Processing of (personal) data by the entity in charge of the online application process
Information letter from onpier GmbH for applicants – How we handle your data and your rights – Information pursuant to Articles 13 and 21 of the GDPR
The following information is intended to give you an overview of how onpier GmbH processes your personal data. We also provide information about your rights under data protection law.
Who is the data controller?
The controller within the meaning of the GDPR is:
onpier GmbH
Uhlandstraße 3
80336 Munich
Email: datenschutz@onpier.de
You can contact our data protection officer at:
Data Protection Officer at onpier GmbH
c/o activeMind AG
Potsdamer Straße 3
80802 Munich
Tel.: +49 (0) 89 919294-900
Email: dsb@onpier.de
We process your data for the following purposes and on the following legal basis:
We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG):
1. Decision on the establishment of an employment relationship (Art. 6 (1) (b) GDPR)
We will process the data you provide exclusively for the purpose of evaluating and selecting suitable candidates and contacting you.
2. Within the framework of balancing interests (Art. 6 (1) (f) GDPR)
Where necessary, we process your data beyond the actual decision on the establishment of an employment relationship in order to protect our legitimate interests or those of third parties. Examples of such cases include:
Measures to protect employees and customers, as well as to protect the company's property and ensure building and facility security (e.g. access controls, locking systems, video surveillance)
Assertion of legal claims and defence in legal disputes: the disclosure of personal data may be necessary in the context of official/judicial measures for the purposes of gathering evidence, criminal prosecution or the enforcement of civil law claims.
3. Due to legal requirements (Art. 6(1)(c) GDPR in conjunction with Section 26 BDSG)
We are subject to various legal obligations that entail data processing. These include, for example, the fulfilment of tax and similar control and reporting obligations.
Furthermore, the disclosure of personal data may be necessary in the context of official/judicial measures for the purposes of gathering evidence or enforcing civil law claims.
Who receives my data?
Within our company
Within the company, those departments that need your data to fulfil contractual, legal and regulatory obligations and to protect legitimate interests (e.g. human resources, management, future supervisor) will have access to it.
In the context of order processing
Service providers and vicarious agents employed by us may also receive data for these purposes, provided that they need the data to perform their respective services. These may be external service providers from the following areas: support or maintenance of EDP or IT applications and personnel management software. All service providers are contractually bound and, in particular, obliged to treat your data confidentially.
We use Personio SE & Co. KG as the operator of the recruitment site as part of the application process. On the recruitment site, additional data such as access and error logs are collected and, if consent has been given, cookies are also set. Further information on this can be found in the privacy policy on the application page.
Other recipients (third parties)
Data will only be passed on to recipients outside our company in compliance with the applicable data protection regulations. Personal data may be passed on to the following third parties, for example: external data protection officer, authorities in the event of an obligation to disclose data.
Is data transferred to a third country or to an international organisation?
Data is transferred to locations in countries outside the European Economic Area (so-called third countries) if
it is required by law (e.g. tax reporting obligations),
required for fulfilment of the contract with you,
- you have given us your consent, or
- this is legitimised by a legitimate interest under data protection law and there are no higher interests of the data subject that are worthy of protection.
Beyond this, we do not transfer any personal data to entities in third countries or international organisations. For certain tasks, we use service providers who may use sub-service providers that may have their registered office, parent company or data centers in a third country. A transfer is permitted if the European Commission has decided that an adequate level of protection exists in a third country (Art. 45 GDPR). If the Commission has not made such a decision, the companies or the service provider may only transfer personal data to service providers in a third country if appropriate safeguards are provided (standard contractual clauses adopted by the EU Commission or the supervisory authority in a specific procedure) and enforceable rights and effective remedies are available.
We have contractually agreed with our service providers that data protection guarantees must always be in place. This also applies to their contractual partners as well. We will provide you with a copy of these guarantees upon request.
How long will your data be stored?
If your application is rejected, your data will be deleted no later than six months after the decision has been announced. If an employment relationship is established, the application documents will be stored for at least the duration of your employment at onpier GmbH.
What data protection rights do I have?
Every data subject has the right to access under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR and the right to data portability under Article 20 of the GDPR. With regard to the right to information and the right to erasure, the restrictions pursuant to Sections 34 and 35 BDSG apply.
You may withdraw your consent to the processing of personal data at any time. Please note that the withdrawal is only effective for the future. Processing that took place before the withdrawal is not affected.
In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG). A list of supervisory authorities (for the non-public sector) with address can be found at:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
Is there an obligation to provide data?
The provision of the aforementioned personal data is neither legally nor contractually required. However, it is not possible to process the application without this information.
To what extent is there automated decision-making or profiling?
We do not use fully automated decision-making in accordance with Article 22 of the GDPR for the establishment, implementation and termination of the employment relationship. If we use these procedures in individual cases, we will inform you separately about this and your rights in this regard, provided that this is required by law. We also do not process your data with the aim of automatically evaluating certain personal aspects.
Information about your right to object in individual cases pursuant to Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
The objection can be made informally with the subject line "Objection" via one of the above-mentioned contact channels.