V2 (022024)
Normfest GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by Normfest GmbH.
With regard to interaction within the company account of Normfest GmbH, Normfest GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with Normfest GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of Normfest GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to Normfest GmbH only.
The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/
If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.
The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.
Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
Contents
YOUR PERSONAL DATA IN THE APPLICATION PROCEDURE
Information on data protection
We are pleased that you want to apply to us. Transparency and a trustful handling of your personal data is an important basis for a good cooperation. We therefore inform you about how we process your data and how you can exercise your rights to which you are entitled according to the Basic Data Protection Regulation (DSGVO). The following information will give you an overview of the collection and processing of your personal data in connection with the application procedure. Please read this data protection declaration carefully before you apply for a job with us.
1. General
1. a) Who is responsible for data processing?The person responsible within the meaning of Art. 4 No. 7 DSGVO is:
Normfest GmbH
Siemensstr. 23
42551 Velbert
1. b) How can you contact the data protection officer?
For questions regarding data protection, you can reach us by e-mail at datenschutz@normfest.de.
According to Art. 4 No. 1 DSGVO, personal data is all information which relates to an identified or identifiable natural person.
In order to carry out the application procedure, the following data or data categories are processed:
Your personal data will be processed for the purpose of personnel selection to fill vacancies, i.e. to initiate an employment contract. The necessity and the extent of the data collection are assessed, among other things, according to the position to be filled. If your desired position involves the performance of particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements, more extensive data collection may be necessary. The legal basis is § 26 para. 1 Federal Data Protection Act (BDSG).
If you have given us your voluntary consent to the processing of certain personal data, this consent forms the legal basis for the processing of these data.
In the following cases, we will process your personal data on the basis of consent given by you:
In certain cases we process your data to safeguard a legitimate interest of us or of third parties. A legitimate interest exists, for example, if your data is required for the assertion, exercise or defence of legal claims within the scope of the application procedure (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute we have a legitimate interest in processing the data for evidence purposes.
Your data is mainly processed by our personnel department. However, to some extent other internal and external bodies are also involved in the processing of your data.
Internal bodies may be specialist departments or divisions or the works council of our company.
We use Prescreen International GmbH as an external service provider. Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna (hereinafter "Prescreen"), operates the e-recruiting system Prescreen under the domain *.jobbase.io (hereinafter "jobbase.io"), on which companies can place job advertisements as well as receive and manage applications.
Prescreen processes personal data within the scope of these activities solely on behalf of and for the purposes of Normfest GmbH and is therefore a so-called order processor in the sense of Art. 4 No. 8 DSGVO.
Jobbase.io is the central platform for our applicant management. When using our online form, your personal data is recorded directly in jobbase.io. Your data can also be transferred to the e-recruiting system in case of a postal or e-mail application.
(1) We store your personal data as long as it is necessary for the decision on your application. If an employment relationship between you and us does not come about, we may also continue to store data, insofar as this is necessary for the defence against possible legal claims. Your data will be regularly deleted within six months after the end of the application procedure.
(2) If no employment relationship is established, but you have given us your consent for the further storage of your data ("applicant pool"), we will store your data until your consent is revoked, but for a maximum of three further years. If there is a concrete reason, we may also store your data for a longer period of time for the purpose of defence against possible legal claims.
(3) Should you withdraw your application before the end of the application procedure, i.e. delete your data and your account, the stored data will be blocked for the period of the still ongoing application process and will be finally deleted after six months after the end of the application procedure.
(4) If you no longer use your candidate profile and have not given your consent to the longer storage of data in the applicant pool, the data will be deleted within six months after the end of the application procedure.
(5) You yourself can delete your candidate profile and your application documents at any time or submit a request for deletion or have the processing restricted.
7. What rights do you have in connection with the processing of your data?
(1) You can request information as to whether we have stored personal data about you. If you so wish, we will inform you of what data is involved, for what purposes the data is processed, to whom the data is disclosed, how long the data is stored and what other rights you are entitled to in relation to this data.
(2) In addition, you have the right to correct or delete your data. You may also request that we make all personal data you have provided us with available in a structured, common and machine-readable format, either to you or to a person or company of your choice.
(3) You also have the right not to be subject to a decision based solely on automated processing - including profiling - which has legal effect vis-à-vis you.
(4) You also have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 paragraph 1 l.it. e DPA (data processing in the public interest) or Art. 6 paragraph 1 letter f DPA (data processing to safeguard a legitimate interest), including profiling based on this provision. In the event of your objection we will no longer process your personal data unless we can prove compelling reasons for processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
(5) In addition, you have the right of appeal to the competent data protection supervisory authority.
(6) In order to exercise your rights you can contact datenschutz@normfest.de by e-mail. We will process your enquiries immediately as well as in accordance with the legal requirements and inform you about the measures we have taken or will take.
The provision of personal data is not required by law or contract, nor are you obliged to provide the personal data. However, the provision of personal data is necessary for the implementation of the application procedure. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application procedure.
You can interrupt the creation of your online application at any time and continue it at a later date. For this purpose, technically necessary cookies are used on the platform. During the application process a data transfer to jobbase.io takes place. This means that data provided by you for the creation of the user account as well as uploaded documents are recorded in jobbase.io. The data remains recorded even if you interrupt and/or do not complete an application. In this case, your application will be marked as incomplete and the data will remain restrictedly visible to our company.
You can view, edit or update the data that you have entered in the online application at any time in your candidate profile.
Provided that you do not make any further changes in your candidate profile, for example closing an ongoing application, starting a new application or changing the data of an existing application, your data will be deleted within six months after the end of the last active application process.
You yourself can request deletion of your candidate profile and application documents at any time. After the request for deletion has been submitted, you will be informed of the exact date of deletion and your data will be automatically deleted in accordance with the conditions set out in this Privacy Policy.
Normfest GmbH is not responsible for the data processing described below, but Prescreen:
Prescreen International GmbH
Mariahilfer Straße 17
A-1060 Wien
If you have any questions regarding data protection law at Prescreen International GmbH, please contact datenschutz@prescreen.io.
When accessing the jobbase.io domain, your Internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is recorded by Prescreen:
The legal basis for the processing of the data is Art. 6 Para. 1 lit. f DSGVO.
10. b) Cookies
Prescreen uses cookies. These serve to make the online application more user-friendly and effective. The cookies are technically necessary to make this website available to you. Without the use of cookies, the operation of the website would not be possible. There is therefore no possibility to object to the use of the cookies.
The legal basis for the processing of the data is Art. 6 para. 1 lit. f DSGVO.
The following cookies are used by Prescreen:
Provider | Cookie | Purpose | Duration of Storage |
Prescreen | PHPSESSID | This cookie is used to identify the user while using Prescreen. The cookie is essential for correct functionality. | The cookie loses its validity when the browser is closed until the browser window is closed (session cookie). |
Prescreen | REMEMBERME | This cookie is used to restore an expired session. The cookie is absolutely necessary for correct functionality. | The cookie loses its validity after 2 weeks. |
