Information on how we handle your data as an applicant
We process your personal data in accordance with the requirements of the German Telemedia Act and the EU General Data Protection Regulation.
Our purpose here is to inform you about what is done with your data and your rights in this connection.
1. Preliminary remark
The purpose of the following points is to provide you with information about your data. The law has determined which information is necessary in this connection.
Those interested to learn more can consult Articles 12 through 22 and 34 of the General Data Protection Regulation. The text of the General Data Protection Regulation (GDPR) can be found online here: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 If you have any further questions about the General Data Protection Regulation, please feel free to contact the data protection officer and/or the administration at any time.
2. What are personal data?
Any information relating to an identified or identifiable person. A person is deemed identifiable if he or she can be identified directly or indirectly. This can be done, for example, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors.
3. Basic information
3.1 Who is responsible for the processing of my data?
The party responsible for data processing is
Häcker Küchen GmbH & Co. KG
32289 Rödinghausen, Germany
Tel. +49 (0)5476 / 940-0
3.2 Which authority is responsible for control and compliance with the laws governing data protection?
Responsible supervisory authority for data protection
The State Officer for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 200444, 40102 Düsseldorf, Germany
Telephone: +49 (0)211 / 384240
3.3 How can I reach the company’s data protection officer?
Our company’s Data Protection Officer is Leonie Francke. The data protection officer can be reached as follows:
4. Other important information
4.1 Data collection during the application process (Why?)
Before you decide for us and we decide for you, we’d like to get acquainted. As a first step, we routinely make use of the information and documents you have submitted to us, whether in writing or in text form. The next step is to get acquainted personally, during which we have an opportunity to learn more about one another. We collect this data in order to be able to make a well-founded decision that will characterise our cooperation over the long term.
4.2 Why are we permitted to do this?
The law on data protection permits (pursuant to Section 26 (1) (1) BDSG (rev.) in conjunction with Article 88 (1) GDPR) the collection of such data as are required for the establishment of the employment relationship. If you voluntarily tell us things about yourself, beyond what is necessary, the law on data protection permits us to collect this information within scope of your consent (pursuant to Article 6 (1) (1) (a) GDPR).
The basis in law for collecting the above-referenced mandatory disclosures is Section 26 (1) (1) BDSG (rev.) in conjunction with Article 88 (1) GDPR.
4.3 Who can receive data about me?
Within the scope of processing, your data may be transmitted to:
- Persons within our company who are directly involved in data processing (e.g. Human Resources)
- Service providers that are bound by contract, have an obligation to secrecy and perform partial tasks of data processing
- External companies, if required. Examples of these firms are the providers of postal services for the delivery of letters
4.4 Will you transmit my data to countries outside the European Union?
We have no plans to do so. An exception to this would be conceivable only if you were to make arrangements for our doing so: if, for example, you were to inform us of a bank account outside the European Union to which we were to transfer money. The legal bases for this can be found in Article 6 (1) (b) GDPR, Section 24 BDSG (rev.) and Article 49 (1) (b) GDPR.
4.5 How long will you store my data?
We shall store your data for as long as we need to do so in order to fulfil the purposes as outlined in 4.1 above. Not later than six months following the employment decision, either the documents in paper form will be returned to you, or the documents in digital form will be deleted. This deadline protects the company from invocations by applicants of the German General Act on Equal Treatment (AGG). There may, however, be provisions of statute (e.g. Section 147 of the German Tax Code) that require us to retain certain documents for six or ten years. Following the end of the retention period, we delete any data that are no longer required.
4.6 Am I required to provide my data?
In order to achieve the grounds set out in Item 4.1, you must make your personal data available to us.
This is absolutely necessary to conclude the employment agreement with you. If you do not provide these personal data, we cannot conclude an agreement with you.
In the event of complaint, you may contact the relevant supervisory authority at any time. The supervisory authority referenced in Item 3.3. has jurisdiction over our company in these matters.
You have the right to have this judicially reviewed, against a supervisory authority pursuant to Article 78 GDPR, and against our company pursuant to Article 79 GDPR.
4.7 Automated decision-making / profiling
Automated decision-making / profiling does not occur.
5. What rights do I have?
5.1 About your rights
As a data subject of data processing, under the General Data Protection Regulation you have the following rights, among others (hereinafter referred to as ‘rights of data subjects’).
5.2 Rights to information (under Article 15 GDPR)
You have the right to obtain information as to whether or not your personal data are being processed. If we process personal data about you, you are entitled to learn
- why we process your data (see also Item 4.1);
- the types of data we process about you;
- the type of recipients that receive or are to receive data about you (see also Item 4.3);
- how long we will store your data; if details about the storage period are not available, we must indicate how the storage period is determined (e.g. following expiry of legal retention periods) (see also Item 4.5);
- that you have a right to rectification and erasure of the data relating to you, including the right to restrict processing and/or the option of objection (in this connection, see also Items 5.2, 5.3 and those that follow);
- that you have a right to lodge a complaint with a supervisory authority;
- where your data come from, if we have not collected them from you directly;
- whether your data are used for an automated decision-making, and, if this is the case, to learn which underlying decision-making logic is involved, along with the consequences and significance of automated decision-making for you;
- that, if data about you are transferred to a country outside the European Union, you are entitled to obtain information as to whether and, if so, which, appropriate levels of security are ensured on the part of the data recipient;
- that you have the right to request a copy of your personal data. Data copies are always provided in electronic form.
The first copy is free of charge; additional copies may be subject to a reasonable fee. A copy can be provided only if to do so does not impinge upon the rights of other persons.
5.3 Right to rectify data (under Article 16 GDPR)
You have the right to compel us to rectify your data if these are inaccurate and/or incomplete. This right also includes the right to have incomplete personal data completed by supplementary declarations or communications. A rectification and/or supplement must be forthcoming without undue delay.
5.4 Right to erasure of personal data (under Article 17 GDPR)
You have the right to obtain from us the erasure of your personal data if
- the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
- the data processing is done on the basis of a consent you have granted, and you have withdrawn this consent; this does not apply, however, if there is another legal permission for processing these data;
- you have filed an objection to processing of the data the legal permission for which lies within the realm of so-called ‘legitimate interest’ (as set forth in Article 6 (1) (e) or (f)); there is no erasure requirement, however if overriding legitimate grounds for continued processing exist;
- you have objected to data processing for purposes of direct marketing;
- your personal data have been unlawfully processed;
- the data in question are those of a child and have been collected for information-society services (=electronic service) on the basis of the consent (pursuant to Article 8 (1) GDPR).
A right to erasure of personal data does not exist if
- the erasure request is in conflict with the right of freedom of expression and information;
- processing of personal data is required
- to comply with a legal obligation (e.g. statutory retention obligations),
- for the exercise of public functions and interests under applicable law (this also includes ‘public health’) or
- for archiving and/or research purposes;
- the personal data are required for the establishment, exercise or defence of legal claims.
Erasure must be carried out immediately (without undue delay). If we have made personal data public (e.g. online), we must see to it, to the extent technically feasible and reasonable, that other data processors are also notified of the erasure request, including the deletion of links, copies and/or replications.
5.5 Right to restriction of data processing (under Article 18 GDPR)
You have the right to obtain a restriction on the processing of your personal data in the following cases:
- If you have disputed the accuracy of your personal data, you may request that we make no other use of your data for the duration of the review of the accuracy of the personal data, thereby restricting their processing.
- In the event of unlawful data processing, you may request restriction of data usage instead of data erasure;
- If you need your personal data to establish, exercise or defend legal claims, but we no longer have a need for your personal data, you may request us to restrict processing to the legal purposes involved;
- If you have objected to data processing (under Article 21 (1) GDPR) (see also Item 5.7), and it has not yet been determined whether our interests in processing these data override your interests, you may request that your data not be used for other purposes for the duration of the review, thereby restricting their processing.
Personal data the processing of which has been restricted at your request may, with the exception of storage, be processed only
- with your consent;
- for the establishment, exercise or defence of legal claims,
- for the protection of the rights of another natural or legal person, or
- for reasons of important public interest.
If a processing restriction is lifted, you will receive advance notification of this fact.
5.6 Right to data portability (under Article 20 GDPR)
You have the right to request that we furnish you, in a commonly used electronic format (e.g. as a PDF or Excel document), with the data that you provided to us.
You may also ask us to send these data directly to another company (specified by you), provided that it is technically feasible for us to do so.
The condition for your right in this regard is that the processing is done on the basis of consent, or for implementing a contract and carried out with the aid of automated means.
The exercise of the right to data portability must not adversely affect the rights and freedoms of other persons.
If you exercise the right to data portability, you will continue to enjoy the right to data erasure pursuant to Article 17 GDPR.
5.7 Right to object to certain forms of data processing (under Article 21 GDPR)
If your data are processed for the performance of a task carried out in the public interest or for the exercise of legitimate interests, you may object to this processing. Your objection must be accompanied by the grounds relating to your particular situation. These grounds may include special family circumstances, for instance, or a legitimate interest in maintaining confidentiality.
In the event of an objection, we must refrain from all further processing of your data for the purposes set forth, unless
- there are compelling, legitimate reasons for processing that outweigh your interests, rights and freedoms, or
- processing is required for the establishment, exercise or defence of legal claims.
You may object at any time to the use of your data for the purpose of direct marketing; this also applies to profiling in connection with direct marketing. In the case of an objection, we may no longer use your data for purposes of direct marketing.
Under no circumstances do we initiate or carry out direct marketing and/or profiling.
5.8 Prohibition of automated decision-making/profiling (under Article 22 GDPR)
You have the right not to be subject to a decision by us that is based solely on automated processing of personal data and produces legal effects concerning you or significantly affects you in similar ways. This also includes profiling. This prohibition does not apply where automated decision-making
- is necessary for entering into, or performance of, a contract with you,
- is authorised by provisions of law, where these legal provisions contain appropriate measures to protect your rights and freedoms as well as your legitimate interests, or
- is carried out with your express consent.
Decisions based solely on automated processing of special categories of personal data (=sensitive data) are permitted only if
- they are taken pursuant to your express consent or
- a significant public interest in their processing exists
and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.
5.9 Exercise of the rights of data subjects
Please contact the entity listed in Item 3.2 for further information on the exercise of your rights as a data subject. Requests submitted electronically will usually be answered electronically. As a matter of principle, the information, communications and measures that must be provided under GDPR, including the exercise of the rights of data subjects, are provided free of charge. Only in the case of manifestly baseless or excessive applications are we entitled to charge an adequate fee for processing or to refrain from taking action (under Article 12 (5) GDPR).
If there are reasonable doubts as to your identity, we may require additional information from you for identification purposes. If identification is not possible, we are entitled to decline to process your request. Where possible, we will notify you separately of any impossibility of verifying your identity (see Article 12 (6) and Article 11 GDPR).
Disclosure and information requests are usually processed immediately within one month after receipt of the request. The period may be extended for another two months if this is necessary taking into account the complexity and/or the number of requests; if this period is extended, we will notify you of the grounds for the delay within a month of receiving your request. If we should fail or decline to act on a request, we will notify you immediately, within one month of receiving your request, of the grounds for this and inform you of the option of filing a complaint with a supervisory authority or pursuing judicial remedies (see Article 12 (3) and (4) GDPR).
Please bear in mind that you can only exercise your rights as a data subject within the framework of the limitations and restrictions as provided within the European Union or its Member States (Article 23 GDPR).
6. Miscellaneous information
6.1 Use of your application data
Your application data will be used exclusively for application procedures at Häcker Küchen GmbH & Co. KG. We are assisted in this connection by d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, Germany, acting in its capacity as a provider of technical services. Data are transmitted in encrypted form, in application of the recognised state of the art. There will be no further use or transfer of your application data to any third parties. Through technical and organisational measures, d.vinci HR-Systems GmbH ensures the protection of data in compliance with the General Data Protection Regulation (GDPR).
The applicant-management system stores cookies on your computer that make it easier for you to navigate through and work in the system. The applicant-management system uses temporary cookies only; these are automatically deleted once the browser is closed.