Privacy Policyof GROB-WERKE GmbH & Co. KG
on the processing of applicant data
Mindelheim, 20.02.2024

Thank you for visiting our career page and for your interest in our company. Whenever
you apply for a job in our company, we will of course receive a great deal of informationthat you provide during the application process. The protection of your personal data isimportant to us and takes top priority. We guarantee, as a matter of course, compliancewith the legal data protection regulations and treat both the fact that you have made anapplication and your data as confidential.
This Privacy Policy describes how your personal data are processed by GROB-WERKEGmbH & Co. KG and your rights under data privacy laws.
Who is responsible for data processing and who is the Data Protection Officer?
The responsibility for data processing lies withGROB-WERKE GmbH & Co. KG
Industriestraße 487716 Mindelheim
Tel.: +49 8261 996-0
E-mail: personal@grob.de
Details about the Data Protection Officer
Industriestraße 487716 Mindelheim
Tel.: +49 8261 996-0
E-mail: datenschutz@grob.de
Which persona data do we collect and where do they originate?
We process the following personal data as part of the application process: data about you (including first name, last name, name affixes, date of birth) work permit/residence permit where required contact data (such as private address, (cell) telephone number, e-mail address)
 Skill data (e.g. specific knowledge and abilities)
 where relevant for the advertised position: health and fitness
 other data from the application records (such as grades, periods of employment)
Your personal data are essentially collected from you during the employment process,more particularly from the applications records, the interview and from the personnel
questionnaires. In case of a job placement, we will also receive data from third parties.
In addition, we may process personal data that we have legitimately obtained frompublicly accessible sources (e.g. professional networks such as Xing).
For which purposes and on which legal basis are data processed?
We process your personal data in compliance with the provisions of the EU General Data
Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1/5

Data are processed first and foremost to justify the employment relationship. The primary legal basis is Art. 88, para. 1 GDPR in conjunction with Section 26, para. 1 BDSG.
Your data are processed exclusively for the purpose of filling the particular position forwhich you applied.
It may also be necessary to process health data in order to assess your fitness for theposition in accordance with Art. 9, para. 2 h) GDPR in conjunction with Section 22, para.
1 b) BDSG (Federal Data Protection Act).
Special categories of personal data (details on racial and ethnic origin, political opinions,religious and philosophical beliefs, trade union membership, health or sexual orientation)
are not deliberately gathered by GROB GmbH & Co. KG in the course of the application
process. Therefore, we ask you not to provide any information on the above criteria aspart of your application.
If, in case of a rejection, you wish to be incorporated into our Talent Pool, we will require
your Declaration of Consent.
Moreover, we are obligated under European Anti-Terror Regulations 2580/2001 and881/2002 to compare your data against the so-called "EU Terror Lists". This is to ensurethat no money or other economic resources are provided for terrorist purposes.
How long are your data stored?
In case of employment, we will place your application records in your personnel file. At
the end of the employment relationship, we will continue to store those personal datathat we are required to retain by law. It may also be that GROB-WERKE GmbH & Co. KG
retain data for the period during which claims can be made against us (statutory limitation period of three years or up to thirty years).
In case of a rejection, your application records will be deleted six months after the application process closes at the latest, unless you have granted your consent to a longer period of storage (Talent Pool). Your data will be stored in the Talent Pool for a maximum of
12 months. After that time, we will delete your data or request your consent to store
your data for another 12 months.
Data security
GROB-WERKE GmbH & Co. KG ensures the protection of your personal data regardless of
where your data is accessed and complies with existing laws and regulations on the collection, processing, evaluation, transmission, storage and use of data. As a matter ofprinciple, your personal data will not be transferred to third parties outside GROB-WERKEGmbH & Co. KG, except in the following cases:
1. We have obtained your consent or an official injuction to do so.
2. Your applicant data is transferred in encrypted form to a data center of Softgarden e-recruiting GmbH in our electronic applicant management system, storedand processed there, and is subject to German law. The security measures arecontinuously improved to keep abreast of technical developments.
3. As part of the application process, after agreeing to our privacy policy and when
uploading your CV to our electronic applicant management system, your CV will
be forwarded to Textkernel B.V. as part of the CV parsing*) process. The data istransferred solely for the technical purpose of being able to transfer your data to
the online career portal of GROB-WERKE GmbH & Co. KG. The transmission is encrypted and data storage in the Netherlands does not take place.
2/5

Who receives your data?
Within our company, only those persons and departments (e.g. HR management, specialist department, management, works council) that are involved in the decision about youremployment will receive your data. Where legally prescribed, the Severely Disabled Persons Representative. The disclosure about a severe disability or equivalent condition is atyour discretion as the applicant. If your disclose a severe disability or equivalent condition and do not explicitly refuse the involvement of the Severely Disabled Persons Representative, the Severely Disabled Persons Representative will be informed, in accordance with Section 164, para. 1, sentence 4 SGB IX about your application as soon as
it is received. Moreover, your application can then be viewed by the Severely Disabled
Persons Representative concerned.
All persons involved in the application process are bound by data secrecy.
Transmission of personal data to a third party country
There is no intention to transmit personal data to a third party country.
References to the rights of affected parties
The affected person shall be entitled demand from the responsible party a confirmation
as to whether their personal data are being processed; if this is the case, they have aright to information about these personal data and to the information individually listedin Art. 15 GDPR (General Data Protection Regulation).
The affected person has the right to demand from the responsible party an immediate
correction to any incorrect personal data and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).
The data subject has the right to request that the data controller delete personal data
concerning him/her without delay if one of the reasons specified in Article 17 of GDPR
applies, e.g. if the data are no longer required for the intended purposes (right to deletion).
The affected person has the right to demand from the responsible party the limitationof processing if one of the prerequisites listed in Art. 18 GDPR is met, e.g. if the affected person has lodged an objection to processing, for the duration of the examination by
the responsible party.
If the prerequisites of Art. 20 GDPR are met, the affected person shall be entitled to data
portability.
The affected person has the right, for reasons ensuing from their particular situation, toobject to the processing of their personal data at any time. In this case, the responsible
party will cease to process the personal data unless they are able to demonstrate legitimate grounds for such processing that outweigh the interests, rights or freedoms of theaffected person, or the processing serves to assert, exercise or defend legal claims (Art.
21 GDPR).
If the prerequisites of Art. 20 GDPR are met, you shall be entitled to data portability.
Should you exercise your rights as mentioned above, GROB-WERKE shall verify
whether the legal prerequisites are met.

3/5

Recipient of an objection
The objection can be made informally with the subject "Objection" stating your name andaddress and should be addressed to:
GROB-WERKE GmbH & Co. KG
Industriestraße 487719 Mindelheim
E-mail: personal@grob.de

Each affected party, notwithstanding any other administrative or judicial remedies, has
the right to complain to a supervisory authority, if the affected person believes thatthe processing of their personal data is in contravention of the GDPR (Art. 77 GDPR). The
data subject may exercise this right before a supervisory authority in the member statein which he/she resides or works or in which the suspected infringement took place.

The competent supervisory authority inBavaria is:Internal data protection:

Bavarian Regional Office for
Data Protection Supervision (BayLDA)GROB-WERKE GmbH & Co. KG
Company Data Protection Officer (bDSB)

Promenade 27

Industriestrasse 491522 Ansbach87719 Mindelheim

Phone: +49 981 53 1300

Tel.: +49 8261 996-0

Fax: +49 981 53 98 1300

Fax: +49 8261 996-268

e-mail: poststelle@lda.bayern.de

E-mail: datenschutz@grob.de

Further information on the subject of data protection and for use of the ERecruiting Systema) Registration:
Before you can enter your data for the online application, you will be asked to provide anemail address and choose a password to create an account for access to the protectedarea of the applicant portal.
You can edit and expand your data at any time until your application is submitted. Oncethe online application has been submitted, you will be asked to enter the email address
and the password to create your account for access to the protected area of the applicant
portal. You can view, edit and delete your data stored there at any time in your account.
If you are still a minor:

4/5

If you are still a minor, i.e. if you have not yet reached the age of 16, and would like tomake an application, you will be advised when you state your age group that the Declaration of Consent form provided must be completed and signed by your legal guardian(usually your parents) and uploaded with your application records.
Please note: If this Declaration of Consent is not made available to us for the recruiting
process, we will not be able to consider your application and your data will be deleted
immediately.
b) Notes on the password
Keep your password secret to prevent it being accessed by unauthorized persons. Never
disclose your password. Even employees of GROB-WERKE are not authorized to ask you
for your password!
c) Data security
We employ technical and organizational security measures to protect the data about you
we administrate against accidental or deliberate manipulation, loss, destruction or accessby unauthorized persons. Our security measures are continuously improved to keep abreast of technical developments. Unless encrypted by you, data are transmitted via email
in unencrypted format. To increase the data protection of your attachments, we recommend encryption via 7Zip. You can transmit the password for decryption to us by telephone.
To what extent do automated case-by-case decisions or profiling measures takeplace?
We do not use any purely automated processes for taking decisions.
*) CV parsing - also known as CV analysis or CV processing - is the process of convertingCVs or profiles on social networks into a structured format. CV parsing eliminates theneed for manual data input. Candidates can apply via (mobile) devices of any kind andsearching databases is facilitated for recruiters. (Source: textkernel.com – CV Parsing)
No automatic analysis or machine matching is performed at any time.

5/5