Data protection information to fulfill the information requirements in accordance with Art. 13 and 14DS-GVO for the application process
With this information, elevait GmbH & Co. KG informs about the collection and processing of personal data. elevait GmbH & Co. KG (hereinafter also: “we”/“us”) is the person responsible for the persons affected by our data processing (hereinafter also: “you” or “user”). The information is provided on the basis of the provisions in Articles 13 and 14 of the GDPR.
1. Responsible
elevait GmbH & Co. KG
Hauptstraße 60
78098 Triberg i
info@elevait.de
Phone: +49 (0) 7722/91 79 057
a) Contact details of the data protection officer
You can contact our data protection officer at: TÜV SÜD Akademie GmbH
Westendstraße 160
80339 Munich
Frank.Hillmer@partner.tuvsud.com
Phone: +49 341 308246780
Hauptstraße 60
78098 Triberg i
info@elevait.de
Phone: +49 (0) 7722/91 79 057
a) Contact details of the data protection officer
You can contact our data protection officer at: TÜV SÜD Akademie GmbH
Westendstraße 160
80339 Munich
Frank.Hillmer@partner.tuvsud.com
Phone: +49 341 308246780
2. Contact details of the data protection officer
You can contact our data protection officer at: TÜV SÜD Akademie GmbH
Westendstraße 160
80339 Munich
Frank.Hillmer@partner.tuvsud.com
Phone: +49 341 308246780
Westendstraße 160
80339 Munich
Frank.Hillmer@partner.tuvsud.com
Phone: +49 341 308246780
3. Purposes for which personal data are to be processed and legal bases for processing
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and any other data protection regulations.
3.1. Data processing to decide on the establishment of an employment relationship
a) When we receive an application, we process the following personal data:
● Title, first name, last name,
● a valid e-mail address, possibly other electronic communication data,
● address,
● Telephone number (optional)
● Curriculum vitae (including date of birth),
● Testimonials, certificates,
● further applicant data and information, including, if applicable, data in accordance with Art. 9 GDPR)
Personal data is processed in order to:
● to be able to carry out an application process,
● to be able to offer the employee an employment contract, if applicable,
● to process any liability claims that may exist and the assertion of any claims against the employee.
1. Data processing is carried out at the request of the data subject and is necessary in accordance with Article 88 GDPR in conjunction with Section 26 (1) of the BDSG for the stated purposes for the appropriate processing of the application.
● Title, first name, last name,
● a valid e-mail address, possibly other electronic communication data,
● address,
● Telephone number (optional)
● Curriculum vitae (including date of birth),
● Testimonials, certificates,
● further applicant data and information, including, if applicable, data in accordance with Art. 9 GDPR)
Personal data is processed in order to:
● to be able to carry out an application process,
● to be able to offer the employee an employment contract, if applicable,
● to process any liability claims that may exist and the assertion of any claims against the employee.
1. Data processing is carried out at the request of the data subject and is necessary in accordance with Article 88 GDPR in conjunction with Section 26 (1) of the BDSG for the stated purposes for the appropriate processing of the application.
3.2. Data processing based on consent
It may happen that we may only process personal data based on the consent of the person concerned. One such case is when we want to include the application in our application tool. We request consent from the person concerned to be included in the pool of applicants and to be contacted again within the agreed period of time. The legal basis for this processing is Article 6 (1) (a) GDPR.
3.3. Data processing based on balancing of interests
a) If the application is processed via our online application form of the HR system and you access it via our website, we process the following personal data:
Site:
● the user's IP address,
● The date and time the website was accessed,
● the protocol, such as https,
● the “Get” or “Post” request method,
● Content relating to the request or specification of the retrieved file that was sent to the user
● the website from which the user accessed it,
● the browser used by the user, the operating system, the interface, <the language of the browser and the version of the browser software.
Online application form
● Title, first name, last name,
● a valid e-mail address, possibly other electronic communication data,
● address,
● Telephone number (optional)
● Curriculum vitae (including date of birth),
● Testimonials, certificates,
● further applicant data and information, including, where applicable, data in accordance with Art. 9 GDPR
b) Personal data is processed to:
● Ensuring a smooth connection to the website,
● Ensuring convenient use of our website,
● Evaluation of system security and stability as well as for other administrative purposes
The legal basis for this processing is Article 6 (1) (f) GDPR.
In the event that personal data is processed on the basis of our balancing of interests, Section 7 contains particularly emphasized information about your right to object.
Site:
● the user's IP address,
● The date and time the website was accessed,
● the protocol, such as https,
● the “Get” or “Post” request method,
● Content relating to the request or specification of the retrieved file that was sent to the user
● the website from which the user accessed it,
● the browser used by the user, the operating system, the interface, <the language of the browser and the version of the browser software.
Online application form
● Title, first name, last name,
● a valid e-mail address, possibly other electronic communication data,
● address,
● Telephone number (optional)
● Curriculum vitae (including date of birth),
● Testimonials, certificates,
● further applicant data and information, including, where applicable, data in accordance with Art. 9 GDPR
b) Personal data is processed to:
● Ensuring a smooth connection to the website,
● Ensuring convenient use of our website,
● Evaluation of system security and stability as well as for other administrative purposes
The legal basis for this processing is Article 6 (1) (f) GDPR.
In the event that personal data is processed on the basis of our balancing of interests, Section 7 contains particularly emphasized information about your right to object.
4. Recipients or categories of recipients of personal data
4.1. The data subject's personal data will be passed on or transferred to third parties if this is necessary to prepare and process the application process, to process other business activities or to fulfill legal obligations, in particular tax or social security obligations.
4.2. The data subject's personal data will be passed on or transferred outside of the cases set out in section 4.1 if:
● There is a legal obligation to transfer data in accordance with Article 6 (1) (c) GDPR, or
● Disclosure in accordance with Article 6 (1) (f) GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that the data subject has an overriding legitimate interest in not disclosing their data.
Recipient categories of personal data may include: social and employment services, data destruction service providers, waste management service providers, tax consulting and legal consulting service providers, IT service providers.
4.3. Within our company, those persons have access to the data subject's data who need it to fulfill our pre-contractual and legal obligations.
4.4. Data recipients include in particular our IT service providers and data/document shredders as contract processors, insofar as they must receive personal data or could become aware of their work as part of their service and maintenance activities for our company IT. Contract processors may only process personal data that they become aware of as a result of our data collection and process under our responsibility only on the basis of our instructions. Appropriate commitments and confidentiality agreements and order processing contracts secure their activities.
4.5. We do not carry out web hosting for personal data received through the use of our websites at the Internet address https://www.elevait.de ourselves. For this purpose, we use a contract processor, see 4.6 a).
4.6. Third country transfer
a) We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP addresses.
Webflow is a tool for building and hosting websites. Webflow stores cookies or other recognition technologies that are necessary to display the page, to provide certain website functions and to ensure security (necessary cookies) .For details, see Webflow's privacy policy: EU & Swiss Privacy Policy | Webflow 22.
Webflow is used on the basis of Art. 6 para. 1 lit. f DSGVO. We have a legitimate interest in presenting our website as reliably as possible. If a corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO and §25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be withdrawn at any time.
Data transmission to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: EU & Swiss Privacy Policy | Webflow 22.
Order processing
We have concluded an order processing contract (AVV) with the above-mentioned provider. This is a contract required by data protection law, which ensures that it only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.”
Storage period
4.7. The personal data of the person concerned will be stored upon receipt of the application. If we are unable to offer you employment, we will keep the submitted data for up to 180 days after the job has been filled in order to answer questions in connection with the application and rejection, provided that there are no legal or regulatory storage obligations to the contrary.
4.8. In the event that the data subject has consented to be included in the applicant pool, the personal data will be stored for the agreed period after a decision has been made on the job advertisement. This allows us to contact the person concerned in case of future job offers.
If we offer you an employment contract/employment relationship, we store the personal data in accordance with applicable tax and commercial storage and documentation obligations. These provide for a storage obligation of six and ten years for the commercial documents referred to in Sections 238 and 257 of the Commercial Code. Corresponding provisions are also contained in the Tax Code and the Social Code for the storage of the documents mentioned herein.
4.9. The expiry of the appropriate retention periods under commercial, social or tax law does not automatically result in an obligation to delete, as there may continue to be a legitimate interest in archiving in individual cases, in order to be able to provide information in the event of legal disputes, for example. This also applies to cases of receipt of evidence under statute of limitations. According to Sections 195 et seq. of the Civil Code (BGB), these limitation periods may amount to up to 30 years, with the regular limitation period being three years.
4.10. We have a deletion concept with which we have determined standard deletion periods based on the processed data category in the respective procedure, which take into account how long we must keep personal data because it is needed and what period of time is still justifiable after that until the personal data must be irrevocably deleted by us.
4.2. The data subject's personal data will be passed on or transferred outside of the cases set out in section 4.1 if:
● There is a legal obligation to transfer data in accordance with Article 6 (1) (c) GDPR, or
● Disclosure in accordance with Article 6 (1) (f) GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that the data subject has an overriding legitimate interest in not disclosing their data.
Recipient categories of personal data may include: social and employment services, data destruction service providers, waste management service providers, tax consulting and legal consulting service providers, IT service providers.
4.3. Within our company, those persons have access to the data subject's data who need it to fulfill our pre-contractual and legal obligations.
4.4. Data recipients include in particular our IT service providers and data/document shredders as contract processors, insofar as they must receive personal data or could become aware of their work as part of their service and maintenance activities for our company IT. Contract processors may only process personal data that they become aware of as a result of our data collection and process under our responsibility only on the basis of our instructions. Appropriate commitments and confidentiality agreements and order processing contracts secure their activities.
4.5. We do not carry out web hosting for personal data received through the use of our websites at the Internet address https://www.elevait.de ourselves. For this purpose, we use a contract processor, see 4.6 a).
4.6. Third country transfer
a) We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP addresses.
Webflow is a tool for building and hosting websites. Webflow stores cookies or other recognition technologies that are necessary to display the page, to provide certain website functions and to ensure security (necessary cookies) .For details, see Webflow's privacy policy: EU & Swiss Privacy Policy | Webflow 22.
Webflow is used on the basis of Art. 6 para. 1 lit. f DSGVO. We have a legitimate interest in presenting our website as reliably as possible. If a corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO and §25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be withdrawn at any time.
Data transmission to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: EU & Swiss Privacy Policy | Webflow 22.
Order processing
We have concluded an order processing contract (AVV) with the above-mentioned provider. This is a contract required by data protection law, which ensures that it only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.”
Storage period
4.7. The personal data of the person concerned will be stored upon receipt of the application. If we are unable to offer you employment, we will keep the submitted data for up to 180 days after the job has been filled in order to answer questions in connection with the application and rejection, provided that there are no legal or regulatory storage obligations to the contrary.
4.8. In the event that the data subject has consented to be included in the applicant pool, the personal data will be stored for the agreed period after a decision has been made on the job advertisement. This allows us to contact the person concerned in case of future job offers.
If we offer you an employment contract/employment relationship, we store the personal data in accordance with applicable tax and commercial storage and documentation obligations. These provide for a storage obligation of six and ten years for the commercial documents referred to in Sections 238 and 257 of the Commercial Code. Corresponding provisions are also contained in the Tax Code and the Social Code for the storage of the documents mentioned herein.
4.9. The expiry of the appropriate retention periods under commercial, social or tax law does not automatically result in an obligation to delete, as there may continue to be a legitimate interest in archiving in individual cases, in order to be able to provide information in the event of legal disputes, for example. This also applies to cases of receipt of evidence under statute of limitations. According to Sections 195 et seq. of the Civil Code (BGB), these limitation periods may amount to up to 30 years, with the regular limitation period being three years.
4.10. We have a deletion concept with which we have determined standard deletion periods based on the processed data category in the respective procedure, which take into account how long we must keep personal data because it is needed and what period of time is still justifiable after that until the personal data must be irrevocably deleted by us.
5. Rights of data subjects
If personal data is collected from you by us, you generally have the following rights as a data subject:
5.1. Right to information
1. You can request information about your personal data that we process in accordance with Article 15 of the GDPR.
5.2. Right to rectification
2. If the information concerning you is no longer correct, you can request a correction in accordance with Article 16 of the GDPR. If your data is incomplete, you can request that it be completed.
5.3. Right to delete
3. You can request the deletion of your personal data under the conditions of Article 17DS-GVO.
5.4. Right to restrict processing
4. In cases under Article 18 GDPR, you have the right to request that the processing of your personal data be restricted (“blocking”).
5.5. Right to complain
5. If you believe that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority of your choice in accordance with Article 77 (1) of the GDPR.
5.6. Right to object
6. You have the right to object for the specific reasons of Article 21 (1) of the GDPR. We will inform you about this under section 7.
5.7. Right to data portability
7. In the event that you have provided us with personal data in accordance with Article 20 (1) GDPR, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to yourself or to third parties in a structured, common and machine-readable format.
5.8. Automated decision making and profiling
8. We do not use any automated decision-making process, including profiling, in accordance with Art. 4 para. 4 and Art. 22 GDPR.
5.1. Right to information
1. You can request information about your personal data that we process in accordance with Article 15 of the GDPR.
5.2. Right to rectification
2. If the information concerning you is no longer correct, you can request a correction in accordance with Article 16 of the GDPR. If your data is incomplete, you can request that it be completed.
5.3. Right to delete
3. You can request the deletion of your personal data under the conditions of Article 17DS-GVO.
5.4. Right to restrict processing
4. In cases under Article 18 GDPR, you have the right to request that the processing of your personal data be restricted (“blocking”).
5.5. Right to complain
5. If you believe that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority of your choice in accordance with Article 77 (1) of the GDPR.
5.6. Right to object
6. You have the right to object for the specific reasons of Article 21 (1) of the GDPR. We will inform you about this under section 7.
5.7. Right to data portability
7. In the event that you have provided us with personal data in accordance with Article 20 (1) GDPR, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to yourself or to third parties in a structured, common and machine-readable format.
5.8. Automated decision making and profiling
8. We do not use any automated decision-making process, including profiling, in accordance with Art. 4 para. 4 and Art. 22 GDPR.
6. Particularly noteworthy information
Art. 21 GDPR obliges us to draw particular attention to a particular right of the data subject. The particular emphasis concerns the following passages, which are italicized and underlined.
1. Individual right of objection to the balance of interests
a) Data subjects have the right to object to the processing of their personal data for reasons arising from their particular situation. The prerequisite for this is that data processing is carried out on the basis of our balancing of interests in accordance with Art. 6 para. 1 lit. f GDPR.
b) The 1.1 cases have been described in general terms in this data protection information.
c) In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate reasons for processing this data which outweigh the interests, rights and freedoms of the data subject. This is also the case if the personal data is used to assert, exercise or defend legal claims.
1. Individual right of objection to the balance of interests
a) Data subjects have the right to object to the processing of their personal data for reasons arising from their particular situation. The prerequisite for this is that data processing is carried out on the basis of our balancing of interests in accordance with Art. 6 para. 1 lit. f GDPR.
b) The 1.1 cases have been described in general terms in this data protection information.
c) In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate reasons for processing this data which outweigh the interests, rights and freedoms of the data subject. This is also the case if the personal data is used to assert, exercise or defend legal claims.
7. Withdrawal of consent
If the processing of personal data by us is based on the consent of the data subject, the data subject has the right to withdraw their consent at any time by making a statement to us. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent up to the withdrawal. We will inform the data subject before giving consent.
8. Delivery obligation
The provision of data is not required by law or contract, but is necessary to process your application. The provision of data is voluntary. If the data is not provided, it will not be possible to process your application.
9. Data security
9.1. If you contact us using an email address provided on our website, the transport of the content of the email to us is not end-to-end encrypted. This means that although the emails are usually encrypted during transport via the participating email providers, they are available unencrypted on the servers there.
9.2. According to data protection supervisory authorities, sending letters by post ensures adequate protection of confidentiality.
9.2. According to data protection supervisory authorities, sending letters by post ensures adequate protection of confidentiality.
10. Amendment to this data protection information
This data protection information does not require the consent of the person concerned and is subject to regular review with regard to the need for changes. In the event of replacement by a new version, the previous version will be archived by us.
Version1/12.04.2022
Version1/12.04.2022
