Information about data processing

V2 (022024)

Bertrandt uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by Bertrandt.

Shared responsibility

With regard to interaction within the company account of Bertrandt, Bertrandt and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with Bertrandt, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy one

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Pausing your online application

You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of Bertrandt in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to Bertrandt only.

Visibility of your data

The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.

Notes on the special functions of onlyfy one

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/

WhatsApp application

If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.

The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.

Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

Privacy policy

YOUR PERSONAL DATA IN THE APPLICATION PROCESS

Version 2.4 (April 2022)

Information on data protection

We are pleased that you wish to apply for a job at Bertrandt Group. Transparency and trustworthy handling of your personal data is an important basis for a good cooperation. Therefore, we inform you about how we process your data and how you can exercise your rights, which you are entitled to under the General Data Protection Regulation (GDPR). The information below provides you with an overview of the collection and processing of your personal data in connection with the implementation of the application process. Please read this privacy policy carefully before applying to us.

Consent to data transfer within the Philotech Group and to its potentially interested customers

The protection of your personal data is very important to us. Therefore, we would like to inform you transparently about our data protection principles and procedures for the use of your data in the context of your application via our e-recruiting system. By applying to Bertrandt Group, you are applying to an innovative company with modern IT and HR processes and systems.

Consent to data processing

By completing the registration and sending your application, you consent to:

• to be included in the Bertrandt Group applicant database (this includes Bertrandt Technology GmbH and affiliated Group companies (these can be found at https://www.philotech.net/legal-notice ),
• the access possibility of our personnel managers and personnel recruiters of the Philotech Group for the purpose of applicant selection,
• the forwarding of applicant data to existing and potentially interested customers.

You can revoke your consent at any time, however, further consideration in selection procedures can then no longer take place. For details, please refer to the data protection declaration.

You also confirm that you have read and understood the data protection declaration.

1. General

a) Who is responsible for data processing?

The responsible party within the meaning of Art. 4 No. 7 DSGVO is:

Bertrandt Technology GmbH

Eschenstraße 2

82024 Taufkirchen

+49 - 89-610898-0

info@philotech.de

www.philotech.de

 

b) How can you contact the data protection officer?

For questions regarding data protection, you can reach us by e-mail at

datenschutzbeauftragter@datenschutzexperte.de

2. What is personal data?

According to Art. 4 No. 1 DSGVO, personal data are all information relating to an identified or identifiable natural person.

3. What data is processed?

3.1 The following data or categories of data are processed to carry out the application process:

• Applicant master data (first name, last name, title, e-mail address, telephone number, address, date of birth, citizenship).
• Qualification data (cover letter, letter of motivation, curriculum vitae, previous activities, professional qualifications, and skills)
• Voluntary information, such as an application photo, details of severely disabled status or other information that you voluntarily provide to us in your application or upload voluntarily
• additional questions depending on the respective job advertisement (e.g., driver's license, citizenship)
• communications between you and us, as well as comments and evaluations written about you during your application process
• other data/ categories of data, e.g. publicly accessible, job-related data, e.g. a profile on professional social media networks such as XING or LinkedIn
• Special categories of personal data: If you provide information in your application documents that contains special categories of personal data within the meaning of Art. 9 (1) DSGVO (e.g. information that allows conclusions to be drawn about your sexual orientation; information about your health; information that allows conclusions to be drawn about your ethnic origin or your religion), we will also only process this data to the extent permitted by law

3.2 The following additional personal data is processed in connection with the use of the platform:

a) Automatically collected usage data.

When accessing the jobbase.io domain, your internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is collected by Onlyfy:

• Date and time as well as duration of access,
• browser type/version,
• operating system used,
• URL of the previously visited website,
• amount of data transferred,
• based on the IP address (Internet Protocol address), a GeoIP lookup is made,
• name of the retrieved files,
• http status code (e.g. "request successful"),
• and URL of the accessed web page,
• type of access (GET,POST).

This data is technically necessary to provide the functions of the e-recruiting system and to ensure its stability and security. They are stored by Onlyfy for a period of 12 months. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

The legal basis for the processing of the data is Art. 6 para.1 lit. f DSGVO.

b) Cookies

Onlyfy uses cookies. These serve to make the online application more user-friendly and effective. The cookies are technically necessary to provide you with this website. Without the use of cookies, the operation of the website would not be possible. There is therefore no possibility to object to the use of the cookies.

The legal basis for the processing of the data is Art. 6 para.1 lit. f DSGVO.

The cookies used by Onlyfy can be found in the Onlyfy privacy policy.

4. For what purposes do we process your data and on what legal basis?

a) Data processing for purposes of the employment relationship - § 26 BDSG.

Your personal data is processed for the purposes of personnel selection to fill open positions, i.e. to initiate an employment contract. The necessity and scope of the data collection are assessed, among other things, according to the position to be filled. If your desired position involves the performance of particularly confidential tasks, increased personnel and/or financial responsibility, or is subject to certain physical and health requirements, we may more extensive data collection may be necessary. The legal basis is Section 26 (1) of the German Federal Data Protection Act (Bundesdatenschutzgesetz) (BDSG).

b) Consent - Art. 6 para.1 lit. a, and Art. 9 para. 2 lit. a DSGVO, §26 Section 2 BDSG

If you have given us voluntary consent to process certain personal data, then this consent forms the legal basis for the processing of this data.

In the following cases, we process your personal data based on consent given by you:

• Inclusion in the applicant pool, i.e., we store the application documents beyond the current application process for consideration in subsequent application processes.
• Further processing(s) based on consent (e.g. forwarding the documents to other Group companies/Group-wide applicant pool, sending feedback questionnaires). For this purpose, the data that you have already provided in the application process will be processed

On the basis of the consent, you have given within the meaning of Art. 6 I a DS-GVO, we will continue to process your data for similar staffing procedures, irrespective of whether you applied on your own initiative or directly in response to a job advertisement when you registered.

You can view, update, and delete your data at any time under your applicant cockpit. Please note that you yourself are responsible for the accuracy of your data.

If we base data processing on your consent, you have the right to revoke your consent at any time with effect for the future. If possible, please send the revocation by e-mail to recruiting@philotech.de. The lawfulness of the processing of your data up to the time of the revocation remains unaffected.

c) Data processing based on legitimate interest - Art. 6 para.1 lit. f DSGVO.

In certain cases, we process your data to protect a legitimate interest of us or of third parties. A legitimate interest exists, for example, if your data is required for the assertion, exercise or defense of legal claims in the context of the application process (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes.

d) Feedback questionnaire

To optimize our application processes and improve us as an employer, we offer you the opportunity to provide your personal feedback. For this purpose, we will send you a feedback questionnaire to the e-mail address you provided. If you participate in the survey, our service provider New Work SE (see item 5 "To whom is your data disclosed?") will record the feedback, position title and location of the position as well as job category and, if applicable, type of employment for which you have applied. This information is then transmitted to kununu GmbH and possibly other verified rating platforms and published there without mentioning your name. Kununu cannot establish a link to your person. However, please note that others, e.g. your employer, may be able to identify you based on the information you provide in the published feedback.

e) Calendar function

If the calendar function is used, your data will be processed within the scope and for the purpose of making appointments in the application process. The legal basis is Art. 6 para.1 lit. f DSGVO. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a safe third country based on the adequacy decision of the European Commission. Here you can find more detailed information about Cronofy's data protection: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/.

5. To whom is your data passed on?

Data transfer within the group, data transfer to third countries

In detail, the Bertrandt Group (this includes Bertrandt Technology GmbH and affiliated group companies (these can be found at https://www.philotech.net/legal-notice ) have access to your data, in particular:

• the employees in the human resources departments,
• the employees of the Group organizations in which a position is to be filled
• the managers and potential supervisors
• employees in customer service departments who, as part of a potential customer interest in your application documents, forward them to the customer
• and employee representatives,

In the case of potentially interested customers, this may include

• the recruitment department,
• the purchasing department,
• the departments in which a position is to be filled,
• the managers and potential supervisors, and
• employee representatives.

Data is only passed on for the purpose of checking your qualifications and in the context of processing current and subsequent application procedures and staffing processes, insofar as this is necessary for processing the applications received.

Only those internal departments that are entrusted with the preparation and implementation of the application process and are required for this purpose will receive your data.

A restriction with regard to your application for a specific position applied for by you will therefore not be made.

Internally, only those departments that are entrusted with the preparation and implementation of the application process and are required for this purpose will receive your data.

For the technical implementation of the eRecruiting process, we use a service provider as a processor within the meaning of Art.28 DSGVO. This service provider processes personal data for these purposes on our behalf and in accordance with our instructions.

We use New Work SE as an external service provider. New Work SE, Am Strandkai 1, 20457 Hamburg (hereinafter "Onlyfy"), operates the e-recruiting system Onlyfy under the domain *.onlyfy.io (hereinafter "jobbase.io"), on which companies can post job advertisements and receive and manage applications.

Jobbase.io is the central platform for our applicant management. When you use our online form, your personal data is recorded directly in jobbase.io. In the case of a postal or e-mail application, your data can also be transferred to the e-recruiting system.

6. How long will your data be stored?

(1) We store your personal data for as long as is necessary to decide about your application. If an employment relationship between you and us does not come about, we may continue to store data beyond this, insofar as this is necessary for the defense against possible legal claims. As a rule, your data will be deleted within 6 months after the end of the application process.

(2) If no employment relationship is established, but you have given us your consent for the further storage of your data ("applicant pool"), we will store your data until your consent is revoked, but for a maximum of 2 further years. If there is a specific reason, we may also store your data for a longer period for the purpose of defending against possible legal claims.

(3) If you withdraw your application before the end of the application process, i.e. delete your data and your account, the stored data will be blocked for the period of the application process that is still ongoing and finally deleted after 6 months after the end of the application process.

(4) If you no longer use your candidate profile and have not given your consent to longer data storage in the candidate pool, the data will be deleted within 6 months after the end of the application process.

(5) You yourself can delete your candidate profile and your application documents at any time or submit a request for deletion or have the processing restricted.

7. What rights do you have in connection with the processing of your data?

(1) You can request information about whether we have stored personal data about you. If you wish, we will tell you what the data is, for what purposes the data is processed, to whom this data is disclosed, how long the data is stored and what other rights you have in relation to this data.

(2) In addition, you have the right to have your data corrected or deleted. You may also request that we provide any personal data you have provided to us in a structured, commonly used, and machine-readable format either to you or to a person or company of your choice.

(3) You also have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you. In the context of the application process, we do not use exclusively automated processing for decision-making.

(4) You also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6(1)(l)(it)(e) DSGVO (data processing in the public interest) or on the basis of Article 6(1)(f) DSGVO (data processing for the purposes of safeguarding a legitimate interest); this also applies to profiling based on this provision. In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

(5) In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.

(6) To exercise your rights, you can contact Tobias Miesen by e-mail at dataprotection@philotech.de. We will process your requests promptly and in accordance with the legal requirements and inform you of the measures we have taken or will take.

 

8. Is there an obligation to provide your personal data?

The provision of personal data is neither legally nor contractually required, nor are you obliged to provide the personal data. However, the provision of personal data is necessary for the implementation of the application process. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process.

 

9. What happens if you interrupt your online application?

You can interrupt the creation of your online application at any time and continue it later. For this purpose, technically necessary cookies are used on the platform. During the application process, data is transferred to jobbase.io. I.e. data provided by you for the creation of the user account as well as uploaded documents are recorded in jobbase.io. The data remains recorded even if you interrupt and/or do not complete an application. In this case, your application will be marked as incomplete, and the data will remain restricted for our company to view.

You can view, edit, or update the data you provided in the online application in your candidate profile at any time.

Provided you do not make any further changes in your candidate profile, for example, complete a current application, start a new application, or change the data of an existing application, your data will be deleted within 6 months of the end of the last active application process.

You yourself can request deletion of your candidate profile and application documents at any time. After the deletion request has been made, you will be informed about the exact deletion date and your data will be automatically deleted according to the specified conditions of this privacy policy.