The protection of your personal data is very important to us. For this reason, we handle your personal data responsibly in all data processing operations and comply with the statutory data protection requirements, in particular the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
This privacy policy provides you with an overview of the following information:
Which of your personal data is collected, stored and processed via our websites (hereinafter also referred to as the ‘Service’)?
In what way, to what extent and for what purposes is this data used?
What security measures are in place to protect your data?
How can you obtain details of the information provided to us and, where applicable, exercise any other rights you are entitled to as a data subject?
1. Contact details of the data controller
e.solutions GmbH
Despag-Straße 4a
85055 Ingolstadt
Telefon: +49 8458 3332-100
Telefax: +49 8458 3332-333
www.esolutions.de
Contact details for our Data Protection Officer:
Claudia Langer
Chief Data Protection Officer
e.solutions GmbH
Despag-Straße 4a
85055 Ingolstadt, Germany
E-mail: datenschutzbeauftragter@esolutions.de
2. Purposes of data processing
You can apply for advertised vacancies with us via our internal job board. The purpose of data processing is to shortlist candidates for a potential internal transfer within e.solutions GmbH. In order to receive and process your application, we are required to collect the following applicant data:
Salutation,
First name and surname,
Address,
Email address,
Telephone number
Curriculum Vitae,
Knowledge of German and English
Preferred location
Current proportion of remote working
Should you voluntarily provide us with further data, we will use it solely for the purpose of processing your application and conducting the recruitment process.
You may also choose to provide us with additional documents (e.g. certificates, cover letters, etc.) to help us assess your application more effectively.
We will review your application and, if necessary, contact you to arrange appointments or clarify any queries.
If you apply for an internal vacancy at e.solutions, we will not, as a matter of principle, pass on your application details to third parties. If you have any questions regarding data protection during the application process (e.g. regarding your rights under data protection law), please contact our Data Protection Officer directly at datenschutzbeauftragter@esolutions.de.
We will store your application details once we have received your application. If we accept your application and subsequently offer you a position within the company, we will retain your application details for as long as is necessary for the purposes of your employment and to the extent that we are legally obliged to do so.
If we reject your internal application, we will retain your application data for a maximum of six months following the rejection of your application, unless you give us your consent to retain it for a longer period. We will contact you by telephone or email to find out whether you would be interested in having your application considered for another vacancy. If you let us know that you’re interested, we’ll send you a confirmation email shortly afterwards. Once this further recruitment process has been completed, we will retain your data for a further six months. Once this period has expired, the data will be automatically deleted.
If we do not have any other specific vacancies advertised at that time, you have the option of having your application details stored in our talent pool. We will contact you by email or telephone to find out whether your profile may be considered for future vacancies. Your details will only be stored once we have received your written confirmation. Once you have given your consent, we will retain your application details for a maximum of a further six months. Once this period has expired, the data will be automatically deleted.
Whenever you contact us (e.g. via the contact form or by email), your details will be stored for the purpose of processing your enquiry and in case any follow-up questions arise.
3. Legal basis for processing
The legal basis for processing your application data is
Article 6(1)(b) of the GDPR for the purposes of establishing and carrying out any internal transfer,
Article 6(1)(c) of the GDPR (in conjunction with the relevant legal obligation to which we are subject) for the purpose of complying with legal obligations to which the employer is subject,
Article 6(1)(f) of the GDPR to safeguard the legitimate interests of e.solutions or a third party, unless your interests or fundamental rights and freedoms take precedence,
Section 26(2), first sentence, of the BDSG (in conjunction with Article 6(1)(a) of the GDPR) on the basis of the consent you have given.
Where special categories of personal data are concerned (e.g. health data, Article 9(1) of the GDPR) is processed, such processing is carried out on the basis of Section 26(3), sentence 1 of the BDSG (in conjunction with Article 9(2)(b) of the GDPR) for the purpose of exercising rights or fulfilling legal obligations arising from labour law, social security law and social protection law, or on the basis of your consent pursuant to Section 26(2) and (3) of the BDSG (in conjunction with Article 9(2)(a) of the GDPR).
Please note that, in particular, CVs, certificates or any other data you submit for the purposes of your application may also contain particularly sensitive data (Article 9(1) of the GDPR). We therefore advise you not to provide any details relating to particularly sensitive data. If you provide us with information of this kind, we will use it solely to keep a record of your details and to process your application in accordance with this information.
4. Log files
We (or rather, our web hosting provider) process data relating to every visit to the website (so-called server log files, or system and usage data). Access data includes: Name of the webpage accessed, file, date and time of access, amount of data transferred, notification of successful access, referrer URL (the previously visited page), IP address and the requesting internet service provider. We use the log data solely for statistical analysis for the purposes of operating, securing and optimising our website. However, we reserve the right to review the log data retrospectively if there are specific grounds for a reasonable suspicion of unlawful use. The legal basis for the processing of personal data in log files is Article 6(1)(f) of the GDPR.
5. Disclosure of data
If you are applying for a specific internal vacancy with us, we will forward your application internally to the relevant departments so that they can process and assess it.
As a general rule, the data we collect is disclosed to third parties if:
you have given your explicit consent to this in accordance with Article 6(1), sentence 1, point (a) of the GDPR,
the disclosure is necessary pursuant to Article 6(1), sentence 1, point (f) of the GDPR for the establishment, exercise or defence of legal claims, and there is no reason to believe that there is an overriding legitimate interest in not disclosing the data,
we are legally obliged to disclose the data pursuant to Article 6(1), sentence 1, point (c) of the GDPR, or
this is permitted by law and is necessary, in accordance with Article 6(1), sentence 1, point (b) of the GDPR, for the performance of contractual relationships with you or for the implementation of pre-contractual measures taken in response to your enquiry.
Some of the data processing described in this privacy notice may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular, data centres that host our website and databases, IT service providers that maintain our systems, and consultancy firms. Where we pass data on to our service providers, they may only use the data for the purpose of carrying out their tasks. We have carefully selected and commissioned these service providers. They are contractually bound to follow our instructions, have appropriate technical and organisational measures in place to protect the rights of data subjects, ensure an adequate level of data protection, and are subject to careful monitoring by us.
Furthermore, data may be disclosed in connection with requests from public authorities, court orders and legal proceedings where this is necessary for the pursuit or enforcement of legal claims.
6. Retention period
As a general rule, we retain your application details for six months from the date,
once you have received our notification regarding the decision on who has been appointed to the advertised post, or
following your notification that you are withdrawing your application,
in order to be able to respond, where necessary, to claims brought under the General Equal Treatment Act (AGG). If a legal dispute arises with you in this context, we will retain your application data beyond these six months until the legal dispute has been resolved.
In addition, we will retain your data even after the application process has ended if
a balanced assessment suggests that it is necessary to retain the data for the time being in view of a future legal dispute with you,
a legal dispute with you is certainly on the cards, or
a legal dispute with you is already underway.
In the cases listed above, we will retain your application details until the conclusion of the relevant legal proceedings at the latest.
7. Safety
We maintain up-to-date technical measures to ensure data security, in particular to protect your personal data from risks associated with data transmission and from unauthorised access by third parties. These are each adapted in line with the current state of the art.
8. Third-party services
Apply via the form on the website using onlyfy (by Xing)
If you apply for a vacancy via our internal job board, you will be redirected to a page where you can enter and submit your application details. We provide this website with the assistance of our service provider, New Work SE, Am Strandkai 1, 20457 Hamburg (hereinafter ‘New Work SE’). New Work SE provides the application form and the technical infrastructure on our behalf. As part of this, New Work SE processes the log files referred to in section 4 of this privacy policy on our behalf and sets a session cookie (PHPSESSID), which is required to display the application page containing the form and which expires when the window containing the form is closed.
Once you have submitted your application documents in full, they will appear in our applicant tracking system, Onlyfy. We process the application documents received via our applicant tracking system as part of the recruitment process on the basis of our legitimate interests in receiving and using the application data for the recruitment process, in accordance with Article 6(1)(f) of the GDPR.
onlyfy one
We use the ‘onlyfy one’ (by XING) service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, to process and manage job applications. Through onlyfy one, we can, amongst other things, publish job advertisements, identify promising talent (including, for example, from the professional network XING), receive and manage applications, and engage with talent and applicants. Among other things, New Work SE provides recommendations for talented individuals, displays these on our company account, and generates recruitment-related information and analyses based on data that New Work SE processes in onlyfy one and, for example, in other XING applications or externally.
With regard to certain data processing activities, New Work SE and we are joint controllers within the meaning of Article 26(1), sentence 1, of the GDPR. With regard to data processing for which New Work SE is solely responsible or is responsible jointly with us (see also the table in this section for details of responsibility), you can find further information in XING’s privacy policy at https://privacy.XING.com/de/datenschutzerklaerung. You can find a list of the sub-processors used by New Work SE, who are the recipients of the data processed under joint controllership, here.
You can find the agreement concluded between us and New Work SE here. Below, we set out the key points of the agreement entered into with New Work SE, as well as the scope of joint responsibility and the allocation of responsibilities for fulfilling the obligations under the GDPR. As part of the joint responsibility between New Work SE and us, the following types of data are processed in accordance with the agreement entered into with New Work:
Personal details (e.g. name, contact details, date of birth, etc.);
Qualification details (CVs, etc.);
optional details (application photograph or other information, additional questions specific to the relevant vacancy, etc.);
Communication data;
special categories of personal data as defined in Article 9(1) of the GDPR, e.g. health-related information (e.g. status as a person with a severe disability) or information that allows conclusions to be drawn about sexual orientation, ethnic origin or religion;
Usage data, including that collected via cookies and similar technologies;
Data collected in the course of support services (email address, name, context of the enquiry, other personal data, etc.)
The categories of data mentioned above are processed in connection with the following processing operations as part of joint responsibility under the authority of the following parties:
Processing step | Responsibility |
Storage of applicant data in our applicant tracking system | Us |
Displaying and recommending candidates in our applicant tracking system | New Work SE |
Collection of usage data, tracking, including through the use of cookies and similar technologies | New Work SE |
The collection of data generated or processed in our applicant tracking system, including usage data and automatically collected data – including that gathered via tracking technologies and cookies – for New Work SE’s own purposes | New Work SE |
Provision of “Insights”: Generating and providing recruitment-related information and analyses based on data from our account | New Work SE |
Product support for talent or applicants regarding the products and services covered, including information on product changes, etc. | New Work SE |
The selection and implementation of third-party tools made available to us for use in connection with the products and services covered, as well as the associated processing of data by data processors and/or the disclosure of data | New Work SE |
The party responsible for any of the processing operations listed above is, as one of the joint controllers, responsible for ensuring that a legal basis under the GDPR exists and for fulfilling the data subjects’ rights under Article 15 of the GDPR (right of access), Article 16 of the GDPR (right to rectification), Article 17 of the GDPR (right to erasure), Article 18 of the GDPR (right to restriction of processing), Article 20 of the GDPR (right to data portability) and Article 21 of the GDPR (right to object).
New Work SE is solely responsible for fulfilling the right set out in Article 22(3) of the GDPR (the right to obtain human intervention, to set out one’s own point of view and to contest the decision in the event of automated decisions in individual cases with legal or adversely affecting consequences). Notwithstanding the responsibilities agreed between us and New Work regarding the fulfilment of data subjects’ rights, you may contact the organisation of your choice to exercise your data subjects’ rights. In practice, however, it is certainly more effective if you contact New Work SE in the first instance, as – as shown in the table – we are only responsible for storing data relating to applicants in our account.
Furthermore, New Work SE is solely responsible for ensuring compliance with the requirements set out in Article 25 of the GDPR (data protection by design and by default) and for carrying out a risk assessment of the processing operations. In addition, New Work SE is also responsible for issuing notifications in connection with data breaches pursuant to Article 34(1) of the GDPR, provided that such a data breach is not caused by our technical implementation and configuration.
We use onlyfy one on the basis of our legitimate interests in processing and managing applications, receiving recommendations for potential candidates from New Work SE, communicating with candidates via onlyfy one, and obtaining recruitment-related information and analyses based on data from our applicant tracking system. The legal basis is Article 6(1)(f) of the GDPR. If you provide us with special categories of personal data as part of your application, the processing will be carried out on the basis of Section 26(3), first sentence, of the BDSG (in conjunction with Article 9(2)(b) of the GDPR) for the purpose of exercising rights or fulfilling legal obligations arising from labour law, social security law and social protection law, or on the basis of your consent in accordance with Section 26(2) and (3) of the BDSG (in conjunction with Article 9(2)(a) of the GDPR).
Video interviews using Microsoft Teams
We use the online video conferencing system Microsoft Teams (‘MS Teams’) to conduct video interviews; this is provided to us by our contractual partner, Microsoft Ireland Operations Limited (One Microsoft Place, South Country Business Park, Leopardstown, Dublin 18, DP18 P521, Ireland, ‘Microsoft’). Microsoft and the sub-processors named here are the recipients of the data we process when you communicate with our staff via Microsoft Teams.
We process the following data when you communicate with our staff via MS Teams:
Information about your Microsoft Teams account, the version of Microsoft Teams and the settings;
Information about meetings and their participants;
Status information (offline, inactive, active, in a meeting, etc.);
personal data as part of video and audio quality data;
personal data contained in text, video and audio files;
personal data as part of analyses and reports that can be created in MS Teams.
The legal basis for the processing of data is our legitimate interests within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interests lie in providing and using a widely used tool for video interviews, as well as in conducting such interviews to avoid the need for travel and to allow for flexible scheduling, and in providing translations in the form of Microsoft Live Captions in Teams to improve comprehensibility. Microsoft also processes the data for the purposes set out here on page 10 under ‘Processing for business activities arising from the provision of products and services to customers’ in its capacity as an independent data controller.
When using MS Teams, data is transferred to the USA and other countries where Microsoft or Microsoft’s sub-processors are based. Such data transfers between a Microsoft company established in the EU and sub-processors commissioned by Microsoft or Microsoft companies established in third countries are carried out on the basis of the EU Standard Data Protection Clauses, Module 3 (Implementing Decision (EU) 2021/914 of 4 June 2021) or, in the case of data transfers to the USA, additionally on the basis of the adequacy decision and Microsoft’s certification under the Data Privacy Framework (the certification is available at the following URL: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active). As Microsoft enters into EU Standard Data Protection Clauses with other companies, you must contact Microsoft to obtain a copy of the EU Standard Data Protection Clauses. You can do this, for example, using the form at the following URL: https://www.microsoft.com/de-de/privacy/privacy-support-requests.
Analysing key performance indicators for the recruitment process using Microsoft Power BI
In order to assess the effectiveness of our recruitment measures, improve specific business processes and, in this context, measure certain factors (e.g. candidate experience or budget planning), we collate various data sets and use Microsoft Power BI (‘Power BI’) to generate reports. These reports enable us to analyse and evaluate our recruitment initiatives more effectively. The Power BI service is provided to us by our contractual partner, Microsoft Ireland Operations Limited (One Microsoft Place, South Country Business Park, Leopardstown, Dublin 18, DP18 P521, Ireland, “Microsoft”).
For the purposes set out above, we process the following data via Power BI:
Applicant details (surname, first name, address, date of birth, nationality, email address);
Data on the recruitment process (application channel, outcome of the recruitment process, number of applications, number of successful candidates / rejections, number of interviews, reasons for rejection).
The legal basis for the processing of data is our legitimate interests within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interests lie in regularly assessing the effectiveness of our recruitment channels and producing reports for various stakeholders within the company. Furthermore, as part of the evaluation, we would like to derive key business indicators to measure certain factors (e.g. candidate experience or budget planning) and, ultimately, improve our business processes.
9. Your rights
You have the right at any time to request information regarding our processing of your personal data. As part of the process of providing you with information, we will explain how your data is processed and provide you with an overview of the personal data we hold about you.
If any data we hold about you is incorrect or out of date, you have the right to have that data corrected.
You may also request that your data be deleted. Should deletion, in exceptional cases, not be possible due to other legal provisions, the data will be blocked so that it remains available solely for that legal purpose.
You can also request that the processing of your data be restricted, for example if you believe that the data we hold is incorrect. You also have the right to data portability, which means that, upon request, we will provide you with a digital copy of the personal data you have supplied.
To exercise the rights described here, you can contact us at any time using the contact details provided above. This also applies if you wish to receive copies of guarantees to demonstrate an adequate level of data protection.
You also have the right to object to the processing of your personal data where such processing is based on Article 6(1), sentence 1, point (e) or (f) of the GDPR, or where it is carried out for the purposes of direct marketing.
You do, after all, have the right to lodge a complaint with the data protection supervisory authority responsible for us. You may exercise this right by contacting a supervisory authority in the Member State where you are resident, where you work, or where the alleged infringement took place. In Bavaria, the competent supervisory authority is: Bavarian State Office for Data Protection Supervision, Promenade 27, 91522 Ansbach.
Right of withdrawal and right to object
In accordance with Article 7(2) of the GDPR, you have the right to withdraw any consent you have given at any time. As a result, we will no longer continue to process data on the basis of this consent in future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.
Where we process your data on the basis of legitimate interests in accordance with Article 6(1)(f) of the GDPR, you have the right, under Article 21 of the GDPR, to object to the processing of your data and to provide us with reasons arising from your particular situation which, in your view, demonstrate that your legitimate interests outweigh those of the controller.
If you wish to exercise your right of withdrawal or right to object, simply send an informal notification to the contact details given above.