Source: https://jobsearch.createyourowncareer.com/content/Privacy-Policy/
Timestamp: 2019-04-22 10:19:19+00:00

Document:
5. For what purpose are my data processed and on what legal basis?
6. Who shall receive my data?
7. Will my data be processed outside the EU/EEA (third country transfer)?
9. To what extent is there automated decision-making or profiling?
This applicant portal enables you to enter your application online and apply for a vacant position at a Bertelsmann Group company (hereinafter "Group company") or a Bertelsmann Foundation (hereinafter "Bertelsmann Foundation"). Your application also includes personal data (hereinafter referred to as "data"), and for this reason data protection provisions and in particular the EU General Data Protection Regulation (hereinafter referred to as "GDPR") apply.
The principles of fair and transparent processing of your data require that you be informed of the existence of the individual processing operations and their purposes in connection with your online application. Technical and organizational security measures protect your data against accidental or intentional manipulation, loss, destruction or against unauthorized access.
The following Data Protection Notice applies to the applicant portal worldwide, EU and non-EU, and fulfills the information requirements set out in Articles 12 to 14 GDPR. They are supplemented by the Data Protection Notice in the specific job posting (hereinafter referred to as "1st level information"). Local regulations on the processing of applicant data from individual EU and non-EU countries, if available, will be referred to at the appropriate place.
1 Who is responsible for processing my data?
Bertelsmann SE & Co. KGaA, Carl-Bertelsmann-Straße 270 in 33311 Gütersloh, Germany, operates the applicant portal and is responsible for processing your data if you apply for a specific position at Bertelsmann SE & Co. KGaA or agree to participate in the candidate pool.
In addition, the Bertelsmann Group companies or the Bertelsmann Foundations, which use the applicant portal for online applications, are responsible for data processing in the specific application process. As a rule, the Bertelsmann Group company or Bertelsmann Foundation of the job posting for which you are applying is responsible. With the exception of Bertels-mann SE & Co. KGaA, which operates in this context under a Data Protection Agreement, no other Group companies or Bertelsmann Foundations have access to your data. However, if you apply for a trainee program, a Group-wide or cross-foundation job posting or agree to participate in the candidate pool, several Group companies or several Bertelsmann Founda-tions may be responsible in exceptional cases and have access to your data. The company name and address of the respective responsible Group company or Bertelsmann Foundation can be found in the 1st level information described above in the job posting.
You can reach the Data Protection Officer of Bertelsmann SE & Co. KGaA at the above postal address or via datenschutz@bertelsmann.de. In order to ensure that your request for data protection is processed promptly and appropriately, please contact the Data Protection Officer of the respective responsible company or Bertelsmann Foundation directly. You can also obtain this information from the 1st level information in the job posting.
2 What data is collected?
When you visit the applicant portal, the calling computer automatically collects information (hereinafter referred to as "access data"). The access data may contain information about the browser type, browser version, operating system, Internet service provider, date and time of use of the applicant portal, previously visited websites, newly accessed websites and the IP address of the computer.
When you use the online application, you will need to create an applicant profile. Your first and last name, residence and email address as well as user name and password are required to create of an applicant profile. However, uploading documents or information on academic and/or professional background, qualifications and skills, language skills and willingness to travel/mobility is voluntary and not mandatory for registration. To make it as easy as possible for you to apply for various positions, your applicant profile shall be valid for all online applica-tions via the applicant portal.
In addition to the general profile information, job-specific information is also requested when you apply for a specific job. While the general profile information can also be used for other online applications, the job-specific information is collected and processed anew for each online application.
The mandatory fields are regularly marked with an asterisk (*) and all other fields are volun-tary.
In addition to the applicant profile, other data such as communication content (e.g. email con-tact), appraisals (e.g. assessment center results or proficiency tests) or accounting data (e.g. reimbursement of travel expenses) can also be processed when an application procedure is carried out if this is required by law or contract or if you have given your consent. As a rule, this data is not processed via the applicant portal.
3 Is there an obligation to provide the data?
There is an obligation to provide the data if their processing is required by law or (pre-)contract. For your online application, you must provide the Bertelsmann Group company or Bertelsmann Foundation with the data necessary for the recruitment decision and thus for the examination of your professional skills, or which the Bertelsmann Group company or Ber-telsmann Foundation is obliged to collect. Without this data, registration is not possible and your online application is not possible.
If the data processing takes place on the basis of legitimate interests, you are basically not obliged to provide us with your data.
The applicant portal is a website service. Functional and optional cookies are used for the purpose of the provision of services. Cookies are small text files that are stored on your com-puter when you visit the applicant portal. The stored cookies are assigned to the browser you are using. If the applicant portal is opened again, the web browser sends back the contents of the cookies and thus makes a recognition possible. Functional cookies facilitate the technolo-gy and functions of the applicant portal and ease your use of the portal. Optional cookies, on the other hand, help to optimize offers on the applicant portal by recording user behavior and evaluating it statistically.
The cookies are limited to a certain period of time (e.g. expiration of the browser session) and are deleted after this period (so-called "session cookies"). In addition, you can configure and delete cookies according to your wishes via the settings of your browser. An early deletion can, however, lead to the fact that the offers of the applicant portal are only available to a limited extent. It can also have a negative impact on user-friendliness.
5 For what purpose are my data processed and on what legal basis?
Data processing for other purposes does not take place in the applicant portal.
For the functionality of the applicant portal, the performance of security analyses and the de-fense against attacks, the access data referred to under Section 2 shall be automatically rec-orded by the computer system of the calling computer on access and during use and stored at short notice. The server log files contained therein are generally not stored together with other data. The server log files are used for statistical evaluations in order to analyze and rec-tify technical faults, to fend off attacks and fraud attempts and to optimize the functionality of the website.
The legal basis for the collection of personal server log files is Art. 6 Para. 1 (f) GDPR. Ensuring functionality, carrying out safety analyses and averting dangers are legitimate interests.
After calling up the applicant portal, the server log files are stored on the web server connected to it and the IP address contained therein is deleted after 7 days at the latest. An evaluation during this storage period takes place exclusively in the event of an attack.
You have the right to object to the processing of your data within the framework of server log files, if there are special reasons for doing so. If you wish to make use of your right of objec-tion, please contact the responsible Bertelsmann Group company or Bertelsmann Foundation, stating the reasons.
The web tracking service Google Analytics is used in the applicant portal. The provider of Google Analytics is Google Inc. Google Analytics creates a pseudonymous user profile in order to optimize the user friendliness of the applicant portal. Your access data is recorded according to Section 2 and the usage behavior is evaluated with the aid of optional cookies according to Section 4. Personal identification is generally not required for web tracking, so that when your access data is collected, the IP address stored is shortened before it is trans-mitted to Google Inc. and no inference can be made about you. The pseudonymous user pro-file is evaluated after transmission in order to optimize the user friendliness of the applicant portal. Combining with other data of Google Inc. does not take place. A contract for order processing ensures that Google Inc. processes the data only according to instructions.
The legal basis for recording and evaluating pseudonymous user profiles is Art. 6 Para. 1 (f) GDPR. The justified interest lies in optimizing the user-friendliness of the website.
The pseudonymous user profiles are generally stored until you object to their use. The maxi-mum storage period is 26 months.
With the creation of your applicant profile and receipt of your online application for a specific job posting, your data will be processed for recruitment purposes. At the stage of entering into a contract of employment or employment relationship, your prospective employer has an interest in ensuring that you have the required professional competence and suitability for the specific job. The scope of data processing, the application procedure and the choice of means (e.g. telephone interview, assessment center, personal interview) depend on the re-quirements of the specific job posting. It also depends on which persons are involved in data processing and thus have access to your data. These persons regularly include employees of the personnel department (also known as "recruiters") and supervisors as well as, in some cases, also specialist managers. Depending on the country and position, your data may also be processed by members of the works council or members of the representative bodies of severely disabled employees, exercising their legal rights of codetermination. If, in addition, other persons or bodies (e.g. service providers) have access to your data, this is always done on the basis of a contractual confidentiality agreement and/or a data privacy agreement.
The legal basis for the processing of your data in the online application is Art. 6 Para. 1 (b) GDPR, a necessity for the recruitment decision and justification of an employment contract. In addition, the local legal basis for the processing of applicant data applies if the country in which the Data Protection Officer is established has issued such a law pursuant to Art. 88 Para. 1 GDPR. You can view these and other local legal bases of countries outside the EU here.
Your data will be processed as long as it is necessary for the establishment of the employ-ment relationship. The online application and thus also the purpose of the data processing for the specific application procedure ends with the recruitment decision. After the legal retention period for applicant data has expired, your data will be deleted. The legal retention period depends on the applicable local law of the of the person responsible.
In order to make it as easy as possible for you to apply for various positions and to offer you additional functions such as participation in the candidate pool, your applicant profile is also valid for further online applications via the applicant portal during or after the online application process. The general profile data will be stored and used, the job-specific data will be deleted in accordance with the above deadlines. The applicant profile will be deleted automatically if you have not used it more than 5 months after completion of your (last) online application. You will be informed of the deletion by email in good time and you have the option of extend-ing the storage by a further 6 months by using the applicant profile.
The processing of your data is necessary for the recruitment decision. As a result, no objec-tion is possible.
Regardless of the individual online application, you have the opportunity to participate in the worldwide candidate pool during registration. Participation in the candidate pool only takes place with your consent, which you can give upon registration. This consent allows all recruiters of Bertelsmann and the Bertelsmann Foundations authorized to have access to be able to access your applicant profile in order to check it for suitable job postings. The only subject is your general profile information and explicitly not the job-specific requirements if you are in the middle of one or more application procedures. The check is also carried out manually and not by automated individual case decisions or profiling. In the case of a suitable job posting, you may be contacted by the Bertelsmann Group company or Bertelsmann Foundation re-sponsible for the job posting, provided that you have consented to the notifications on career matters in addition to consenting to visibility (for further information, see Section 5.5). An online application is not yet justified by contacting us, so that you are free to decide whether you wish to apply or not. If an application is received, your data will be processed in accord-ance with Section 5.3.
Bertelsmann's Group companies are located worldwide. Therefore, access can also take place from outside the European Union or the European Economic Area (hereinafter referred to as "EU/EEA"), such as the USA or Brazil (hereinafter referred to as "third country transfer"). The GDPR initially only applies in the EU/EEA, so that no globally appropriate level of data protection can be guaranteed. However, efforts to ensure a similar level of data protec-tion for third countries is underway. For example, standard contractual clauses provided by the EU Commission may qualify as a suitable guarantee. Any guarantees may exceptionally be waived if you consent to this. Therefore, consent to the transfer of data within the group of companies and the group of foundations also includes the transfer of data to third countries in accordance with the legal requirements of Art. 49 Para. 1 (a) GDPR. In addition, the EU Commission has recognized certain third countries as safe third countries, so that appropriate safeguards can also be waived here.
The legal basis for your participation in the candidate pool is the consent according to Art. 6 Para. 1 (a) GDPR. In addition, the local legal basis for the processing of applicant data applies if the country in which the Data Protection Officer is established has issued such a law pursuant to Art. 88 Para. 1 GDPR. You can view these and other local legal bases of countries out-side the EU here.
The consent is voluntary. A refusal of consent or the revocation of your consent has no nega-tive effects on current application procedures.
Your participation in the candidate pool and thus the access of the recruiters takes place until you revoke your consent and/or your applicant profile is deleted. Legal retention periods re-garding ongoing application procedures remain unaffected. The legal retention period depends on the applicable local law of the person responsible.
You can revoke your consent to participate in the candidate pool at any time with effect for the future by restricting access via your profile settings.
When registering and via your profile settings you have the possibility to subscribe to a news-letter. Via the newsletter, you will receive weekly information on current job postings by email, the content of which is initially geared to the subject area of your (first) online application. The content of the newsletter, i.e. fields of interest to you, can be optionally extended or changed via your profile settings. You can also unsubscribe from the newsletter at any time via your profile settings.
In addition to the newsletter, you also have the opportunity to be informed about career oppor-tunities. If you select this option during registration or via your profile settings, the recruiter may contact you personally by email and suggest current job postings to you. Basically, this shall only be the recruiter who has access to your applicant profile as part of your online application. If you have agreed to participate in the candidate pool, you can always contact all recruiters with access rights. In this case, the descriptions in Section 5.4 shall apply. You can turn off this notification option at any time via your profile settings.
Both notification functions can be used independently of each other. Both the registration for the newsletter as well as the contact to career matters is voluntary and has no influence on the registration or ongoing application procedures.
The legal basis for the processing of your data in the notifications is Art. 6 Para. 1 (f) GDPR. The legitimate interests lie in the acquisition of applicants and thus the filling of vacant posi-tions.
Your data will be stored for the purpose of notification until you deactivate it and/or until the applicant profile is deleted. Legal retention periods regarding ongoing application procedures remain unaffected. The legal retention period depends on the applicable local law of the person responsible.
You can object to the notifications at any time with effect for the future by deactivating the notifications via your profile settings.
In principle, no special categories of personal data are covered by the data processing in the specific application procedure via the applicant portal. In this respect, when uploading docu-ments such as a cover letter or CV, you will be required to refrain from including any special categories of personal data.
Particular categories of personal data include information from which racial and ethnic origin, political opinion, religious or ideological beliefs or trade union affiliation can be derived, as well as genetic data, biometric data for the unambiguous identification of a natural person, health data or data on the sexual life or sexual orientation of a natural person.
Due to a legal obligation under labor law, it is necessary to grant participation rights to the rep-resentative body for severely disabled persons in the application process, if the employer has established one. Therefore, during the application procedure you may be asked whether you wish to have the participation of the representative body for severely disabled persons or not. The same applies to certain abilities such as vision or physical fitness or agility, if required for filling a position. However, this data is not collected online in the applicant portal but by other means, such as in paper form, and is stored and destroyed in accordance with data protection regulations.
The legal basis for the processing of special categories of personal data is Art. 9 Para. 2 b GDPR, provided that the processing is necessary for the exercise of rights or for the fulfill-ment of legal obligations under labor law, social security law and social protection law and there is no reason to believe that your legitimate interest in the exclusion of the processing prevails.
6 Who shall receive my data?
When applying online, only persons who make the specific recruitment decision or are signifi-cantly involved in this decision are granted access to your data. These persons regularly in-clude personnel department employees (so-called "recruiters") and supervisors as well as, in certain cases, specialist managers.
In addition, due to compliance with legal obligations under labor law and social security law or social protection, it may be necessary in a specific application process that employee representatives (works council and representative body for severely disabled persons) have ac-cess to your applicant profile.
The service providers used to provide and manage the applicant portal can also access your applicant profile. Data protection contracts ensure that your instructions are followed, that data is secure and that your data is handled confidentially.
public bodies and institutions, such as labor courts and law enforcement authorities, that must gain access to the applicant profile due to compliance with legal or regulatory obligations.
7 Will my data be processed outside the EU/EEA (third country transfer)?
If you have agreed to participate in the worldwide candidate pool, a third country transfer will take place. With your consent, you have, according to Art. 49 Para. 1 (a) GDPR, expressly taken due note that data transfers to third countries do not provide an adequate level of data privacy protection at the EU level. An overview of the Group companies established in a third country can be found here. Further information on the scope and purpose of data processing for participation in the candidate pool can be found in Section 5.4.1.
8 What data protection rights do I have?
You can view your data in your applicant profile at any time. You have the right at any time to information about the data stored about your person, provided that only the first request during a year will be provided free of charge. If your personal data is incorrect or no longer up to date, you have the right to request that it be corrected. You also have the right to request the deletion or limitation of the processing of your data in accordance with Art. 17 or Art. 18 GDPR. You can also correct or delete your data yourself at any time via your profile settings. You may also have the right to have the data provided by you published in a common and machine-readable format (so-called "right to data transferability").
Pursuant to Art. 21 GDPR, you also have the right, for reasons arising from your particular situation, to object at any time to the processing of your data, which takes place in accordance with the legal basis of Art. 6 Para. 1 (f) GDPR.
Further Data Protection Authorities of individual federal states and member states of the EU can be found here. However, you can also contact the Data Protection Authority responsible for your place of residence.
9 To what extent is there automated decision-making or profiling?
For the processing of your data in the applicant portal neither automated decision-making nor profiling will be used.
We reserve the right to amend this notice at any time and will provide any required notice(s) of the amendment to the extent applicable. We will post the revised notice on this portal or announce the change on the home page of the site. You can determine when the Statement was revised by referring to the "Last Updated" legend on the top of this notice. Any changes will become effective upon the posting of the revised notice, except to the extent of any applicable notice requirements.
You can download the Data Protection Notice version 1.0 here.

References: Art. 6
 Art. 6
 Art. 6
 Art. 88
 Art. 49
 Art. 6
 Art. 88
 Art. 6
 Art. 9
 Art. 49
 Art. 17
 Art. 18
 Art. 21
 Art. 6