Data Protection Notice for Applicants
Last updated: 31.01.2024
We are pleased that you are interested in working for Utimaco and that you are applying or have applied for a position in our company. In the following, we would like to provide you with information on the processing of your personal data in connection with your application. This data protection notice applies in addition to our general data protection notice athttps://utimaco.com/privacy
1. Who is responsible for data processing?
The controller within the meaning of data protection law is
Utimaco Management Services GmbH
Germanusstrasse 4
52080 Aachen
Germany
Phone: +49 241 1696-200
Fax: +49 241 1696-199
E-mail: info@utimaco.com
The contact information of our data protection officer can be found under section 9.
You can find further information about our company, details of the persons authorised to represent us and also other contact options in our imprint on our website: https://utimaco.com/legal.
2. Which of you data do we process and for what purposes?
We process the data that you have sent us in connection with your application in order to check your suitability for the position (or other open positions in our companies, if applicable) and to carry out the application process.
If you have also provided us with special categories of personal data, i.e. particularly sensitive data, as part of your application (e.g. religious affiliation, health data, degree of disability), these will be processed by us on the basis of your consent. In this case, the processing will only take place in order to be able to consider your application in the application process. The data of special categories of data will not be taken into account by us in the selection decision, unless the consideration results from a legal obligation. We therefore ask you to refrain from communicating these categories of data to us as a matter of principle.
For the purposes of internal processing and management of job advertisements and applications, we have implemented the applicant management tool of d.Vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, Germany. The following personal data are affected by this processing:
- Name
- Address data
- Curriculum vitae including the information contained therein (and, if applicable, profile pictures)
- Profiles of applicants (including data from aptitude tests, if applicable).
In the context of data processing via the above-mentioned provider, no transfer of data to third countries takes place. Furthermore, the provider has implemented technical and organizational measures to protect your personal data.
You have the option of using the "Use LinkedIn profile" button to have certain data from your LinkedIn profile transferred directly to the application form by entering your LinkedIn login data. If you choose this function as part of the application process, you will be redirected to the LinkedIn network website after clicking. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. This data will be automatically entered into the application form after entering the login data and giving your consent to the transfer. The data is transmitted once. There is no permanent connection to LinkedIn. However, you can delete this data in the respective text box. Only when you send the application form for the purpose of your application will we receive the data you have selected and provided. By using LinkedIn, the following data may be provided by you and subsequently collected by us:
- Name
- Profile
- Slogan
- E-mail address
- Current Positions
- City/Country
- Link to your LinkedIn profile
When using the services of LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), data is processed by LinkedIn itself. This includes login data, information about the type of device, page visits and IP addresses. In addition, LinkedIn uses cookies, i.e. small text files that are stored on your computer and which, for example, allow recognition when you visit the site again.
The data is stored by LinkedIn, but not transmitted to us. Nevertheless, we would like to point out that the data stored by LinkedIn and any consent given by you also refers to the transfer of at least part of your personal data to the U.S. as a third country in accordance with Art. 49 (1) (a) GDPR. On 10 July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework. It thus certifies that the United States of America (USA) has an adequate level of protection for personal data transferred from the European Union (EU) to US companies as data importers within this framework. If the US company is certified for the EU-U.S. Data Privacy Framework, the adequacy decision then takes immediate effect. This is the case for LinkedIn Corporation.
If the data transfers are not covered by the EU-U.S. Data Privacy Framework and are not based on another of the transfer instruments provided for in Art. 44 et seq. GDPR, your data will be transferred on the basis of the consent you have given.
For more information on data protection on LinkedIn, see https://www.linkedin.com/legal/privacy-policy.
3. On what legal basis do we process the data?
The legal basis for the processing of your personal data in this application process is primarily § 26 BDSG in conjunction with Art. 6 (1) (b) GDPR. Accordingly, the processing of data necessary in connection with the decision to establish an employment relationship is permitted.
In individual cases, we process your data in order to safeguard the legitimate interests of the controller or third parties (e.g. German subsidiaries of Utimaco Management Services GmbH). Such a legitimate interest exists in particular if the processing of your data is carried out for administrative purposes for an intra-group data exchange (legal basis Art. 6 para. 1 lit. f) GDPR).
Your consent also constitutes permission for data processing. If you have therefore given us your consent, e.g. to store the application documents in our applicant pool for a longer period of time or to pass on the application documents to other business units, we will also process your data for this purpose in accordance with Art. 88 (1) GDPR in conjunction with § 26 (2) BDSG. If we obtain your consent, we will of course inform you about the specific purpose of the data processing and about your right of withdrawal.
Insofar as special categories of personal data are processed in accordance with Art. 9 (1) GDPR, this serves the purpose of exercising rights or fulfilling legal obligations under labor law and social law as part of the application process. This is done on the basis of Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG.
In addition, the processing of special categories of personal data may be based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a), Art. 88 (1), (2) GDPR in conjunction with Section 26 (3) sentence 2, (2) BDSG.
If, after completion of the application process, the data may be required for legal prosecution, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular for the protection of legitimate interests pursuant to Art. 6 (1) (f) GDPR. Our interest then lies in the assertion or defense of claims.
If there is an employment relationship between you and us, we may continue to process the personal data already received from you for the purposes of the employment relationship in accordance with Section 26 (1) of the Federal Data Protection Act (BDSG). This is done if this is necessary for the performance or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of representing the interests of employees arising from a law or a works or service agreement (collective agreement).
4. How long will the data be stored?
In the event of a rejection, applicants' data will be deleted after 6 months.
In the event that you have consented to the further storage of your personal data, we will add your data to our applicant pool. There, the data will be deleted after two years.
Applicants who have taken part in an interview at our company can apply for reimbursement of travel expenses. In this case, for reasons of processing any travel expense reimbursements, we will store the necessary data until the expiry of the statutory limitation period. In principle, this is three years and begins at the end of the year in which the entitlement arose.
If you have been awarded a job as part of the application process, the data from the applicant data system will be transferred to our personnel information system.
5. To which recipients will the data be disclosed?
We use a specialized software provider for the application process. This service provider acts may also gain knowledge of your personal data in connection with the maintenance and care of the systems. We have concluded a so-called data processing agreement with this provider, which ensures that data processing is carried out in a permissible manner and that measures are taken to ensure the protection of your personal data.
Your applicant data will be reviewed by the HR department upon receipt of your application. Suitable applications are then forwarded internally to the department managers for the respective open position. Thereafter, the further process is coordinated with the person responsible for the department and the applicant, e.g. arranging a telephone or personal meeting, etc.
If you have consented to this, your data will be used to fill positions throughout the entire group of companies (Utimaco Management Services GmbH, Utimaco GmbH, Utimaco IS GmbH, Utimaco TS GmbH, Utimaco IS Pte. Ltd., Utimaco TS Srl., Utimaco TS UK Ltd., Utimaco Inc., MYHSM Ltd., Utimaco Iberia S.L., Utimaco S.A. de C.V., Utimaco Technologies Ltd., Utimaco Technologies Private Ltd., Celltick Technologies Singapore PTE Ltd., Utimaco Japan GK). Your data will be made available to the responsible decision-makers of the respective Group companies for the further implementation of the application process.
In addition, your data will be transmitted to other group companies within the group if they perform data processing tasks for the companies affiliated in the group (e.g. IT services, legal department, recruiting, etc.). These companies are subject to the aforementioned provisions to the same extent.
In the entire group of companies, only those persons who need it for the proper running of our application process have access to your data.
6. Where is the data processed?
The data is processed by us in data centers in the Federal Republic of Germany, but may also be transmitted to affiliated companies outside the European Economic Area, e.g. to the USA, UK or Singapore.
7. Your rights as a "data subject"
You have the right to information about the personal data we process about you. In the case of a request for information that is not made in writing, we ask for your understanding that we may then require you to provide evidence proving that you are the person you claim to be.
Furthermore, you have the right to rectification or erasure or to restriction of processing, insofar as you are legally entitled to this.
If the processing of your data by us takes place on the basis of Art. 6 (1) (e) or (f) GDPR, for example if the data processing does not serve to establish the employment relationship, but to safeguard legitimate interests on our part, you can object to this processing at any time for reasons arising from your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
The same applies to the right to data portability.
To assert your rights, you can contact us at any time at the address given in section 9.
8. Withdrawal of consent
In the event that we process your personal data on the basis of your consent, you can withdraw your consent at any time for the future without giving reasons. To revoke your consent, please use the contact details under section 9.
9. Our Data Protection Officer
We have appointed a data protection officer. You can reach him at the following contact options:
Utimaco Management Services GmbH
– Data Protection Officer –
Germanusstraße 4
52080 Aachen
E-Mail: dataprotection@utimaco.com
10. Right to lodge a complaint
You have the right to complain about our processing of personal data to a supervisory authority of your choice for data protection. The data protection authority responsible for us is the
Landesbeauftragte für den Datenschutz und Informationsfreiheit
in Nordrhein-Westfalen (LDI NRW) (State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia)
Kavalleriestr. 2-4
40213 Düsseldorf
Tel.: 0211-38424-0
