Mandatory information according to Articles 13 and 14 of the GDPR for applicants to EDAG

This mandatory information for applicants supplements our existing general data privacy statement, in which you are given concrete information explaining how we process your personal data during your visits to our website or with regard to subjects not specifically related to your application. You can find this general data privacy statement here: https://www.edag.com/en/legal/data-privacy

Mandatory information according to Articles 13 and 14 of the GDPR for applicants to EDAG Group

I. Name and Address of the Data Controller

II. Contact data of the data protection officer

The data controller's data protection officer can be contacted through:
Email: datenschutz[at]edag.com

III. General Data Processing Information

1. Extent to which personal data is processed

We process all personal data that you provide to us  as part of your application, including data resulting from the context of your application.

We may also obtain your personal data from other sources, including recruitment agencies, the references you have provided, websites and other publicly available data  on the Internet. This includes, for instance, data you have obviously made public within the scope of an online profile on a business social network. We can also receive data that you transmit to us via third-party websites, for instance from job markets such as StepStone or Monster. This data may include the following: your contact details, your desired salary, the type of employment you are seeking and the date of your availability.

We only gather special categories of personal data (information on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data data concerning health or data concerning a person's sex life or sexual orientation) if this is prescribed by law. If you voluntarily provide us with special categories of personal data, you hereby expressly consent to the processing of this data as described in this mandatory information.

If you apply via our online portal, we can collect access information such as the IP address of your access device. Further information relating to this can be taken from the data privacy statement on our website.

We use the software solution provided by SAP as an applicant tracking system (ATS), which can be accessed via the subdomain careers.edag.com. SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, is a provider of cloud-based application management solutions. SAP operates its application management system software and the IT infrastructure required for this under its own respnsibility. SAP acts as our service provider in relation to the processing operations in the ATS referred to below, i.e. only processes data on our behalf, and only in accordance with the specifications and instructions on the basis of a concluded data processing agreement (Article 28 para. 3 of the GDPR). The processing of personal data under the responsibility of SAP is described in a separate data protection statement, which can be downloaded at www.sap.com/about/legal/privacy.html

As part of your application, the Quick Apply add-on allows you to upload more than two documents in the first application step, i.e. certificates or references in addition to the CV and cover letter. These documents are automatically and immediately transferred to our ATS. Quick Apply identifies the category of the uploaded document and assigns it to the appropriate section in our SAP system.

If you have given your consent, we will process your personal data that you provide in your application, including the data that result from the circumstances of your application, for our Talent Relationship Program for further contact by our recruiters for other job openings within the EDAG Group (EDAG Engineering GmbH, EDAG Production Solutions GmbH, EDAG Aeromotive GmbH and EDAG Akademie GmbH). For the Talent Relationship Program, HubSpot sends out a newsletter every 3 months. For this purpose, we will process your provided email address. The newsletter contains attractive job offers from the EDAG Group (EDAG Engineering GmbH, EDAG Production Solutions GmbH, EDAG Aeromotive GmbH and EDAG Akademie GmbH).

2. Purpose of and legal basis for the processing of personal data

We process your personal data insofar as this is necessary for the decision on the establishment of an employment relationship with us. The legal basis is Art. 6 para. 1 p. 1 b) of the GDPR and Art. 88 of the GDPR in conjunction with § 26 para. 1 of the Federal Data Protection Act with regard to the initiation or execution of contractual relationships.

The legal basis for the processing of your personal data in the context of inclusion in our Talent Relationship Program is your consent according to Article 6 para. 1 p. 1 point a) of the GDPR. By agreeing to our Talent Relationship Program, you consent to being further contacted by our recruiters for other vacancies within the EDAG Group (consisting of EDAG Engineering GmbH, EDAG Production Solutions GmbH, EDAG Aeromotive GmbH and EDAG Akademie GmbH).

As part of your acceptance into our Talent Relationship Program, you consent to a subscription to our newsletter in accordance with Art. 6 (1) p. 1 lit. a) GDPR. The newsletter is distributed via HubSpot, i.e. by joining our Talent Relationship Program, you consent to your data being processed by HubSpot  to receive the newsletter.

HubSpot is a CRM provider based in Cambridge, USA. The USA currently has a level of data protection comparable to the requirements of the GDPR. The level of data protection in the USA is currently comparable to the requirements of the GDPR. Effective enforcement of your rights is possible in the USA through the entry into force of the Data Privacy Framework with membership of the provider HubSpot. By consenting to the newsletter subscription, you also agree to the aforementioned third country transfer to the USA. Further information on data protection can be found here:  www.edag.com/en/legal/data-privacy

You are entitled to withdraw your consent to the Talent Relationship Program and the newsletter vie HubSpot at any time, with future effect. The withdrawal of consent shall not affect the lawfulness of any processing carried out on the basis of your consent before its withdrawal. After withdrawal, the EDAG Group may only continue to process the personal data insofar as EDAG has another legal basis on which to support such processing. If you do not consent to the Talent Relationship Program and the newsletter, this will not entail any negative consequences for you. Your application process will also remain unaffected.

In addition, we may also process personal data about you insofar as this is necessary to comply with legal obligations in accordance with Art. 6 para.1, p. 1, point c) of the GDPR, or to defend against legal claims asserted against us in the application process. The legal basis is Art. 6 para. 1 p. 1 points b) and f) of the GDPR. The legitimate interest here is proof of interest in a judicial procedure. We have balanced our proof of interest and the interest in maintaining confidentiality of the data subject. In this respect, our legitimate interest prevails. There are no indications that the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

In addition, for the purpose of security screening, we may check your master data (name, address, date of birth, place of birth) against the terrorist lists in the appendices to the current versions of Regulation (EC) No. 2580/2001 of December 27, 2001, Regulation (EC) No. 881/2002 of May 27, 2002, Regulation (EU) No. 753/2011 of August 1, 2011 and/or Regulation (EU) No. 1686/2016 of September 20, 2016, to protect ourselves from criminal liability and to ensure that funds and economic resources are not made available to persons listed therein. The legal basis for this is Art. 6 para. 1 p. 1 point f) of the GDPR in conjunction with the relevant regulation. In this respect, our legitimate interest prevails. There are no indications that the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, are overriding.

According to Art. 88 of the GDPR in conjunction with § 26 of the BDSG, as soon as an employment relationship is established between you and ourselves, any personal data already received from you may be used for the purpose of the employment relationship, insofar as it is necessary for the performance or termination of the employment contract, or for exercising rights and discharging obligations arising from a law or a wage agreement, or a company or works agreement (collective agreement) of the body representing the employees' interests.

3. Data erasure and storage period

We store your personal data for as long as this is necessary for the decision on your application. We store application documents for a maximum of 6 months after completion of the application process, after which they are destroyed or deleted. Insofar as our processing is based on a legitimate interest or consent, we store your personal data for as long as this is necessary for the respective purpose, or for as long as we are entitled or obliged to process the data.

The Quick Apply add-on itself has no data storage and transfers your document directly to our applicant tracking system in SAP.

If you consent to being included in our Talent Relationship Management we will store your application documents for an initial period of 6 months from the start of the application process, in order to have them available for future job offers. We will contact you in good time before the end of the storage period. You can then consent to your data being stored in the Talent Relationship Management for a further period of 6 months. You can withdraw your consent for the Talent Relationship Management at any time. Consent to the aforementioned newsletter via HubSpot can also be revoked here. By withdrawing your consent, the subscription will be terminated and your data will be deleted from HubSpot.

If, following the application process, an employment, training or internship relationship is established, your data will initially continue to be stored to the extent necessary and permissible, and then transferred to the personnel file.

4. Data recipients

Unless you have given us your consent to use your data for other positions in our company and in the affiliated group, we will, in the current application procedure, use your personal data only for the processing involved in the advertised position (Talent Relationship Management). Within our company, access to your data is granted only to those departments and employees needing it to fulfill the above-mentioned purposes. The employees involved are members of the HR department and of the department in which there are vacancies to be filled. Insofar as this is required by law, we will also make your application documents available to works councils and other bodies representing the interests of our company's employees, to enable them to perform their statutory duties (cf. § 99 para. 1 of the Works Constitution Act).

Otherwise, and depending on the purpose and legal basis for the processing of your application documents, the following shall apply:

1. Unsolicited applications

By submitting an unsolicited application via our recruitment portal, you provide us with your application documents for the purpose of finding a suitable position. In order to be able to offer you suitable jobs, we will forward your application documents to all Group companies affiliated with us, as defined in §§ 15 et seq. of the German Companies Act, insofar as you have consented to this. Should there be no suitable position available, your data will be deleted immediately.

2. Consent to inclusion in the Talent Relationship Program

If you consent to being included in our Talent Relationship Management, in order to be able to offer you suitable jobs, we may also pass on your application documents to Group companies affiliated with us, as defined in §§ 15 et seq. of the German Companies Act (AktG). By consenting to our Talent Relationship Program, you also consent to our HubSpot Newsletter. In the course of this, we will share your email address with HubSpot. Further information on HubSpot's use of your data can be found here: https://www.edag.com/en/legal/data-privacy

3. Applications submitted by email

Applications may only be submitted via our recruitment portal. It is not possible for applications to be sent to the parties responsible by email.

Moreover, personal data may also be processed on our behalf on the basis of contracts in accordance with Art. 28 of the GDPR, in particular by suppliers of recruiting management and applicant selection process systems (see above).

Personal data is also handed on to the public authorities and/or law enforcement authorities if necessary for the above-mentioned purposes, if prescribed by law and/or if necessary for the protection of our legitimate interests, in compliance with applicable law.

5. Data transmission to third countries

Should we transmit personal data to service providers or Group companies outside of the European Economic Area (EEA), the data is only transmitted insofar as the EU Commission has confirmed that the third country provides an adequate level of data protection, you have consented to the transfer of data to the third country or other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place.

IV. Rights of Data Subject

If personal data concerning you is processed, you are the data subject as defined in the GDPR, and have the following rights against the data controller:

1. Right of access

Within the scope of Art. 15 of the GDPR, you are entitled to request information about your data that is being processed by us at any time.

2. Right to rectification

If your personal data is incorrect or incomplete, you are entitled, within the scope of Art. 16 of the GDPR, to have any incorrect personal data concerning you to be rectified and/or to have incomplete personal data completed.

3. Right to restrict processing

Within the scope of Art. 18 of the GDPR, you may, if the legal conditions are met, request that processing of your personal data be restricted.

4. Right to deletion

Within the scope of Art. 17 of the GDPR, you may at any time request that your personal data be deleted, provided we are not legally obliged or entitled to further process your data.

5. Right to data portability

Within the scope of Art. 20 of the GDPR, you have the right to receive the personal data concerning yourself with which you have provided us in a structured, commonly used and machine-readable format, and to transmit this date to another controller.

6. Right to object

Within the scope of Art. 21 of the GDPR, you have the right to object to the processing of your data for direct marketing or profiling purposes. You may object to processing on the basis of an assessment of interests, stating the reasons arising from your particular situation.

7. Right to withdraw declaration of consent under data protection law

You have the right to withdraw your declaration of consent to the processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before its withdrawal.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy in accordance with Art. 78 of the GDPR.

The authorized supervisory authority is:

Hessian Commissioner for Data Protection and Information Security
Gustav-Stresemann-Ring 1
65189 Wiesbaden

Status: April 2024