Information on the processing of personal data

Data protection instruction Applicant (m/f/d)

We undertake to comply with the statutory regulations for data protection and do our best to avoid the collection of data and to minimize the data volume at all times.

1. Name and address of the Controller and the Data Security Officer

a) The Controller

The Controller in the sense of the General Data Protection Regulation and other national privacy acts of the Member States of the European Union and of other privacy laws is:

HMI Project GmbH
Frankfurter Str. 92
97082 Würzburg

Email: datenschutz@hmi-project.com
Phone: 0931 / 45 32 97 70

www.hmi-project.com

b) The Data Security Officer

The address of the Controller’s Data Security Officer is:
SiDIT GmbH
Langgasse 20
97261 Güntersleben

info@sidit.de

2. Collection and storage of personal data in applications and on the basis of applicant profiles on applicant portals, as well as the type and purpose of such data and their use

2.1. Collection and storage

When

• you contact us for the first time
• you submit an application to us,
• we contact you for the first time on the basis of your applicant profile on applicant portals such as Experteer and/or Indeed, or
• we contact you for the first time based on your profile on professional social media platforms such as LinkedIn and/or XING,
  then we usually process the following information:
• Salutation, first name, last name,
• address,
• a valid e-mail address,
• telephone number (landline and/or mobile),
• any other data you provide in your application documents (in particular CV, certificates)
• all other data that you have submitted in the applicant profile on applicant portals
• all other data you provide in the application process (in applicant questionnaires, interviews, etc.)
• special categories of personal data voluntarily provided by you.

2.2 What do we process your data for (purpose of processing) and on what legal basis?

In the following, we inform you about the purposes for which we process your data and the legal basis for doing so.

2.2.1. for the performance of contractual obligations and pre-contractual measures (Art. 6 para. 1 letter b DSGVO)

We process your data for the performance of contractual obligations and pre-contractual measures with you, i.e. in particular.

• for the internal processing of your application
• to carry out the application procedure
• for correspondence with you
• for the implementation or termination of an employment relationship
• to exercise or fulfil rights and obligations arising from the law or from a collective agreement, a works agreement or a service agreement
• for the settlement of any existing liability claims and the assertion of any claims against you.

2.2.2 Based on your consent (Art. 6 para. 1 letter a DSGVO)

In principle, we will delete your data no later than 6 months after the end of the application process, unless there are further reasons for retention, see point 5. If you have given us consent to process your personal data as part of an "applicant pool", we will delete this consent no later than three years after it was given. The purpose of the "applicant pool" is to be able to consider you for a future vacancy.

You can revoke your consent at any time with effect for the future. We inform you that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

2.2.3. On the basis of legitimate interests (Art. 6 para. 1 lit. f DSGVO)

Furthermore, we may process your personal data insofar as this is necessary to defend legal claims against us arising from the application process on the basis of legitimate interest (e.g. claims arising from the AGG), Art. 6 para. 1 letter f DSGVO.

2.2.4. due to legal requirements (Art. 6 para. 1 letter c DSGVO).

We are subject to various legal obligations, such as statutory commercial storage and documentation obligations (from HGB, StGB or AO).

2.2.5 Processing of special categories of personal data (Art. 9 (2) DSGVO)

We process the special categories of personal data you have provided if you have given us consent pursuant to Art. 9 (2) a) DSGVO or if the processing is necessary to enable us to exercise your rights under labour law and social security and social protection law and to comply with our obligations in this respect.

You can withdraw consents at any time with effect for the future. We inform you that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

3. Disclosure of data to third parties and processors

The transfer of personal data is also processing within the meaning of the previous section 3.2. However, at this point we would like to inform you again separately about the issue of transferring data to third parties. The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to passing on your data to third parties.

As a rule, your personal data is transferred to third parties for the following purposes:

• Order processors with whom we have concluded an agreement in accordance with Art. 28 DSGVO.
• Accounting (e.g. tax advisor)
• Litigation (e.g. lawyer)
• Communication platform (e.g. email, WhatsApp, other messenger services).

4. Deletion

Your personal data will be deleted by us if it is no longer necessary for the purposes for which it was collected or otherwise processed, the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.

5. Data subject rights

You have the right:

• in accordance with Art. 7 (3) DSGVO, to revoke your consent once given to us at any time. This means that we will no longer process the data based on this consent in the future.

• request information about your personal data processed by us in accordance with Art. 15 DSGVO. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details;

• pursuant to Art. 16 DSGVO, to request the correction of incorrect or incomplete personal data stored by us without undue delay;

• in accordance with Article 17 of the GDPR, request the erasure of your personal data stored by us if it is no longer necessary for the purposes for which it was collected or otherwise processed, or if the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

• in accordance with Art. 18 DSGVO, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is
  unlawful, but you object to its erasure and we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing pursuant to Art. 21 DSGVO;

• pursuant to Art. 20 DSGVO, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller; and

• complain to a supervisory authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace for this purpose.

6. Right of objection

Insofar as your personal data are processed on the basis of legitimate interests pursuant to Article 6 (1) sentence 1 lit. f DSGVO, you have the right to object to the processing of your personal data pursuant to Article 21 DSGVO, insofar as there are grounds for doing so arise from your particular situation. If you wish to exercise your right of objection, an email to datenschutz@hmi-project.com is sufficient.

As of: 10.01.2022