Privacy Notice of the Encavis Group for Applicants
Privacy notice for applicants and email, telephone and video conference contacts pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR)
The purpose of this privacy notice is to inform you about which personal data are processed in connection with your application within the companies of the Encavis Group. It applies to all channels through which individuals apply to companies of the Encavis Group.
Controllers responsible for the processing
ENCAVIS Management GmbH & Co. KG, ENCAVIS GmbH, Encavis Asset Management AG, Encavis Portfolio Management GmbH, Asset Ocean GmbH and Stern Energy SpA constitute a group of undertakings within the meaning of Art. 4(19) GDPR. In order to design processes efficiently and uniformly, certain administrative activities are performed centrally for the companies of the group. This is done by ENCAVIS GmbH, People & Culture, Große Elbstraße 59, 22767 Hamburg, jobs@encavis.com, + 49 (40) 378562-0. If you apply to ENCAVIS Management GmbH & Co. KG, Encavis Asset Management AG, Encavis Portfolio Management GmbH, Asset Ocean GmbH or Stern Energy SpA, there is therefore joint controllership between the respective company and ENCAVIS GmbH.
Within the framework of the joint controllership, ENCAVIS GmbH has concluded an agreement with each of the other controllers pursuant to Art. 26(1) GDPR, which sets out in a transparent manner which of them fulfils which obligation under the General Data Protection Regulation. In essence, the following has been laid down in this agreement pursuant to Art. 26(1) GDPR:
- The processing operations were designed and coordinated jointly and are carried out as described below;
- the rights of the data subjects can be exercised equally with each controller using the contact details provided above;
- the information obligations pursuant to Art. 13 and, where applicable, Art. 14 GDPR are fulfilled by ENCAVIS GmbH by publishing this coordinated privacy notice.
Contact details of the Data Protection Officer
You can reach our Group Data Protection Officer at datenschutz@encavis.com.
Source of the data
If you apply directly to an Encavis company, we collect all data directly from you. In the event that you are referred to us by a recruitment agency, we receive from that agency your application documents and all data that you provided to the recruitment agency up to the time the data were transmitted to us. In the subsequent process, we collect data exclusively from you.
Further data are generated during the application process through entries made by the persons responsible and by the applicant management system, in particular search and evaluation criteria, AI-generated criteria suggestions, overall and detailed evaluations as well as technical usage and log data.
Scope and purpose of data processing, type of data, legal basis
Conducting the application process
All data that you or a recruitment agency provide to us are processed for the purpose of conducting the application and selection procedure and serve to assess your professional and personal suitability and to contact you, including by email or telephone, as well as to conduct job interviews and to decide on hiring.
In this context, we process your private contact details, including telephone number and email address, form of address, first name, surname, CV and data on your education and qualifications. In addition, we process all information that you provide to us in a personal interview. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).
Furthermore, your email address and content data are processed for the administration, performance and evaluation of personality tests. This includes a differentiated profile of character traits, motives and competencies in the form of a detailed results report. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in being supported in the selection of candidates.
AI-supported assistance through Prefilling and Prescreening
In the d.vinci applicant management system, we use the AI-supported functions “Prefilling” and “Prescreening”. Prefilling supports the persons responsible in formulating search and evaluation criteria. For this purpose, a text with job requirements entered by the persons responsible is processed and suggestions for structured criteria are generated. The suggestions are not adopted automatically. The persons responsible review, modify, supplement or discard them and determine the final criteria.
Prescreening supports the structured preliminary review of incoming applications. For this purpose, form data and the contents of the submitted documents, in particular cover letters, CVs, references, certificates and answers to screening questions, are extracted by technical means. For scanned or image-based documents, text recognition may be performed using OCR. The contents are matched against the previously approved selection criteria with AI support. The system generates an overall evaluation and detailed evaluations of the individual criteria, each with a justification. The results can be used in the application list for orientation, filtering and sorting. Technical measures intended to reduce possible bias in the evaluation are used in this process.
The purpose of the AI-supported processing is the uniform, structured and more efficient preliminary review of applications and supporting the persons responsible in screening and prioritisation. The processing of your application data in the application procedure is generally based on Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG. We base the additional AI-supported analysis and evaluation as part of Prescreening on Art. 6(1)(f) GDPR. Our legitimate interest lies in the above-mentioned purpose of a uniform, structured and efficient preliminary review of applications and in supporting the persons responsible in screening and prioritisation.
The AI-supported analysis and evaluation as part of Prescreening constitutes profiling within the meaning of Art. 4(4) GDPR. However, no decision based solely on automated processing within the meaning of Art. 22(1) GDPR is made. The evaluations generated by Prescreening and any sorting or filtering based on them serve as an aid to decision-making. Before a decision is made, the persons responsible independently review the relevant application documents and evaluation results and may deviate from the AI-supported evaluation. The final decision on the further course of your application is made exclusively by the persons responsible.
Inclusion in the talent pool
We include you in our talent pool only after you have given your corresponding consent (Art. 6(1)(a) GDPR) and, in this context, store the data collected during a previous application process.
In the case of applications via recruitment agencies: fulfilment of our contractual obligations
If you apply to us via a recruitment agency, the contractual arrangements with such agencies usually provide that a placement fee becomes due after a successful placement, in some cases only after the end of the probationary period. This fee depends on your earnings, including all remuneration components. We will therefore transmit to the recruitment agencies information on your annual salary and other remuneration components, such as a company car, on the basis of which the placement fee is calculated. For this purpose, we must also inform the recruitment agencies whether you have successfully completed the probationary period or whether you have left us again at your own request, if applicable. You have already been informed of this by the recruitment agency. The legal basis for this processing is Art. 6(1)(f) GDPR, our legitimate interest in fulfilling the placement agreement concluded between the recruitment agency and us.
Recipients of your data
Your application documents are only passed on to those departments that are involved in the application process and require the data in this context. These are the People & Culture department (ENCAVIS GmbH), the responsible specialist department in the respective company to which you are applying, the Legal department (ENCAVIS GmbH) and the Management Board or management of the company to which you are applying.
If you have applied for a position at Encavis Portfolio Management GmbH, we may, depending on the position, be obliged to transmit certain personal data to the Federal Financial Supervisory Authority (BaFin). BaFin receives the personal data in order to assess professional suitability, reliability and time availability in accordance with the statutory requirements. The legal basis for this processing is Art. 6(1)(c) GDPR.
In addition, d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, supports us as a technical service provider for the applicant management system through which you can send us your application. When you click on a job offer to view details or when you click on “unsolicited application”, we redirect you to d.vinci. Further processing takes place there. We also use this system internally when we receive applications via recruitment agencies.
As a decision-making aid for the selection of candidates, we use the “LINC Personality Profiler” platform of LINC GmbH, Grapengießerstr. 16, 21335 Lüneburg.
We use Hetzner Online GmbH, Industriestraße 25, 91710, Gunzenhausen, to operate the data centre and to provide the servers.
Apart from this, we do not, as a matter of principle, pass on any personal data to third parties.
Transfers to a third country
No data are transferred to recipients in countries outside the European Economic Area.
Storage period
If you are hired, we will transfer your data to your personnel file and store them at least for the duration of the employment relationship.
If we do not end up working together, we will delete your data six months after the end of the application process. The legal basis for this storage is our obligation (Art. 6(1)(c) GDPR) to be able to demonstrate that we comply with the provisions of the General Act on Equal Treatment (AGG).
Excluded from deletion are the data of those applicants who have given us their consent to the further storage of their data in the talent pool. For these data, we check annually whether further storage is still required. If this is not the case, the data are deleted. In addition, your data will be deleted from the talent pool without undue delay if you ask us to do so or withdraw your consent to storage.
If you withdraw your application during an ongoing application process, we will delete your data without undue delay. We will only continue to store your notification regarding your termination of the process and will delete it six months after the end of the application process. The legal basis for this storage is our obligation (Art. 6(1)(c) GDPR) to be able to demonstrate that we comply with the provisions of the General Act on Equal Treatment (AGG).
Technical and operational system logs are stored for 60 days. For specific bias and monitoring logs, the storage period is 180 days. AI-generated evaluation results that become part of the application documents are deleted together with the other application data.
Your rights
If you wish to exercise a right to which you are entitled, please contact us as the controller using the contact details provided above or use one of the other ways we offer of sending us this notification.
Right of access
Pursuant to Art. 15 GDPR, you have the right to obtain confirmation from us as to whether personal data concerning you are being processed by us. If this is the case, you have a right of access to these personal data and to the further information listed in Art. 15 GDPR.
Right to rectification/completion
Pursuant to Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed – including by means of a supplementary statement.
Right to erasure
You have the right to request that personal data concerning you be erased by us without undue delay. We are obliged to erase personal data without undue delay if the relevant conditions of Art. 17 GDPR are met. For details, please refer to Art. 17 GDPR.
Right to restriction of processing
In accordance with Art. 18 GDPR, you have the right, under certain conditions, to request that we restrict the processing of your personal data.
Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means.
Right to withdraw consent
Pursuant to Art. 7 GDPR, you have the right to withdraw any consent you have given at any time and without stating reasons. Please note that a withdrawal only applies to the future and does not affect the lawfulness of processing carried out in the past.
Right to object
If we cite our legitimate interest pursuant to Art. 6(1)(f) GDPR as the legal basis, you have the right to object set out below pursuant to Art. 21 GDPR.
Pursuant to Art. 21 GDPR, you have the right to object to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Right to lodge a complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority, without prejudice to any other administrative or judicial remedy. This right exists in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.
Reservation of the right to make changes
We reserve the right to change the security and data protection measures at any time, in particular where this becomes necessary due to technical developments. In such cases, we will also adapt this privacy notice accordingly, if necessary. Please therefore always take note of the current version of this privacy notice.
