Datenschutzhinweis

Informationen zur Datenverarbeitung

V2 (022024)

Für die Bearbeitung von Bewerbungen nutzt Normfest GmbH den Dienst onlyfy application manager (by XING). Mit dieser Datenschutzerklärung werden Sie über die Verarbeitung Ihrer Daten durch den Dienst onlyfy application manager sowie durch Normfest GmbH informiert.

Gemeinsame Verantwortlichkeit

Hinsichtlich des Zusammenwirkens im Unternehmens-Account von Normfest GmbH besteht eine sogenannte gemeinsame Verantwortlichkeit von Normfest GmbH und New Work SE gemäß Art. 26 DSGVO, da sie i.S.d. Art. 4 Nr. 7 DSGVO gemeinsam über Zwecke und Mittel der Verarbeitung bestimmen. Die aktuelle Version der Vereinbarung zur gemeinsamen Verantwortlichkeit nach Art. 26 DSGVO, die die New Work SE mit den Unternehmen schließt, die onlyfy application manager nutzen, können Sie hier als Anhang zu den AGB https://www.xing.com/terms/onlyfy-one einsehen, um sich über das Wesentliche der Vereinbarung zu informieren.

Datenverarbeitung durch die New Work SE

onlyfy application manager ist Teil des umfassenden Dienstes XING der New Work SE, der den Zweck verfolgt, durch eine Vielfalt unterschiedlicher Anwendungen (onlyfy application manager ebenso wie das berufliche soziale Netzwerk bzw. Job-Netzwerk XING, kununu etc.) zur Verbesserung und Vereinfachung des Berufslebens der Nutzer beizutragen sowie die Arbeitswelt für den Einzelnen erfüllender und gleichzeitig Unternehmen noch erfolgreicher zu machen. Bei onlyfy application manager als Teil des umfassenden Dienstes XING handelt es sich um eine Online-Plattform, auf der bzw. über die Talente und Unternehmen zusammenkommen.

Hinsichtlich der Datenverarbeitung für die die New Work SE allein verantwortlich oder im Rahmen der gemeinsamen Verantwortlichkeit mit Normfest GmbH zuständig ist, erhalten Sie nähere Informationen in der Datenschutzerklärung von XING, https://privacy.xing.com/de/datenschutzerklaerung. Dort finden Sie auch die Kontaktdaten der New Work SE sowie des betrieblichen Datenschutzbeauftragten der New Work SE.

Bewerbungen mit onlyfy application manager

Mit Absenden der Bewerbung gehen Sie ein Nutzungsverhältnis mit der New Work SE ein, um Ihre Bewerbung(en) abwickeln zu können. Sie erhalten des Weiteren Support-Leistungen und die New Work SE kann Ihnen weitere Möglichkeiten aufzeigen, die Sie in Ihrem Berufsweg unterstützen können. Es wird nicht automatisch ein öffentliches Profil im beruflichen sozialen Netzwerk bzw. Job-Netzwerk XING für Sie erstellt. Die Rechtsgrundlage für die Verarbeitung Ihrer Daten durch die New Work SE ist folglich insbesondere Art. 6 Abs. 1 lit. b DSGVO (Verarbeitung in Erfüllung eines Vertrages).

Unterbrechung Ihrer Online-Bewerbung

Das Erstellen Ihrer Online-Bewerbung können Sie jederzeit unterbrechen und zu einem späteren Zeitpunkt fortsetzen. Zu diesem Zweck werden Cookies eingesetzt. Von Ihnen bereitgestellten Daten zum Anlegen des Benutzerkontos sowie hochgeladene Dokumente werden im Unternehmens-Account von Normfest GmbH in onlyfy application manager erfasst. Die Daten bleiben auch dann erfasst, wenn Sie eine Bewerbung unterbrechen und/oder nicht abschließen. In diesem Fall wird Ihre Bewerbung als unvollständig markiert und die Daten bleiben für Normfest GmbH eingeschränkt einsehbar.

Hinweise zu speziellen Funktionen von onlyfy application manager

Kalenderfunktion

Wenn die Kalenderfunktion verwendet wird, werden Ihre Daten im Rahmen und zum Zweck der Terminvereinbarung im Bewerbungsverfahren verarbeitet. Rechtsgrundlage ist Art. 6 Abs.1 lit. f DSGVO. Die Kalenderfunktion wird von einem IT-Dienstleister (Cronofy Ltd., Vereinigtes Königreich) zur Verfügung gestellt. Das Vereinigte Königreich ist auf Grund des Angemessenheitsbeschlusses der europäischen Kommission als sicheres Drittland eingestuft. Hier finden Sie nähere Informationen zum Datenschutz von Cronofy: https://www.cronofy.com/gdpr/ und https://docs.cronofy.com/policies/privacy-notice/.

WhatsApp Bewerbung

Soweit Sie die Bewerbung-per-WhatsApp Funktion nutzen, ist Rechtsgrundlage für die Kommunikation Ihre jederzeit widerrufliche Einwilligung (Art. 6 Abs. 1 a DSGVO). Bei einer Bewerbung via WhatsApp werden über einen WhatsApp-Chat alle notwendigen Bewerberinformationen abgefragt. Die Daten werden dann über einen Dienstleister direkt in onlyfy application manager eingespielt und dort im Rahmen und zum Zweck des normalen Bewerbungsprozesses weiterverarbeitet.

Die Bewerbung-per-WhatsApp Funktion wird von einem IT-Dienstleister (PitchYou) zur Verfügung gestellt, der hierzu Zugriff auf Ihre Daten nehmen kann. Weitere Informationen finden Sie hier: https://www.pitchyou.de/datenschutz. Kandidatendaten aus „Bewerbung per WhatsApp" werden über eine Schnittstelle in onlyfy application manager übertragen und unmittelbar nach der Übertragung aus der „Bewerbung per WhatsApp" Infrastruktur in PitchYou gelöscht. Die weitere Verarbeitung erfolgt dann ausschließlich direkt in onlyfy application manager.

Bitte beachten Sie, dass Sie zur Bewerbung Ihren eigenen privaten WhatsApp Account verwenden und daher eine Übermittlung, insbesondere in die USA, nicht ausgeschlossen werden kann.Die Datenschutzinformationen von WhatsApp, etwa zu deren Verarbeitungen oder zur Ausübung Ihrer Datenschutzrechte gegenüber WhatsApp, finden Sie hier: https://www.whatsapp.com/legal/privacy-policy-eea.

Nach Ihrer Einwilligung wird Ihre Bewerbung via WhatsApp durch PitchYou an onlyfy application manager übermittelt. Ein Widerruf der Übermittlung ist jederzeit möglich. Ihre Bewerberdaten werden jedoch nach der Übertragung an onlyfy application manager in der Infrastruktur von PitchYou ohnehin gelöscht, so dass eine weitere Verarbeitung durch PitchYou nicht stattfindet.

Anwendbarkeit des Schweizer Datenschutzgesetzes

Das Schweizer Bundesgesetz über den Datenschutz (Schweizer DSG) gilt für Sachverhalte, die sich in der Schweiz auswirken, auch wenn sie im Ausland veranlasst werden. Diese Datenschutzerklärung dient entsprechend sowohl der Information gemäß EU-DSGVO also auch gemäß Schweizer DSG. Es werden die Begriffe der EU-DSGVO verwendet, also insbesondere „Verarbeitung“, „personenbezogene Daten“, „berechtigtes Interesse" sowie "besondere Kategorien von Daten" statt der im Schweizer DSG verwendeten Begriffe „Bearbeitung“, „Personendaten“, "überwiegendes Interesse" und "besonders schützenswerte Personendaten". Wenn das Schweizer DSG anwendbar ist, bestimmen sich die entsprechenden Begriffe nach dem Schweizer DSG. Den Namen und die Adresse unserer Vertretung in der Schweiz finden Sie im Impressum | XING.

DATA PROTECTION DECLARATION

Contents

1. General 2
2. What is personal data? 2
3. Which data is used? 2
4. For which purposes do we process your data and on which legal basis? 3
5. To whom is your data passed on? 4
6. How long is your data stored? 5
7. What rights do you have in connection with the processing of your data? 6
8. Is there an obligation to provide your personal data? 6
9. What happens if you interrupt your online application? 7
10. Supplement to the data protection declaration by Prescreen 7

 

YOUR PERSONAL DATA IN THE APPLICATION PROCEDURE

Information on data protection

We are pleased that you want to apply to us. Transparency and a trustful handling of your personal data is an important basis for a good cooperation. We therefore inform you about how we process your data and how you can exercise your rights to which you are entitled according to the Basic Data Protection Regulation (DSGVO). The following information will give you an overview of the collection and processing of your personal data in connection with the application procedure. Please read this data protection declaration carefully before you apply for a job with us.

1. General

1. a) Who is responsible for data processing?

The person responsible within the meaning of Art. 4 No. 7 DSGVO is:

 

Normfest GmbH

Siemensstr. 23

42551 Velbert

 

1. b) How can you contact the data protection officer?

For questions regarding data protection, you can reach us by e-mail at datenschutz@normfest.de.

2. What is personal data?

According to Art. 4 No. 1 DSGVO, personal data is all information which relates to an identified or identifiable natural person.

3. Which data is used?

In order to carry out the application procedure, the following data or data categories are processed:

• applicant master data (first name, surname, form of address, e-mail address, telephone number, address, date of birth, nationality)
• qualification data (cover letter, letter of motivation, curriculum vitae, previous activities, professional qualification and competences)
• voluntary information, such ase.g. a photograph of yourself, details of being severely disabled or other information that you voluntarily provide or voluntarily upload in your application
• additional questions depending on the respective job advertisement (e.g.additional data/ data categories, e.g. publicly accessible, job-related data, e.g. a profile on professional social media networks such as XING or LinkedIn
• special categories of personal data: If you provide information in your application documents that contains special categories of personal data within the meaning of Art. 9 para. 1 DSGVO (German Data Protection Act) (e.g. information which allows conclusions to be drawn about your sexual orientation; information about your health; information which allows conclusions to be drawn about your ethnic origin or religion), we will also process these data only within the legally permissible framework.
  
  

4. For what purposes do we process your data and on what legal basis?
4. a) Data processing for purposes of the employment relationship - § 26 BDSG in conjunction with Art. 6 Paragraph 1 lit. b DSGVO

Your personal data will be processed for the purpose of personnel selection to fill vacancies, i.e. to initiate an employment contract. The necessity and the extent of the data collection are assessed, among other things, according to the position to be filled. If your desired position involves the performance of particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements, more extensive data collection may be necessary. The legal basis is § 26 para. 1 Federal Data Protection Act (BDSG).

4. b) Consent - Art. 6 para. 1 lit. a and Art. 9 para. 2 lit. a DSGVO, § 26 para. 2 BDSG

If you have given us your voluntary consent to the processing of certain personal data, this consent forms the legal basis for the processing of these data.

In the following cases, we will process your personal data on the basis of consent given by you:

• Inclusion in the applicant pool, i.e. we store the application documents beyond the current application procedure for consideration in subsequent application procedures.
• To be supplemented by the company: if necessary, further processing(s) based on consent (e.g. forwarding of the documents to other Group companies/group-wide applicant pool, sending feedback questionnaires). The data you have already entered in the application process will be processed for this purpose.
• If we base data processing on your consent, you have the right to revoke your consent at any time with effect for the future. You should send the revocation if possible by e-mail to datenschutz@normfest.de. The legality of the processing of your data up to the time of the revocation remains unaffected
  

4. c) Data processing based on a legitimate interest - Art. 6 para. 1 lit. f DSGVO

In certain cases we process your data to safeguard a legitimate interest of us or of third parties. A legitimate interest exists, for example, if your data is required for the assertion, exercise or defence of legal claims within the scope of the application procedure (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute we have a legitimate interest in processing the data for evidence purposes.

5. To whom is your data passed on?

Your data is mainly processed by our personnel department. However, to some extent other internal and external bodies are also involved in the processing of your data.

Internal bodies may be specialist departments or divisions or the works council of our company.

We use Prescreen International GmbH as an external service provider. Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna (hereinafter "Prescreen"), operates the e-recruiting system Prescreen under the domain *.jobbase.io (hereinafter "jobbase.io"), on which companies can place job advertisements as well as receive and manage applications.

Prescreen processes personal data within the scope of these activities solely on behalf of and for the purposes of Normfest GmbH and is therefore a so-called order processor in the sense of Art. 4 No. 8 DSGVO.

Jobbase.io is the central platform for our applicant management. When using our online form, your personal data is recorded directly in jobbase.io. Your data can also be transferred to the e-recruiting system in case of a postal or e-mail application. 

6. How long will your data be stored?

(1) We store your personal data as long as it is necessary for the decision on your application. If an employment relationship between you and us does not come about, we may also continue to store data, insofar as this is necessary for the defence against possible legal claims. Your data will be regularly deleted within six months after the end of the application procedure.

(2) If no employment relationship is established, but you have given us your consent for the further storage of your data ("applicant pool"), we will store your data until your consent is revoked, but for a maximum of three further years. If there is a concrete reason, we may also store your data for a longer period of time for the purpose of defence against possible legal claims.

(3) Should you withdraw your application before the end of the application procedure, i.e. delete your data and your account, the stored data will be blocked for the period of the still ongoing application process and will be finally deleted after six months after the end of the application procedure.

(4) If you no longer use your candidate profile and have not given your consent to the longer storage of data in the applicant pool, the data will be deleted within six months after the end of the application procedure.

(5) You yourself can delete your candidate profile and your application documents at any time or submit a request for deletion or have the processing restricted.

 

7. What rights do you have in connection with the processing of your data?

(1) You can request information as to whether we have stored personal data about you. If you so wish, we will inform you of what data is involved, for what purposes the data is processed, to whom the data is disclosed, how long the data is stored and what other rights you are entitled to in relation to this data.

(2) In addition, you have the right to correct or delete your data. You may also request that we make all personal data you have provided us with available in a structured, common and machine-readable format, either to you or to a person or company of your choice.

(3) You also have the right not to be subject to a decision based solely on automated processing - including profiling - which has legal effect vis-à-vis you.

(4) You also have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 paragraph 1 l.it. e DPA (data processing in the public interest) or Art. 6 paragraph 1 letter f DPA (data processing to safeguard a legitimate interest), including profiling based on this provision. In the event of your objection we will no longer process your personal data unless we can prove compelling reasons for processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

(5) In addition, you have the right of appeal to the competent data protection supervisory authority.

(6) In order to exercise your rights you can contact datenschutz@normfest.de by e-mail. We will process your enquiries immediately as well as in accordance with the legal requirements and inform you about the measures we have taken or will take.

8. Is there an obligation to provide your personal data?

The provision of personal data is not required by law or contract, nor are you obliged to provide the personal data. However, the provision of personal data is necessary for the implementation of the application procedure. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application procedure.

9. What happens if you interrupt your online application?

You can interrupt the creation of your online application at any time and continue it at a later date. For this purpose, technically necessary cookies are used on the platform. During the application process a data transfer to jobbase.io takes place. This means that data provided by you for the creation of the user account as well as uploaded documents are recorded in jobbase.io. The data remains recorded even if you interrupt and/or do not complete an application.  In this case, your application will be marked as incomplete and the data will remain restrictedly visible to our company.

You can view, edit or update the data that you have entered in the online application at any time in your candidate profile.

Provided that you do not make any further changes in your candidate profile, for example closing an ongoing application, starting a new application or changing the data of an existing application, your data will be deleted within six months after the end of the last active application process.

You yourself can request deletion of your candidate profile and application documents at any time.  After the request for deletion has been submitted, you will be informed of the exact date of deletion and your data will be automatically deleted in accordance with the conditions set out in this Privacy Policy.

10. Supplement to the data protection declaration on the part of Prescreen

Normfest GmbH is not responsible for the data processing described below, but Prescreen:

 

Prescreen International GmbH

Mariahilfer Straße 17

A-1060 Wien

 

If you have any questions regarding data protection law at Prescreen International GmbH, please contact datenschutz@prescreen.io.

10. a) Automatically collected usage data

When accessing the jobbase.io domain, your Internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is recorded by Prescreen:

• date and time as well as duration of the access,
• browser type/ -version,
• operating system used,
• URL of the previously visited website,
• volume of data transferred,
• a GeoIP lookup is made based on the IP address (internet protocol address),
• name of the accessed files,
• http-status code (e.g., browser type, version, etc.)
  

This data is technically necessary to offer the functions of the e-recruiting system and to ensure its stability and security. They are stored by Prescreen for a period of 12 months. Data whose further storage is required for evidential purposes are excluded from deletion until the respective incident has been finally clarified.

The legal basis for the processing of the data is Art. 6 Para. 1 lit. f DSGVO.


10. b) Cookies

Prescreen uses cookies. These serve to make the online application more user-friendly and effective. The cookies are technically necessary to make this website available to you. Without the use of cookies, the operation of the website would not be possible. There is therefore no possibility to object to the use of the cookies.

The legal basis for the processing of the data is Art. 6 para. 1 lit. f DSGVO.

The following cookies are used by Prescreen:

Provider	Cookie	Purpose	Duration of Storage
Prescreen	PHPSESSID	This cookie is used to identify the user while using Prescreen. The cookie is essential for correct functionality.	The cookie loses its validity when the browser is closed until the browser window is closed (session cookie).
Prescreen	REMEMBERME	This cookie is used to restore an expired session. The cookie is absolutely necessary for correct functionality.	The cookie loses its validity after 2 weeks.