A.    Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is

Elatec GmbH

Zeppelinstr. 1

82178 Puchheim, Germany

Phone: +49 89 552 9961 0

Fax: +49 89 552 9961 129

E-mail: info-rfid@elatec.com

(hereinafter referred to as Elatec).

The person appointed as Data Protection Officer at the controller can be reached at:

datenschutz@hjp.de

Phone: +49 6841 9816 0

Fax: +49 6841 9816 29

Please do not hesitate to contact our Data Protection Officer if you have questions relating to processing of your personal data and exercising of your rights in accordance with the General Data Protection Regulation (GDPR).

B.    Purposes of and legal basis for processing of your application data

We process personal data concerning you for the purpose of your job application, where that is necessary for making a decision on establishing an employment relationship between you and us. The relevant legal basis for that is Section 26 (1) in conjunction with (8) sentence 2 of the German Federal Data Protection Act (BDSG), if Elatec processes personal data concerning you for the purpose of your job application, where that is necessary for making a decision on establishing an employment relationship between you and us. In addition, Elatec may process personal data concerning you where that is required for the defense of legal claims against us from the job application process. The legal basis for that is Article 6 (1) point (f) GDPR. Elatec’s legitimate interests here are to enable the process steps related to the purpose and, for example, the requirement to furnish proof in the event of possible legal action under the German General Act on Equal Treatment (AGG).

If an employment relationship is established between you and Elatec, Elatec is authorized under Section 26 (1) BDSG to continue processing the personal data obtained from you for purposes of the employment relationship, if that is required for performing or terminating the employment relationship or for the exercise of rights or discharge of duties by employee representative bodies under the law or a collective bargaining, company or works agreement (collective agreement).

C.    Categories of processed personal data

Elatec processes personal data concerning you which is connected with your application. That can be general data on your person (such as your name, address and contact data), details of your professional qualifications and education, details of your vocational further training, or other details you send Elatec in connection with your application. Apart from that, Elatec may, in individual cases, process job-related information you have made publicly available, such as a profile on professional social networking sites.

Please do not send Elatec any information not connected to the application. In particular, we ask you not to send information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning your health or data concerning your sex life or sexual orientation.

D.   Sources of the processed data

The data is usually collected directly from you. That is done by your sending your application documents to Elatec. In individual cases, job-related information you have made publicly available may also be processed, such as data that can be obtained from a profile on professional social networking sites. That is the case in particular if, as part of the application process, you disclose a profile on a social media platform or contact us using such a profile or communications channel for the purpose of applying for a job.

E.    Categories of recipient

Elatec can transfer your personal data to its affiliated companies within the meaning of Article. 4 No. 19 GDPR, provided that is permissible subject to the above purposes and legal grounds. In addition, personal data is processed on our behalf on the basis of contracts in accordance with Article 28 GDPR, in particular by hosting providers or providers of applicant management systems.

Within the Elatec organization, your data is passed on to the HR department and the departments tasked with making a decision. The latter case involves in particular decision-makers at the department where the post you have applied for is located.

F.     Erasure of your data

Elatec stores your personal data for as long as that is required to take a decision on your application. If an employment relationship is not established between you and Elatec, Elatec can also continue to store the data where necessary for defending against possible legal claims. The application documents are destroyed or erased six months after the decision to reject an applicant is announced, unless they have to be stored for longer due to legal disputes.

That shall not apply only if you have consented to being included in Elatec’s applicant pool. The applications in the applicant pool can be used for considering applicants for later vacancies that match their profile. However, personal data in the applicant pool is erased no later than after three years. After that time, you must provide Elatec with your information again so that you are considered in further application processes.

G.   Transfer of data to a third country

Transfer of data to a third country is not envisaged.

H.   What rights do you have?

You as an applicant have – in an individual case and depending on the situation – the data protection rights below. If you wish to exercise them, you can get in touch with Elatec or the Data Protection Officer at any time under the above contact data:

Information on and access to data: You have the right to obtain information on the person data concerning you which has been processed at Elatec and access to your personal data and/or copies of that data. That includes information on the purpose of its use, the category of data used, its recipients and persons authorized to access it and, if possible, the planned length of time for which the data will be stored or, if that is not possible, the criteria used to determine that length of time.

Rectification, erasure or restriction of processing: You have the right to obtain from Elatec without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to object: If processing of personal data concerning you is based on Article 6 (1) point (f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of that data. We will no longer process that personal data unless Elatec demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw consent at any time, without this affecting the lawfulness of processing based on consent before its withdrawal. To do that, you can get in touch with our Data Protection Officer at any time under the above contact data.

Right to erasure: You have the right to obtain from Elatec the erasure of personal data concerning you without undue delay and Elatec has the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

• you object to the processing and there are no overriding legitimate grounds for the processing;

• the personal data concerning you has to be erased for compliance with a legal obligation in Union or Member State law to which we are subject. This shall not apply if processing is required for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject.

Right to restriction of processing: You have the right to obtain from Elatec restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by you, for a period enabling us

• to verify the accuracy of the personal data;

• the processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead;

• Elatec no longer needs the personal data for the purposes of processing, but it is required by you for the establishment, exercise or defense of legal claims, or you have objected to processing pending verification whether our legitimate grounds override yours.

• Where processing of personal data concerning you has been restricted, the data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

If you have obtained restriction of processing, you shall be informed by us before the restriction of processing is lifted.

Right to lodge complaints: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the General Data Protection Regulation (GDPR). You can also contact Elatec’s Data Protection Officer, who can be reached at:

datenschutz@hjp.de

Phone: +49 6841 9816 0

Fax: +49 6841 9816 29

I.       Requirement to provide personal data

The provision of personal data is not prescribed by law or contractually, nor are you obliged to provide personal data. However, you must provide personal data in order to conclude a contract of employment with us. That means: If you do not provide us with personal data in your application, we will not conclude an employment relationship with you.

J.      No automated decision-making

No automated decision-making is carried out in an individual case within the meaning of Article 22 GDPR, i.e. a decision on your application is not based solely on automated processing.