Information on data privacy in accordance with Articles 13,14, and 21 of the General Data Protection Regulation (GDPR)
Privacy policy for applications toHeidelberger Druckmaschinen AG
We are pleased that you would like to apply to us. This is to inform you as a data subject
about the processing of your personal data by Heidelberger Druckmaschinen AG (in thefollowing: “Heidelberg”) based on your application. Heidelberg would also like to informyou about your rights and entitlements with regard to data privacy. By providing thisinformation, Heidelberg is fulfilling its obligations in this respect under Articles 13, 14 and
21 GDPR.

1. Who is the controller –i.e. the party responsible for processing the personal data?
The controller is:
Heidelberger Druckmaschinen AGKurfürstenanlage 52-60
69115 Heidelberg
Tel.: +49 (0)6221 92-00
Fax: +49 (0)6221 92-69 99
E-mail: information@heidelberg.com

2. Who can I contact if I have questions about data privacy?
Heidelberg’s data protection officer can be contacted at:
Heidelberger Druckmaschinen AG
Data Protection Officer
Gutenbergring
69168 Wiesloch
datenschutzbeauftragter@heidelberg.com

3. Which sources and data categories are processed by Heidelberg?
We process data related to your application. This may be general data about you (such as
your name, address and contact details), information about your professional qualifications
and schooling, information about professional training, or other information provided to us___________________
Privacy policy for applicants
As of: November 1, 2020

Page 1/4

by you in connection with your application. We may also process job-related informationthat you have made publicly available, such as a profile on professional social media
networks.
If we do not collect the data directly from you and you have an active profile on online job
platforms such as Stepstone, or if you disclose an inactive or only partially active profile tous during the application process, we may also collect personal data via these platforms.

4. For what purposes and on what legal bases do we process personal data?
We process personal data about you for the purpose of your application for a possible
employment relationship, where this is necessary for the decision on the establishment ofan employment relationship with us. The legal basis for this is Section 26 para. 1 inconjunction with the second sentence of Section 26 para. 8 of the German Federal Data
Protection Act (BDSG).
We may also process personal data about you if this is necessary for our defense against
legal claims asserted against us in the application process. The legal basis for this is Art. 6para. 1, lit. f GDPR; the legitimate interest is, for example, a burden of proof in proceedings
under the German General Equal Treatment Act (AGG).
If your application results in an employment relationship between you and us, we may,pursuant to Section 26 para. 1 BDSG, further process the personal data already received
from you for the purposes of the employment relationship if this is necessary to implement
or terminate the employment relationship or to exercise or fulfill the rights and obligationsof employee representation arising from a law or a collective bargaining agreement, works
or service agreement (collective agreement).
If your application does not result in an employment relationship between you and us andprovided you have given your consent, we may, pursuant to Art. 6 para. 1 lit a GDPR, store
the personal data already received from you in our pool of applicants in order to be able totransmit an offer to you in the event of any future vacancies for which you might besuitable.

5. With whom will Heidelberg share your personal data?
Internally:
The recipients of the personal data contained in the application documents are theresponsible personnel managers, the direct supervisors in the relevant departments andour company's personnel representatives.

___________________
Privacy policy for applicants
As of: November 1, 2020

Page 2/4Externally:
We may transfer your personal data to companies affiliated with us to the extent that thisis permissible within the framework of the purposes and legal bases set out in section 4 orif you have given us your consent in accordance with Art. 6 para. 1 lit. a GDPR. Apart from
this, personal data is processed on our behalf on the basis of contracts pursuant to Art. 28
DSGVO, in particular by host providers or providers of applicant management systems.
We currently work with the following providers: rexx systems GmbH, Süderstrasse 77,
20097 Hamburg; INFO GmbH, Kloster Arnsburg, 35423 Lich.
Both Heidelberg and the providers use technical and organizational security measures inorder to appropriately protect the data we collect from you. Our security measures arecontinuously improved in line with technological developments.

6. How long will Heidelberg store your personal data?
We will store your personal data for as long as is necessary to decide on your application.
If an employment relationship is not established between you and us, we may also
continue to store data to the extent that this is necessary for our defense against possible
legal claims. The application documents will be deleted four months after notification of
the rejection decision, unless it is necessary to store them for a longer period due to legal
disputes.

7. Is your data transferred to a third country or international organization?
No data transfer to third countries (countries outside the European Economic Area – EEA)
is envisaged.
8. What data privacy rights do I have?
Every data subject has the right to information in accordance with Art. 15 GDPR, the rightto rectification in accordance with Art. 16 GDPR, the right to erasure in accordance withArt. 17 GDPR, the right to restriction of processing in accordance with Art. 18 GDPR and theright to data portability in accordance with Art. 20 GDPR. The right to information and theright to erasure are subject to the restrictions of Sections 34 and 35 BDSG. You
additionally have the right to lodge a complaint with a supervisory authority (Art. 77 GDPRin conjunction with Section 19 BDSG).
If the processing is based on consent, you have the right to withdraw this consent at any
time without affecting the lawfulness of the processing carried out on the basis of theconsent until withdrawal. You can contact us or our data protection officer at any timeusing the above-mentioned contact details.
___________________
Privacy policy for applicants
As of: November 1, 2020

Page 3/4

9. Is there an obligation for you to provide your personal data?
The provision of personal data is neither legally nor contractually required, nor are you
obliged to provide the personal data. However, the provision of personal data is necessary
for the conclusion of a contract of employment with us. This means that if you do notprovide us with personal data in an application, we will not enter into an employment
relationship with you.

10. To what extent is there automated decision making in individual cases, including
profiling?
There is no automated decision making in individual cases within the meaning of Art. 22
GDPR, i.e. the decision about your application is not based solely on automatedprocessing.

11. Right to object
Right to object in individual cases:
You have the right to object at any time to the processing of personal data relating to you
for reasons arising from your particular situation. Any such objection is on the basis of Art.
6, para. 1, lit. f GDPR (data processing based on the balancing of interests).
If you lodge an objection, we will cease processing your personal data unless we candemonstrate compelling legitimate grounds for this that override your interests, rights andfreedoms, or unless the processing is being used to establish, exercise or defend legal
claims.
The objection can be made in any form and should preferably be addressed to:
Heidelberger Druckmaschinen AG
Kurfürstenanlage 52-60
60115 Heidelberg___________________
Privacy policy for applicants
As of: November 1, 2020

Page 4/4