR.

4. DATA RETENTION

We process and store your personal data for the required duration of the application process. If the application process ends without you being hired, your data and application documents will be deleted within 6 months of completing the application process. You will not be informed separately about the deletion.

Application documents submitted in paper form by post will be returned to you, as our application process is exclusively digital.
This does not apply if your data is processed and stored to assert, exercise or defend legal claims (for the duration of the process) or if We obtain your separate consent to store your application documents for a longer period of time.

If you are hired at the end of the application process, both your personal data and your application documents will be used to draw up the employment contract and then included in your personnel file.

The data processed here is subject to various storage and documentation obligations, which result from national legal provisions, often from tax, labor and company law regulations. Finally, the storage period is also assessed according to the national statutory limitation periods.

If necessary, We process and store your personal data for the duration of the application process. This includes i.a. including the initiation and execution of a contract. In addition, We are subject to various storage and documentation obligations, which result from the German Commercial Code (Handelsgesetzbuch - HGB) and the Fiscal Code (Abgabenordnung - AO), among other things. The storage and documentation periods stipulated there are two to ten years. Finally, the storage period also depends on the statutory limitation periods, which e.g. B. according to §§ 195 et seq. of the German Civil Code (Bürgerliches Gesetzbuch - BGB) as a rule three years, but in certain cases it can also be up to thirty years.

5. COOKIES ON THE WEBSITE OF THE RECRUITING MANGEMENT SYSTEM

We use the so-called cookies or similar functions on the website of our Recruiting Management System to make our website technically available. We base the processing of your data through the cookies used for the aforementioned technically necessary purposes on our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR, which is to be regarded as legitimate within the meaning of the aforementioned provision.

The recruiting portals of our recruitment service providers may also use cookies or other tracking technologies. Further information on this processing can be found in the data protection declarations of the respective recruitment service providers, which are usually linked in the job advertisements.

6. RECIPIENTS AND CATEGORIES OF RECIPIENTS

Personal data can be passed on to the following recipients and categories of recipients:

Internally, access to your data is only granted on the basis of authorization. In the case of ongoing application procedures, these are the involved HR business partners within the Human Resources department, interview partners and managers from the relevant business unit and, if necessary, the responsible committee representatives (works council, possibly also representatives for severely disabled people). The IT department provides technical support and ensures the functionality of the Recruiting Management System.

6.1 DATA PROCESSORS

We use service providers who process personal data on our behalf (so-called processors, cf. Art. 4 No. 8, Art. 28 GDPR). This includes service providers in the areas of IT, telecommunications and recruitment service providers. In these cases, We have concluded order processing contracts with the service providers.

6.2 DISCLOSURE TO THIRD PARTIES

Insofar as We are authorized to do so on the basis of contractual or legal provisions, or on the basis of consent, We also pass on the above-mentioned personal data to other companies who process the data in joint responsibility (Art. 26 GDPR).

Such joint responsibility is given in the following areas

• Application process and HR,
• IT services.

In these cases, We have concluded on joint responsibility agreements with these companies.

The main content of these agreements on joint responsibility is the ruling on the area of responsibility in the processing of your personal data. For example, any party against whom you make a claim is responsible for settling that claim. Each party is also responsible for the lawfulness of its own data processing in relation to the organisation of the recruitment process.

In addition, the agreement regulates the responsibility between the data controllers for the cases in which the data subjects exercise their rights. This relates i.a. to the right to have personal data rectified or erased or to restrict processing.

7. TRANSFER OF DATA TO A THIRD COUNTRY OR TO AN INTERNATIONAL ORGANISATION

A transfer of your personal data to a third country or an international organization will only take place if this is necessary in the context of order processing and the requirements of Art. 44 et seq. GDPR are met.

A transmission will only take place if an appropriate level of data protection is ensured in the third country (Art. 45 GDPR), suitable guarantees exist (cf. Art. 46 GDPR) or there is another legal permission (cf. Art. 49 GDPR) and insofar as this is necessary for processing and thus for the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, the transfer is required by law or you have given us your consent.

8. OBLIGATION TO PROVIDE DATA

As part of your application, you only have to provide the personal data required to start and carry out the recruitment process. The application process cannot be started without this data.

9. AUTOMATIC DECISION MAKING AND PROFILING

We do not use your personal data for automated decision-making, including profiling.

10. YOUR RIGHTS

10.1 INFORMATION, CORRECTION, DELETION, RESTRICTION OF PROCESSING, DATA PORTABILITY

Every data subject has the right to information under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability from Art. 20 GDPR. In order to exercise the aforementioned rights, you can contact the offices named under number 1 (responsibility for data processing and contact details).

10.2 RIGHT TO OBJECT PERSUANT TO ART. 21 GDPR

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data relating to you, which is based on Art. 6 Para.1 lit. f GDPR (data processing on the basis of legitimate interest). to insert this also applies to any profiling based on this provision within the meaning of Art. 4 No. 4 GDPR. If you file an objection, We will no longer process your personal data unless We can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If We process your personal data in order to operate direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising. If you object to the processing for direct marketing purposes, We will no longer process your personal data for these purposes.

The objection can be made in any form and should be addressed to the offices named in section 1 (responsibility for data processing and contact details). You will not incur any costs other than the transmission costs according to the basic tariff.

10.3 WITHDRAWAL OF A CONSENT

If you have given us your consent to the processing of your personal data, you can revoke this consent at any time. As a result, We will no longer continue the data processing based on this consent for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected.

Please address the revocation of consent to the office specified in section 1. (Responsibility for data processing and contact details).

11. RIGHT TO COMPLAIN TO THE SUPERVISORY AUTHORITY

According to Art. 77 Para. 1 GDPR, you have the right to complain to a supervisory authority if you believe that the processing of your personal data is not lawful, in particular that it violates the GDPR. In this case, you have the choice of contacting the supervisory authority, in particular in the member state of your place of residence, your place of work or the place of the alleged violation. Irrespective of the aforementioned right to lodge a complaint, We will also accept your request ourselves (for contact details, see section 1. Responsibility for data processing and contact details).