Information on data processing
Dear Sir or Madam,
With this privacy policy, we would like to inform you about the processing of your personal data by Maximilian Munich Apartments & Hotel, and the rights to which you are entitled under data protection law.
Overview:
1. General Information
2. Subscription to our newsletter
3. Website
4. Website for reservations
5. Social media appearances
6. Applicant data
1. General Information
1.1 Who is responsible for the data processing?
The controller in accordance with data protection is:
Maximilian Munich Apartments & Hotel
Helmut Beermann
Hochbrückenstr. 18
80331 München
We have appointed a data protection officer at our company. You can contact him or her via the following address:
ComFor-IT® GmbH & Co. KG
Datenschutz
Bahnhofstraße 6
84405 Dorfen
Tel: 08081-60499-50
E-Mail: datenschutz(at)comfor-it(dot)de
Internet: www.comfor-it.de
1.2 What data relating to you is processed by us? And for what purposes?
We process your personal data insofar as this is necessary for establishing and fulfilling a contract with you. This includes general data about you or persons in your company (name, address, contact details, etc.) as well as, if applicable, further data that you provide to us in the context of the contract. In addition, communication data is processed in case you contact us via telephone or e-mail. The data we process depends on your requested or the agreed upon services.
Registration and passport data:
At the beginning of your hotel stay, we as hoteliers are obliged to request the registration data of our guests. The following information is collected:
Date of arrival and expected departure, surnames, first names, date of birth, nationalities, address, number of fellow travellers and their nationality in the cases of § 29 (2) sentences 2 and 3 BMG as well as serial number of the recognised and valid passport or passport replacement document in the case of foreign persons.
The requirement to collect this information arises from § 27 BMG. The period of retention is one year from the day of arrival of the accommodated person. After expiry of the retention period, the registration forms are destroyed. Upon request, certain authorities have the right to inspect the registration forms within the legally prescribed periods.
If we ask you to make a copy of your passport or passport replacement document in order to include this copy in our records for identification purposes, this will only be done on the basis of your consent. We will keep the copies safe for the duration of your stay and then destroy them.
Customer database:
In addition to the information on the registration forms, we collect other data from you, including contact details such as telephone number and email address, date of birth, your gender and other data that you provide to us.
We store your data in our customer file so that we do not have to collect it again for future stays. This is done because of our legitimate interest in making your stay and future stays as pleasant as possible. No data is stored in our customer file that falls under the special categories of data according to Art. 9 GDPR.
Credit card information:
When booking or checking in, we may ask you to provide your credit card. Your credit card is recorded in order to be able to satisfy outstanding claims in the event of departure without (full) payment. In other cases, a minimum amount will be charged to the credit card in order to carry out a credit check.
Providing your credit card or charging the credit card will be done on the basis of your consent. If you do not give your consent, we may insist on a cash deposit or prepayment.
1.3 Where is the data processed
The processing of your data takes place in Germany or within the European Union or the states of the European Economic Area. Processing in other countries is only permissible if the EU Commission has issued an adequacy decision pursuant to Art. 45 (3) GDPR or an adequate level of data protection is ensured by other suitable guarantees within the meaning of Art. 46 (2) GDPR.
1.4 What is the legal basis for this
The legal basis for the processing of personal data is generally Art. 6 GDPR, unless more specific legal regulations are applicable. In such a case, the following options are present:
When personal data is required for establishing or fulfilling contractual obligation, the processing is based on Art. 6 (1) lit. b GDPR.
In addition to that, data processing can also take place based on Art. 6 (1) lit. f GDPR. In these cases, processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.
Processing may also be necessary for compliance with a legal obligation to which we are subject. The legal basis in this case is Art. 6 (1) lit. c GDPR.
If you give us consent to process personal data for specific purposes, the data processing is based on Art. 6 (1) lit. a GDPR.
1.5 How long will your data be processed and stored
We process your personal data as long as this is necessary for our business relationship or for the fulfilment of contractual obligations. In addition, we are subject to various legal obligations, for example the German Commercial Code and the German Fiscal Code.
Finally, the storage period also depends on the limitation periods according to Division 5 of the German Civil Code.
Due to internal and organizational considerations data in backups may still be available for a longer period of time.
1.6 To which recipients is the data passed on
We only pass on your personal data within our company to those areas and persons who need this data to fulfil contractual and legal obligations or for purposes of our legitimate interest.
Your personal data is also processed on our behalf by service providers based on Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the General Data Protection Regulation.
Under these conditions, recipients of personal data may include:
· Internet providers, hosting and telephone services
· Providers of accounting/billing software
· IT service providers and service providers tasked with facility management
· Service providers and software in the field of web design, marketing, conferences, and events
· Providers of office applications, server/operating systems and cloud storage
· Service providers for the destruction of files
· Providers of monitoring systems
· Providers of hotel software for costumer management
1.7 Your rights as a “data subject”
You have the right pursuant to Art. 15 GDPR to obtain information about your personal data processed by us. According to Art. 16 GDPR you have the right to obtain the rectification of inaccurate personal data without undue delay or the completion of your personal data stored with us. You have the right pursuant to Art. 17 GDPR to obtain the erasure of your personal data stored with us and pursuant to Art. 18 GDPR you have the right to obtain the restriction of the processing of your personal data.
Pursuant to Art. 20 GDPR you have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format or to obtain the transmission to another data controller.
When your data is processed based on Art. 6 (1) lit. f GDPR, you have the right to object to processing pursuant to Art. 21 GDPR.
According to Art. 7 (3) GDPR you have the right to withdraw the consent given to us at any time. This means that in future we may no longer continue to process the data as based on this consent.
You also have the right pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. The address of the data protection supervisory authority which has jurisdiction over us is:
Data Protection Authority of Bavaria:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach
2. Subscription to our Newsletter
If you register for our e-mail newsletter, we will send you regular information about our company and our products. We require your e-mail address and your name as mandatory information for this purpose. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you our newsletter after you have expressly confirmed that you agree to receive it. For this purpose, we will send you a confirmation e-mail in which you are asked to confirm that you would like to receive the newsletter in the future by clicking on an appropriate link.
For our newsletter, we use the service provider Smart Host GmbH, Am Kupfergraben 6A, 10117 Berlin.
With the help of our newsletter service, we can analyse our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked on. In this way, we can determine, among other things, which links were clicked on particularly often and thus better adapt the newsletter to the respective target group.
The use of your personal data is based on your consent in accordance with Art. 6 (1) lit. a GDPR.
Registration is voluntary and you can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending us a message. After unsubscribing, your e-mail address will be removed from our newsletter distribution list and deleted, unless you have expressly consented to further use of your data or we are permitted to process it on the basis of another legal basis.
3. Website
3.1 Data gathering and recording
The following data is transferred to us when you access our website:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- amount of data transferred in each case
- Website from which the request originates
- browser
- Operating system and its interface
- Language and version of the browser software.
The data is stored for reasons connected to technical security in order to prevent attempted attacks against our server. The processing is based on Art. 6 (1) lit. f GDPR.
The personal data collected on our website is stored on the servers of our external hoster. Our hoster processes your data only insofar as this is necessary for the fulfilment of its service obligations and in accordance with our instructions.
3.2 Use of Cookies and Consent Tool
It is possible for us to deposit so-called "cookies" on your computer when you visit our website. Cookies are text files which are received by your Internet browser, and which are stored on your computer.
You can prevent the saving of cookies by setting your browser software accordingly. However, we wish to point out that in such a case, you may not be able to fully use all functions of this website.
There is a difference between so-called session cookies and analysis cookies. Below, you will find an explanation of these types of cookies.
Cookies which are essential for the operation of the website, as otherwise the functionality of the website can be restricted, or parts of the website will not work (necessary session cookies).
Cookies which serve the purpose of analysing user behaviour on the website in order to obtain information concerning number of visitors and to improve the website.
Our website uses Cookiebot's cookie consent technology to obtain your consent to the storage of certain cookies on your end device and to document this in compliance with data protection regulations. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "Cookiebot").
When you enter our website, data to prove your consent and information about your device and browser are processed and transmitted to Cookiebot. Cookiebot is used to obtain the legally required consent for the use of certain technologies. The legal basis for this is Art. 6 (1) 1 lit. c GDPR.
3.3 Getting in touch
When you get in touch with us via email, telephone or our contact form, the information of the user will be processed in order to respond to the enquiry.
The data processing is based on Art. 6 (1) lit. f GDPR if processing is necessary for the purposes of the legitimate interests pursued by our company. If the processing is necessary for the performance of a contract or for pre-contractual measures, the processing is based on Art. 6 (1) lit. b GDPR. Your data will be deleted after final processing of your request, provided that there are no legal obligations.
When your data is used for direct marketing purposes, you have the right to object to processing pursuant to Art. 21 (2) GDPR.
After revoking consent or objecting to the use of data for marketing purposes, your data may remain stored in a backlist or to prove the previous existence of consent.
3.4 Data transfer to third countries / third party providers
Among other things, services from providers based in the USA are integrated on our website. If these services are active, your personal data may be passed on to the US servers of the respective companies.
As a safe third country, the USA generally has a level of data protection comparable to that of the EU. A data transfer to the USA is therefore permitted if the recipient is certified under the "EU-US Data Privacy Framework" (DPF) or has suitable additional guarantees. The list can be found here: https://www.dataprivacyframework.gov/.
We would like to point out that for data transfer to providers who are not certified according to the EU-US Data Privacy Framework (DPF), the US is to be regarded as an insecure third country under data protection law, in which no level of data protection comparable to that in the EU can be guaranteed. We have signed a contract with these providers that includes the so-called EU standard contractual clauses. Taking into account the need for protection of the data, we consider the level of protection with reference to the EU standard contractual clauses to be adequate.
3.5 DialogShift chat application on our website
Our website uses the chat application of DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purpose of web analysis, operating the chat application and responding to queries.
To operate the chat function, the chat texts are saved and a cookie with a unique ID is set - this is used to recognize you as a customer. With the help of this cookie, our application recognizes the device and can call up past chat logs. This cookie is stored for 90 days since it was last used. You can deactivate the storage of cookies in your browser settings. However, the chat function cannot be executed without the use of cookies. In this context, we also store your IP address in anonymized form. The use of cookies is based on your consent in accordance with Art. 6 (1) lit. a GDPR.
If you enter personal data such as your name, e-mail address or telephone number, we use this data in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in effective customer support for temporary communication with you until the end of the contact. The data is stored as part of the chat logs on the basis of our legitimate interest in effective customer support, for statistical analysis of usage behavior and for the purpose of optimizing our offers and is deleted after 90 days.
3.6 Google Analytics
We use Google Analytics of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irland ("Google") Google Analytics uses so-called “cookies”, text files which are saved on your computer and which enable an analysis of the use of the website by you. This information concerning your use of the website which is generated by the cookie are generally transferred to a Google server in the USA and saved there.
We have added "anonymizeIP" to Google Analytics on our website. This guarantees the masking of your IP address so that all data is collected anonymously. You can find more information about IP anonymization on support.google.com/analytics/answer/2763052
Google uses the information collected to evaluate your use of our website on our behalf, to compile reports on website activity and to provide other services relating to website activity and internet usage.
The use of Google Analytics on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
You can also prevent the collection of data generated by the cookies and related to your use of the website to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
The additional terms and conditions of use for Google Analytics can be viewed at: https://support.google.com/analytics/answer/6004245?hl= en
3.7 Google Maps
We use Google Maps (API) of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irland ("Google") in order to display route maps. Google Maps is a web service which displays interactive maps in order to visually display geographical information.
Should you have agreed to the use of cookies, when accessing sites in which the maps of Google Maps is integrated, information concerning the use of our website (for example the IP address of the user) will be transferred to servers of Google in the USA and saved there.
The use of Google Maps on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
The terms and conditions of use of Google can be viewed at:
http://www.google.de/intl/en/policies/terms/regional.html.
The additional terms and conditions of use for Google Maps can be viewed at: https://www.google.com/intl/en_US/help/terms_maps.html.
Detailed information concerning data protection in connection with the use of Google Maps can be found on the website of Google ("Google Privacy Policy"): http://www.google.de/intl/en/policies/privacy/
3.8 Google Adwords Conversion
We use Google Adwords to draw attention to our attractive offers with the help of advertising material (so-called Google Adwords) on external websites. We can determine how successful the individual advertising measures are in relation to the advertising campaign data. We are interested in showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.
These advertisements are delivered by Google via so-called "ad servers". For this purpose, we use ad server cookies, through which certain parameters for measuring success, such as the display of ads or clicks by users, can be measured. If you access our website via a Google ad, Google Adwords will store a cookie on your PC. These cookies generally lose their validity after 30 days and are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie.
These cookies enable Google to recognize your internet browser. If a user visits certain pages of an Adwords customer's website and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Adwords customer. Cookies can therefore not be tracked via the websites of Adwords customers. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. Based on these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material; in particular, we cannot identify the users on the basis of this information.
Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge: By integrating AdWords Conversion, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out your IP address and store it.
You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly; in particular, suppressing third-party cookies will prevent you from receiving ads from third-party providers; b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com", www.google. de/settings/ads, whereby this setting will be deleted if you delete your cookies; c) by deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign via the link www.aboutads.info/choices, whereby this setting will be deleted if you delete your cookies; d) by permanently deactivating them in your Firefox, Internet Explorer or Google Chrome browsers under the link www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all the functions of this website to their full extent.
The use of Google Adwords on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
Further information on data protection at Google can be found here: www.google.com/intl/en/policies/privacy and services.google.com/sitestats/en.html.
3.9 Google DoubleClick
We also use the Google DoubleClick application from Google. DoubleClick uses cookies to place relevant ads for users or to prevent users from seeing the same ads more than once. Google uses a cookie ID to record which ads are displayed in which browser and thus prevents these ads from being displayed more than once. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests.
By using DoubleClick, your browser automatically establishes a connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of DoubleClick. We therefore inform you according to our state of knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us.
The use of Google DoubleClick on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
Further information on data protection at Google can be found here: www.google.com/intl/en/policies/privacy and services.google.com/sitestats/en.html.
3.10 Google Tag Manager
This website uses Google Tag Manager. This service allows website tags to be managed via an interface. The Google Tag Manager itself does not set any cookies and does not collect any personal data.
3.11 Microsoft Clarity
We use Microsoft Clarity on our website. This is a web analysis service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 USA, hereinafter referred to as "Microsoft".
The Microsoft Clarity service is used to analyze the usage behavior of our website. Usage and user-related information, such as IP address, behavior on the website, location, time or frequency of visits to our website, is transmitted to a Microsoft server in the USA and stored there. Pseudonymized user profiles can be created and evaluated from this data for the same purpose. Cookies are used for collection and analysis.
The use of Microsoft Clarity on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
You can find Microsoft's data protection information in the Microsoft Privacy Statement at https://privacy.microsoft.com/en-gb/privacystatement
3.12 Microsoft Advertising - Bing Ads
On our website, data is collected and stored using Bing Ads technologies, from which usage profiles are created using pseudonyms. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
This service allows us to track user activities on our website when they have arrived via Bing Ads advertisements. The collected information is transmitted to Microsoft servers in the USA and is generally stored there for a maximum of 180 days.
Additionally, Microsoft may, under certain circumstances, track your usage behavior across multiple electronic devices through so-called Cross-Device Tracking, and as a result, is able to display personalized advertisements on or within Microsoft websites and apps. You can deactivate this behavior at http://choice.microsoft.com/de-de/opt-out.
The use of Microsoft Advertising on our website is based on your consent according to Art. 6 (1) lit. a GDPR. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
You can find Microsoft's data protection information in the Microsoft Privacy Statement at https://privacy.microsoft.com/en-gb/privacystatement
4. Website for reservations
If you make an online booking on our website, you will be redirected to the SimpleBooking website after entering your travel details or clicking on the "Check availability" button. The SimpleBooking online reservation system is provided by the company QNT s.r.l. - Simple Booking, via Lucca 52, Florence, Italy, which is our contractual partner.
The processing of your data, which you provide to us in the context of an online booking or inquiry, is carried out for the purposes of contract initiation and contract fulfilment in accordance with Art. 6 para. 1 lit. b GDPR. We delete the data collected in this context after it is no longer required for processing.
The links to the data protection provisions will be displayed to you during the online booking process.
Please note our general information regarding data processing for your reservation and booking.
5. Social Media Appearances
In the following, we would like to inform you about the processing of your personal data when using our profile. Processing takes place when you visit our profile, and when you send us a message.
Please note that social networks generally analyse your user behaviour extensively and use it to create user profiles. These are used, among other things, to show you personalised ads. We therefore ask you to carefully check which data you share with us via the profile. As long as you are logged in to your account, the operator of the social network can associate your visit and your use of our profile to your user account. Your personal data may also be collected under certain circumstances if you are not logged in or do not have a user account with this social network.
We would like to point out that we are not able to track all data processing on LinkedIn. For more information on data processing by the operator of the social network, please refer to this privacy policy.
Data collection and legal basis
The processing of your data when you visit our profile is based on Art. 6 (1) lit. f GDPR. Our legitimate interest is to ensure the broadest possible presence on the internet through our presence on social networks.
The processing of your data by LinkedIn may be based on different legal grounds, including your consent according to Art. 6 (1) lit. a GDPR. Please refer to the data protection guidelines of LinkedIn for the legal bases on which the operator of the social network bases the processing of your data.
Your data is also processed when you contact us via contact form or messenger. We use the data you enter in the respective contact form to answer your enquiry and for the associated technical administration. The legal basis for the processing of the data is our legitimate interest to respond to your request in accordance with Art. 6 (1) lit. f GDPR. If your contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.
Note on data transfer to the US
If the provider of a social network is also based in the US, your personal data may be transferred to the US servers of the respective company and processed there.
As a safe third country, the USA generally has a level of data protection comparable to that of the EU. A data transfer to the USA is therefore permitted if the recipient is certified under the "EU-US Data Privacy Framework" (DPF) or has suitable additional guarantees. The list can be found here: https://www.dataprivacyframework.gov/.
Notes on deletion and storage duration
The data that we collect directly from you via our profile will be deleted from our system as soon as the purpose for storing it no longer applies, you request us to delete your data, or you revoke any given consent.
We have no influence on how long the operator of the social network will store your data uand use it for its own purposes. You can find information about this in the data protection guidelines of the social network.
Social networks in detail:
We have a profile on Facebook. The provider of the Facebook service is Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, your data will be transferred to Meta Platforms Inc. in the US. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
We have entered into the Controller Addendum, a joint processing agreement, provided by Facebook. You can view this agreement at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum.
We use the "Facebook Insights" functions to obtain statistical data about the use of and visitors to our profile. The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest is to optimise our profile on Facebook. You can find more information about data processing by Facebook Ltd. in the context of "Facebook Insights" here
https://www.facebook.com/legal/terms/information_about_page_insights_data.
You can adjust your advertising settings independently in your user account. To do so, click on the following link and log in:
https://www.facebook.com/settings?tab=ads
Here, you can find Facebook's privacy policy:
https://www.facebook.com/about/privacy/
We have a profile on Instagram. Instagram is provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. According to the provider, your data will be transferred to Meta Platforms Inc. in the US. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF).
You can adjust your settings in your user account. To do so, click on the following link and log in:
https://www.instagram.com/accounts/login/?next=/accounts/privacy_and_security/
You can view Instagram's privacy policy here:
https://help.instagram.com/519522125107875
Youtube
We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. According to the provider, your data will be transferred to Google LLC in the US. The basis for the third country transfer is the EU-US Data Privacy Framework (DPF). For details on how they handle your personal data, please refer to YouTube's privacy policy:
https://policies.google.com/privacy?hl=en
6. Applicant data
We process the data you have sent us in connection with your application to assess your suitability for a position (or other open positions in our company, if applicable) and to carry out the application process.
The legal basis for processing your data is Art. 6 (1) lit. b GDPR for initiating a contractual relationship. According to this, the data processing is allowed if this is necessary to establish an employment contract.
Insofar as special categories of personal data are processed in accordance with Art. 9 (1) GDPR, this serves the exercise of rights or the fulfilment of legal obligations under labor law as part of the application process. This is done on the basis of Art. 9 (2) lit. b GDPR and § 26 (3) BDSG. In addition, the processing of special categories of personal data may be based on consent pursuant to Art. 9 (2) lit. a GDPR and § 26 (3) sentence 2, (2) BDSG.
Furthermore, data can be processed based on our legitimate interest according to Art. 6 (1) lit. f GDPR to defend our company against legal claims.
If you give us express consent to process personal data for specific purposes, the processing is based on Art. 6 (1) lit. a GDPR.
We process your personal data as long as this is necessary for the establishment of the employment contract or for a legal requirement. Data of applicants will be deleted after six months in the event of rejection. If you have agreed to further storage of your personal data, we will transfer your data to our applicant pool. There, the data will be deleted if it is no longer relevant for open positions in our company. In the event that you have consented to further storage of your personal data, we will transfer your data to our applicant pool. The data will be deleted there if it is no longer relevant for filling further positions.