Information on data protection regarding our processing of applicant data in accordance with Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR)

Herbert Waldmann GmbH & Co KG

Dear applicant,

Thank you for your interest in our company. In accordance with the provisions of Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of the personal data you submit as part of the application process and any personal data we collect and your rights in this regard. To ensure that you are fully informed about the processing of your personal data as part of the application process, please take note of the following information.

1. DATA CONTROLLER WITHIN THE MEANING OF DATA PROTECTION LAW

Herbert Waldmann GmbH & Co KG

Peter-Henlein-Strasse 5

78056 Villingen-Schwenningen

Phone: +49 7720 601 0

E-mail: info@waldmann.com

Web: https://www.waldmann.com/

2. CONTACT DETAILS OF OUR DATA PROTECTION OFFICER

vimopro GmbH

Phone: +49 7721 69811 51

E-mail: datenschutz@vimopro.de

3. PURPOSES AND LEGAL BASES OF PROCESSING

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the decision on the establishment of an employment relationship with us. The legal basis for this is Art. 88 GDPR in conjunction with § 26 BDSG-new and, if applicable, Art. 6 para. 1 lit. b GDPR for the initiation or execution of contractual relationships.

Furthermore, we may process your personal data if this is necessary for the fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR) or for the defence of legal claims asserted against us. The legal basis for this is Art. 6 para. 1 lit. f GDPR. The legitimate interest is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG). If you give us your express consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. Any consent given can be revoked at any time with effect for the future (see section 9 of this data protection information).

If there is an employment relationship between you and us, we may, in accordance with Art. 88 GDPR in conjunction with Section 26 BDSG-new, further process the personal data already received from you for the purposes of the employment relationship, insofar as this is necessary for the performance or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of the employee representation arising from a law or a collective agreement, a works or service agreement (collective agreement).

4. CATEGORIES OF PERSONAL DATA

If you apply for a job at Waldmann, the following personal data will be processed:

· Address data (name, street, house number, postcode, city, country)

· Proof of qualifications (school reports, diplomas, job references, further training certificates)

· Contact details (telephone, fax, mobile, e-mail)

· Curriculum vitae data (school education, higher qualifications, previous jobs, special knowledge/skills)

· Personal data (date of birth, place of birth, marital status, nationality, religion, photograph)

· Any other data that you transmit to us as part of the application process

5. SOURCES OF THE DATA

We process personal data that we receive from you by post, email or via our online application portal or that you transmit to us via external job portals when you contact us or submit your application.

6. RECIPIENT OF THE DATA

We only pass on your personal data within our company to those departments and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest. The data will be forwarded to the respective department manager to check the qualifications for the position to be applied for and to select the suitable person.

We may transfer your personal data to companies affiliated with us insofar as this is permitted within the scope of the purposes and legal bases set out in section 3 of this data protection information sheet. We use the following data processors to provide the services used for the application process:

· When applications are received by e-mail and for appointment management, we use cloud services from Microsoft Deutschland GmbH, which is the recipient of the data.

· If you apply via our online application portal, your data will be processed by our service provider P&I Personal & Informatik AG

Otherwise, data will only be passed on to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfil legal obligations or if we have your consent.

7. TRANSFER TO A THIRD COUNTRY

A transfer to a third country is not intended.

8. DURATION OF DATA STORAGE

We store your personal data for as long as is necessary to make a decision on your application. Your personal data or application documents will be deleted a maximum of six months after the end of the application process (e.g. the announcement of the rejection decision), unless longer storage is legally required or permitted. We will only store your personal data beyond this if this is required by law or in a specific case for the assertion, exercise or defence of legal claims for the duration of a legal dispute.

In the event that you have consented to your personal data being stored for a longer period of time, we will store it in accordance with your declaration of consent.

If the application procedure is followed by an employment relationship, training relationship or internship relationship, your data will, if necessary and permissible, initially continue to be stored and then transferred to the personnel file.

9. YOUR RIGHTS

Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, the right to notification under Art. 19 GDPR and the right to data portability under Art. 20 GDPR.

In addition, you have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that your personal data is being processed unlawfully. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

If the processing of data is based on your consent, you are entitled to revoke your consent to the use of your personal data at any time in accordance with Art. 7 GDPR. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may have to retain certain data for a certain period of time in order to fulfil legal requirements (see section 8 of this data protection information).

Right of objection

Insofar as your personal data is processed in accordance with Art. 6 para. 1 lit. f GDPR to protect legitimate interests, you have the right to object to the processing of this data at any time in accordance with Art. 21 GDPR for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing. These must outweigh your interests, rights and freedoms, or the processing must serve the assertion, exercise or defence of legal claims. You are welcome to contact us to protect your rights.

10. NECESSITY OF PROVIDING PERSONAL DATA

The provision of personal data as part of the application process is neither legally nor contractually required. You are therefore not obliged to provide your personal data. However, please note that this is necessary for the decision on an application or the conclusion of a contract in relation to an employment relationship with us. If you do not provide us with any personal data, we cannot make a decision on the establishment of an employment relationship. We recommend that you only provide the personal data that is required to complete your application.

11. AUTOMATED DECISION MAKING

Since the decision on your application is not based exclusively on automated processing, no automated decision is made in individual cases within the meaning of Art. 22 GDPR.