Encavis Group Privacy Notice for Job Applicants
Privacy Notice for Applicants and Email, Telephone and Video
Conference Contacts in accordance with Articles 13 and 14 of the General Data
Protection Regulation (GDPR)
The purpose of this privacy notice is to provide information
about which personal data is processed in connection with your application to
companies within the Encavis Group. It applies to all methods by which
individuals apply to companies within the Encavis Group.
Data controller
ENCAVIS Management GmbH & Co. KG, ENCAVIS GmbH, Encavis
Asset Management AG, Encavis Portfolio Management GmbH, Asset Ocean GmbH and
Stern Energy GmbH constitute a group of companies within the meaning of Article
4(19) of the GDPR. To ensure processes are efficient and consistent, certain
administrative tasks are carried out centrally for the companies within the
group. This is handled by ENCAVIS GmbH, People & Culture, Große Elbstraße
59, 22767 Hamburg, jobs@encavis.com, +49 (40) 378562-0. If you apply to ENCAVIS
Management GmbH & Co. KG, Encavis Asset Management AG, Encavis Portfolio
Management GmbH, Asset Ocean GmbH or Stern Energy GmbH, there is therefore
joint responsibility between the respective company and ENCAVIS GmbH.
Within the framework of joint responsibility, ENCAVIS GmbH
has concluded an agreement with the other controllers in accordance with
Article 26(1) of the GDPR, which sets out in a transparent manner which of them
fulfils which obligation under the General Data Protection Regulation.
Essentially, the following has been stipulated in this agreement in accordance
with Article 26(1) of the GDPR:
- The
organisation of the processing operations has been jointly determined and
agreed upon and is carried out as described below;
- the
rights of data subjects may be exercised equally with any controller using
the contact details provided above;
- the
information obligations under Article 13 and, where applicable, Article 14
of the GDPR are fulfilled by ENCAVIS GmbH by publishing these agreed data
protection notices.
Contact details of the Data Protection Officer
You can contact our Group Data Protection Officer atdatenschutz@encavis.com .
Source of the data
If you apply directly to an Encavis company, we collect all
data directly from you. If you are referred to us by a recruitment agency, we
receive your application documents, as well as all data that you have provided
to the recruitment agency up to the point of transmission of the data to us,
from the agency. In the subsequent process, we collect data exclusively from
you.
Scope and purpose of data processing, type of data, legal
basis
Conducting the application process
All data provided to us by you or a recruitment agency is
processed for the purpose of conducting the application and selection process
and serves to assess your professional and personal suitability and to contact
you, including by email or telephone, as well as to conduct interviews and make
a decision regarding your employment.
In this context, we process your personal contact details,
including your telephone number and email address, title, first name, surname,
CV, and details of your education and qualifications. In addition, we process
all information you provide to us during a face-to-face interview. The legal
basis is Article 6(1)(b) of the GDPR in conjunction with Article 88(1) of the
GDPR and Section 26 of the BDSG.
Furthermore, your email address and content data are
processed for the administration, conduct and evaluation of personality tests.
This includes a detailed profile of character traits, motivations and
competencies in the form of a comprehensive results report. The legal basis is
Article 6(1)(f) of the GDPR, namely our legitimate interest in support with
candidate selection.
You are not subject to automated decision-making or
profiling by us.
Inclusion in the applicant pool
We will only include you in our applicant pool following
your consent (Article 6(1)(a) GDPR) and, in this context, will store the data
collected during a previous application process.
When applying via recruitment agencies: Fulfilment of our
contractual obligations
If you apply to us via a recruitment agency, the contractual
arrangements with them usually stipulate that a placement fee is payable
following a successful placement, in some cases only after the probationary
period has ended. This fee is based on your earnings, including all
remuneration components. We will therefore provide the recruitment agencies
with information regarding your annual salary and other remuneration
components, such as a company car, on the basis of which the placement fee is
calculated. We must also inform the recruitment agencies whether you have
successfully completed the probationary period or whether you have left us of
your own accord. You have already been informed of this by the recruitment
agency. The legal basis for this processing is Article 6(1)(f) of the GDPR,
namely our legitimate interest in fulfilling the recruitment contract concluded
between the recruitment agency and us.
Recipients of your data
Your application documents will only be passed on to those
departments involved in the application process and which require the data in
this context. These are the P&C department (ENCAVIS GmbH), the relevant
specialist department within the company to which you are applying, and the
management of the company to which you are applying.
If you have applied for a position at Encavis Portfolio
Management GmbH, we may, depending on the role, be obliged to transfer certain
personal data to the Federal Financial Supervisory Authority (BaFin). BaFin
receives the personal data to assess professional suitability, reliability and
availability in accordance with legal requirements. The legal basis for this
processing is Article 6(1)(c) of the GDPR.
In addition, d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097
Hamburg, supports us as a technical service provider for the applicant
management system through which you can submit your application to us. When you
click on a job vacancy to view details, or when you click on ‘Apply
spontaneously’, we will redirect you to d.vinci. The rest of the process takes
place there. We also use this system internally when we receive applications
via recruitment agencies.
For electronic communication, such as emails or initial
consultations via video call, we use the service provider Microsoft Ireland
Operations Limited to operate Microsoft 365 Online. The data storage location
for so-called dormant data is Germany. However, it cannot be ruled out that, in
exceptional cases, personal data may be transferred to Microsoft Corp., USA. In
this case, Microsoft Corp., USA, is certified in accordance with the Data
Privacy Framework (DPF). The DPF is a so-called adequacy decision and, together
with the certification, constitutes a valid guarantee in accordance with Art.
44 et seq. of the GDPR for data transfers to the USA.
To assist with candidate selection, we use the “LINC
Personality Profiler” platform provided by LINC GmbH, Grapengießerstr. 16,
21335 Lüneburg.
We use Hetzner Online GmbH, Industriestraße 25, 91710
Gunzenhausen, for the operation of the data centre and the provision of
servers.
Beyond this, we do not, as a matter of principle, disclose
any personal data to third parties.
Transfers to a third country
No data is transferred to entities in countries outside the
European Economic Area (so-called third countries).
Retention period
If you are hired, we will transfer your data to your
personnel file and store it for at least the duration of your employment.
If we do not reach an agreement, we will delete your data
six months after the end of the application process. The legal basis for this
storage is our obligation (Art. 6(1)(c) GDPR) to be able to demonstrate that we
comply with the provisions of the General Equal Treatment Act (AGG).
Excluded from deletion are the data of those applicants who
have given us their consent to continue storing their data in the applicant
pool. This data is reviewed annually to determine whether there is a need for
further storage. If this is not the case, the data will be deleted.
Furthermore, your data will be deleted from the applicant pool immediately if
you request this or withdraw your consent to its storage.
If you withdraw your application during an ongoing
application process, we will delete your data immediately. We will only
continue to store your notification regarding your withdrawal from the process
and will delete this six months after the end of the application process. The
legal basis for this storage is our obligation (Art. 6(1)(c) GDPR) to be able
to demonstrate that we comply with the provisions of the General Equal
Treatment Act (AGG).
Your rights
If you wish to exercise any of your rights, please contact
us as the data controller using the contact details provided above or use one
of the other methods we offer to send us this notification.
Right of access
Under Article 15 of the GDPR, you have the right to request
confirmation from us as to whether we are processing personal data relating to
you. If this is the case, you have the right to access this personal data and
to further information as set out in Article 15 of the GDPR.
Right to rectification/completion
Under Article 16 of the GDPR, you have the right to request
that we rectify any inaccurate personal data concerning you without delay.
Taking into account the purposes of the processing, you also have the right to
request the completion of incomplete personal data – including by means of a
supplementary statement.
Right to erasure
You have the right to request that we erase personal data
concerning you without undue delay. We are obliged to erase personal data
without undue delay, provided that the relevant conditions of Article 17 of the
GDPR are met. For further details, please refer to Article 17 of the GDPR.
Right to restriction of processing
In accordance with Article 18 of the GDPR, you have the
right, under certain conditions, to request that we restrict the processing of
your personal data.
Right to data portability
Under Article 20 of the GDPR, you have the right to receive
the personal data concerning you that you have provided to us in a structured,
commonly used and machine-readable format, and you have the right to transmit
this data to another controller without hindrance from us, provided that the
processing is based on consent pursuant to Article 6(1)(a) GDPR or Article
9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR, and the
processing is carried out by automated means.
Right to withdraw consent
In accordance with Article 7 of the GDPR, you have the right
to withdraw your consent at any time and without giving any reason. Please note
that withdrawal applies only to the future and does not affect the lawfulness
of processing carried out in the past.
Right to object
Where we cite our legitimate interest pursuant to Article
6(1)(f) of the GDPR as the legal basis, you are entitled to the right to object
set out below in accordance with Article 21 of the GDPR.
Under Article 21 of the GDPR, you have the right to
object to the processing of your personal data carried out on the basis of
Article 6(1)(e) or (f) of the GDPR ; this also applies to profiling based on
these provisions.
Where we process your personal data for the purposes of
direct marketing, you have the right at any time to object to the processing of
personal data concerning you for the purposes of such marketing; this also
applies to profiling insofar as it is related to such direct marketing.
Right to lodge a complaint
Under Article 77 of the GDPR, without prejudice to any other
administrative or judicial remedy, you have the right to lodge a complaint with
the supervisory authority. This right applies in particular in the Member State
of your habitual residence, your place of work or the place of the alleged
infringement, if you consider that the processing of personal data relating to
you infringes the GDPR.
Reservation of the right to make changes
We reserve the right to amend our security and data
protection measures at any time, in particular where this becomes necessary due
to technical developments. In such cases, we may also update this privacy
notice accordingly. Please therefore refer to the current version of this
privacy notice.
