Source: http://www.iuf-duesseldorf.com/data-privacy-declaration-regarding-job-applications.html
Timestamp: 2019-04-24 08:51:38+00:00

Document:
We are pleased that you consider a career at our institute. In the following, we explain how we guarantee the confidentiality in the process of your personal data in the context of your application.
The IUF – Leibniz Research Institute for Environmental Medicine at Heinrich Heine University Düsseldorf gGmbH (in the following referred to as “we”) is responsible within the meaning of the General Data Protection Regulation (“GDPR”) of the EU.
Regarding any questions you may have in connection with how your personal data is processed and how to exercise your rights in accordance with the GDPR, please feel free to contact our data protection officer, Dr Braun (phone 0211/3389-261, e-mail: datenschutz@iuf-duesseldorf.de).
For what purposes and on which legal basis do we process personal data?
It is in our justified interest for being able to process your personal data on the basis of Article 6(1) of the GDPR that with your application you want us to process your data correspondingly.
Furthermore, we can process personal data about you in so far it is necessary for defending us against legal claims made against us in the context of the application process. Here, the legal basis is Art. 6(1)(f) of the GDPR; the justified interest may be, for example, the duty to furnish proof in proceedings pursuant to the General Equal Treatment Act (GETA).
Provided that an employment contract is concluded between you and us, in accordance with § 26 Sec. 1 of the Federal Data Protection Act (BDSG) we can continue to use the personal data that you have already given us for administrative purposes in relation to the employment.
We process data that is related to your application. This may be general data about your person (such as name, address and contact information), your professional qualifications and school education or other information that you submit to us in connection with your application. Apart from that, we may process job-related information from you that you have made publicly accessible, for example a profile in job-related social media networks.
What are the categories of recipients’ data?
Furthermore, personal data is processed on our behalf on the basis of agreements pursuant to Art. 28 of the GDPR, in particular through host providers.
In the context of application processes, personal data is passed on to internal recipients (e.g. technical supervisors, equal opportunities officers, representatives for severely disabled employees and the works council).
Do we intend to communicate the data to a third country?
We do not intend to communicate the data to a third country.
We store your personal data for as long as it is required to make a decision about your application. If we do not conclude an employment contract with you, we may store data for as long as required to defend ourselves against possible legal claims. This means that the application documents are deleted two months after announcing the decision about a refusal, provided that it is not necessary to store the data longer because of a legal dispute.
Right of access: in accordance with Art. 15 of the GDPR, you are entitled to obtain confirmation from us as to whether personal data concerning you are being processed by us. Where that is the case, you are entitled to obtain access to this personal data and further information as set forth in Art. 15 of the GDPR.
Right to rectification and completion: in accordance with Art. 16 of the GDPR, you are entitled to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure: you have the right to demand that we delete personal data concerning you without undue delay. We are obliged to erase personal data without undue delay provided that the corresponding requirements of Art. 17 of the GDPR are met. For details, please refer to Art. 17 of the GDPR.
Right to restriction of processing: pursuant to Art. 18 of the GDPR, you have the right to obtain a restriction on the processing of your personal data under certain circumstances.
Right to data portability: pursuant to Art. 20 of the GDPR, you have the right to receive the personal data concerning yourself, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another responsible party without hindrance from us, if such processing is based on consent in accordance with Art. 6(1)(a) or Art. 9(2)(a) of the GDPR or on a contract in accordance with Art. 6(1)(b) of the GDPR and processing is done by means of automated processes.
Right to object: pursuant to Art. 21 of the GDPR, you have the right to object to the processing of personal data concerning yourself which is based on point (e) or (f) of Article 6(1) of the GDPR; this is also applicable to profiling based on these provisions.
Right to withdraw: you have the right to withdraw your given consent at any time in accordance with Art. 7(3) of the GDPR.
Right to lodge a complaint with a supervisory authority: pursuant to Art. 77 of the GDPR, and without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
Making personal data available is neither statutorily nor contractually required, nor are you obliged to make personal data available. However, it is necessary to make personal data available in order to conclude an employment contract with us. This means that if you do not make any personal data available with your application, we will not enter into an employment relationship with you.
There is no automated decision making in the individual case within the meaning of Art. 22 of the GDPR. This means that the decision about your application does not depend exclusively on automated processing.
Legally binding is the German version.

References: Art. 6
 § 26
 Art. 28
 Art. 15
 Art. 15
 Art. 16
 Art. 17
 Art. 17
 Art. 18
 Art. 20
 Art. 6
 Art. 9
 Art. 6
 Art. 21
 Art. 7
 Art. 77
 Art. 22