- Gerresheimer AG

Legal

Data Protection Information for Applicants

Dear Applicant,

we are pleased that you want to apply at Gerresheimer AG. The protection of your personal data is very important to us. In the course of the application procedure, you provided us resp. our recruiting-staff with personal data. In the following, we explain how we process your personal data of your application and provide to you relevant information in this respect.

1. Who is responsible for the processing of your data? (Controller)

The Gerresheimer AG (hereinafter referred to as „we“, is the controller according to the EU General Data Protection Regulation („GDPR“)).

Gerresheimer AG
Klaus Bungert Str. 4
40468 Düsseldorf
Tel.: +49 211 61 81- 199
Data-protection@gerresheimer.com

2. Data Protection Officer

For all questions that you have regarding the processing of your personal data and the exercise of your rights pursuant to the GDPR, you can reach out to our data protection officer.

Roland Schroeder
SystemDatenschutzConsulting
Rebenlaube 12
D-45133 Essen
www.systemdatenschutzconsulting.de
r.schroeder@systemdatenschutzconsulting.de

3. For what purpose and on which lawful basis do we process your personal data?

We process personal data about you for purposes of your application for an employment relationship as far as it is necessary for a decision about the establishment of such an employment. Legal basis is Section 26 para. 1 in connection with the 2nd sentence of para. 8 of the (German) Federal Data Protection Act-new (Bundesdatenschutzgesetz - “BDSG(neu)”). Furthermore, we can process personal data about you as far as it is necessary for the defense of any legal claim against us based on the application process. Legal basis is Art. 6 para. 1, letter f GDPR, e.g. the legitimate interest is the burden of proof within a legal procedure according to the (German) General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz (“AGG”)).

If there will be an employment relationship between you and us, we can also process the personal data already received from you pursuant to Section 26 para. 1 BDSG (neu) for purposes of such an employment relationship, in case this is necessary for the execution or termination of the employment or the exercise or fulfillment of rights and obligations of the employees’ worker representation that result from statutory provisions, a collective agreement, a works agreement, or a company agreement.

If you use our application-per-WhatsApp function, the legal basis for the communication is your consent, which can be revoked at any time (Art. 6 para. 1 a GDPR). The application-per-WhatsApp function is provided to us by an IT service provider (PitchYou), which may access your data for this purpose as a processor. Further information can be found here: https://www.pitchyou.de/en/data-privacy.  WhatsApp's data protection information, for example on its processing or on exercising your data protection rights against WhatsApp, can be found here: https://www.whatsapp.com/legal/privacy-policy-eea.

4. What categories of personal data do we process?

We process data that is related to you application. This can be general data about your person (such as names, address, and contact data), details about your professional qualification and educational background or information about professional training conducted or details, that you submit in the course of your application. Furthermore, we might process professional related personal data that is publicly accessible, such as your social media profiles.

5. From which sources do personal data stem from?

If the data is not collected from your application documents resp. the information you sent directly to us resp. our recruiting-staff, we may process professional related information that you made public, such as a profile on professional social media platform.

6. What are the categories of recipients of such data?

We can transfer your personal data to our affiliated companies, as far as this is legitimate with regards to the purposes and legal basis as set out in para. 3. Apart from that, personal data is processed on our commission in accordance with agreements pursuant to Art. 28 GDPR (see also the information about SmartRecruiters under para.7).

7. Is the transfer into a third country intended?

The Gerresheimer AG collects and processes application data with the application management program SmartRecruiters. Through the use of SmartRecruiters, personal data is also be transferred into a country outside of the European Union, a so called third country. About our processor SmartRecruiters we want to provide you with the following information:

SmartRecruiters, Inc.
225 Bush Street
Suite Nr. 300
San Francisco CA 94104 (USA)

With a click on the privacy policy and the terms of use of SmartRecruiters you can view them. We ensure that we took all the necessary measures with this provider to comply with the applicable data protection provisions in accordance with EU-GDPR.

8. How long do we retain your data?

We retain your personal data as long as it is necessary for a decision about your application. If an employment relationship will not be established between you and us, we may retain your data as far as it is necessary for the defense against any potential legal claim. Therefore, your application documents are retained for three month after we informed you about a refusal of your application, provided that a legal dispute does not make a longer retention necessary, or in case you expressly consented for a longer retention within our database for potential candidates.  

9. What rights do you have?

As an applicant you have the following rights under the applicable data protection laws and for their exercise you can contact us or our data protection officer with the data provided in para. 1 and 2:

10. Access

You have the right to disclosure of the personal data that we process about you, as well as to request access to your personal data and/or a copy of such data. This includes information about the purpose of use, the categories of the data used, their recipients and accessors, if possible, the planned period of data retention or, if this is not possible, the criteria used for the determination of such period (compilation per PDF or in paper format).

11. Rectification of processing

You have the right to immediately request the rectification of inaccurate personal data that concerns you. Under consideration of the purposes of processing, you have the right to request the completion of incomplete personal data – also with a complementary statement.

12. Right to object or limitation of processing

As far as the processing of personal data concerning you is in accordance with Art. 6 para. 1 letter f GDPR, you have the right, for reasons that result from your special situation, to object at any time against the processing of those data. We will not process such personal data  any longer, unless we can prove compelling reasons that are worthy of protection, that prevail your interests, rights, and freedoms or the processing serves the assertion, exercise, or defense of legal claims.

As long as it is not certain, whether compelling reasons that are worthy of protection prevail, you have the right to request a limitation of the processing of your personal data. A right to limit the processing can also exist if you contest the accuracy of your personal data, if the processing is unlawful, and if you reject the deletion of your personal data and instead request a limitation, or if the personal data is not longer needed for the original processing you, however, need those for the assertion, exercise, or defense of legal claims.

13. Right to revocation

If the processing is based on consent, you have the right to revoke your consent all the time, without touching the lawfulness of the processing that was made until the revocation is exercised. For this purpose you can contact us or our data protection officer with the contact details mentioned above.

14. Right to erasure

You have the right, to request from us, that the personal data concerning you is erased immediately, and we are obliged to erase personal data immediately, as far as one of the following reasons apply:

  • The personal data is for the purposes, for which those were collected and processed otherwise, not necessary anymore.
  • You lodge an objection pursuant to para. 8.c above, against the processing and there are no prevailing reasons for the processing.
  • The personal data was processed unlawfully.
  • The erasure of personal data is necessary for the fulfillment of a legal duty according to the laws of the European Union or the laws of a member state, which we are governed by.

    This does not apply, as far as the processing is necessary:
  • For the fulfillment of a legal duty, that requires the processing pursuant to the laws of the European Union or the laws of a member state, which we are governed by.
  • For the assertion, exercise, or defense of legal claims.

At anytime you have the opportunity to have deleted your data or delete the data and documents on your own in your application portal, the Smart-Profile of our provider SmartRecruiters (for details see para. 7). In the information about the retention period in para. 8. You can find details about the automatic erasure.

15. Right to complain (Art. 77 GDPR)

Irrespective of your rights you are entitled to lodge a complaint to a data protection supervisory authority, in case you think that the processing of your personal data violates the GDPR (Art. 77 GDPR).

The competent supervisory authority for the processing is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information)
Kavalleriestr. 2-4
40213 Düsseldorf
Tel: 0211/38424-0
Fax: 0211/38424-999
E-mail: poststelle@ldi.nrw.de