Source: https://www.invia.de/en/privacy-policy/
Timestamp: 2019-04-25 03:49:16+00:00

Document:
This document will provide you with information which personal data are being collected for the purposes of providing our services (website and application), how these data are being processed by us and/ or third parties and what rights you have according to the General Data Protection Regulation (GDPR).
Cookies are small text files stored in the memory of your browser or device when you visit a website or press a specific button. Cookies allow a website to recognize a particular device or browser for a variety of purposes. These purposes may include: the usability of the website (for example, in the case of session cookies or cookies for recognizing the device and screen format) or, for example, information on whether a particular offer or specific advertising medium has been clicked. The collection of such data happens either anonymously or by means of pseudonymised usage profiles. That means, these are not intended to identify you as a person (if different, please refer to the technologies and cookies explained below). Although only pseudonymised data is collected and processed, in many cases this is still regarded as processing of personal data.
You can disable or remove cookies by using the settings or tools that are available as part of most browser technologies. The preferences must be set separately for each browser you use, with different browsers offering different functionality and options.
With similar tracking technologies (or “technologies” for short) we refer to e.g. small graphics (such as “pixel tags” or “clear gifs”) that may be integrated into our websites, services or features. These typically work with cookies, which in turn regularly contain the pseudonymous identifier.
If you wish to disable the tracking technologies and related cookies, you can do so through special settings on your browser. However, some features of our website are only available through the deployment of cookies. If you disable or opt-out of cookies, your use of the Websites and Services may be restricted or unavailable.
For more information and tips on cookie preference management, please visit http://www.youronlinechoices.com/.
a) Certain technologies and cookies are necessary to enable essential functionality of our website and to ensure the intended function of our online services. These include, for example, the HTTP session ID and session cookies, status, device and preference settings which are stored temporarily, local form data storage or information about voucher codes entered as well as the settings cookie, which saves your cookie preferences made at the beginning of the page visit. This includes technologies and cookies that serve technical error analysis and the ability to perform performance measurements (such as load times, server load allocations). Insofar as these data represent pseudonymous identifiers, we process them for the above-mentioned reasons based on legitimate interest, Art. 6 para. 1 p. 1 lit. f) GDPR. If you want to deactivate these cookies, you can only do so via special settings of your browser. If you disable or opt-out of these cookies, your use of the Websites and Services may be restricted or unavailable. Session cookies expire at the end of your browser session. Persistent cookies are stored between the browser sessions on your device until they are cleared by their browser settings.
For this purpose we use “Google Analytics”, a web analysis service of the Google LLC, in the EU via Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland).
We will process your personal data for the purposes of the application procedure if you submit your application via e-Mail, mail or online form. As far as you have given your consent, we store your data in our talent pool in order to take your application into account for future vacancies. In addition, we store your data for documentation and evidence purposes regarding our personnel decision.
The processing of personal data is based on Art. 6 (1) 1 point (b) GDPR (required prior entering into a contract).
In case of a rejection, the processing is based on our legitimate interest (Art. 6 (1) a point (f) GDPR) which lies in the ability to protect ourselves against claims or legal actions arising out of or in connection with the rejection of your application.
We will store and process your data in our talent pool solely if you have given your explicit consent (Art. 6 (1) 1 point (a) GDPR).
You will be informed at a later point of time about the processing of personal data in connection with the performance of the employment contract if your application was successful.
The provision of personal data is a necessary requirement of the hiring decision. If you do not provide the requested information we cannot take your application into account.
If we reject your application your data will be stored for a period of 90 days (beginning with the information about the rejection) and will be deleted afterwards. Notwithstanding the foregoing, the data will be stored in our talent pool if you have given your consent. In this case your data will be stored for a maximum of three years after your consent was given.
We are in charge of providing recruiting services to all affiliated companies of Invia Group with registered office in Germany. Hence, we will make available your data to the respective company that is responsible for the job offering in question. If your data is also stored in our talent pool we may also disclose your application and all personal data contained therein to other affiliated companies with future vacancies that might suit your profile.
We intend to transfer your personal data to third countries (countries outside the European Union). Insofar as we transfer your data to a third country, we will solely do so on the basis of an adequacy decision of the European Commission pursuant to Art. 45 (1) GDPR or Standard Data Protection Clauses adopted by the European Commission (Art. 46 (2) point (c) GDPR.
Further information regarding the decisions of the European Commission can be obtained here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en). Additional information in connection with the Standard Data Protection Clauses are provided upon request by our Data Protection Officer.
Yous hall have the right to obtain from us confirmation whether or not your personal data are being processed. Where that is the case, you shall have the right to access all data as stipulated in Art. 15 (1) GDPR.
You have the right to be informed whether personal data concerning your person are / have been transferred to a third county or to an international organisation and – if yes – of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
You shall have the right to obtain from us without undue delay the rectification of inaccurate the personal data. Furthermore, you shall have the right to have incomplete personal data completed.
You shall have the right to obtain from us the restriction of processing under the circumstance laid out in Art. 18 (1) GDPR.
Where the processing has been restricted, such personal data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims of for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You shall be informed by us before the restriction of processing is lifted.
You shall have the right to obtain from us the erasure of personal data concerning your person and we shall have the obligation to do so if one of the grounds as stipulated in Art. 17 (1) GDPR applies.
Where we have made the personal data public and we are obliged pursuant to Art. 17 GDPR to erase the personal data, we, taking account of available technology and cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing personal data that you have requested erasure by such controllers of any links to, or copy or replication of, those personal data.
The foregoing shall not apply to the extent that processing is necessary for the grounds as stipulated under Art. 17 (3) GDPR (compliance with legal obligations, exercise or defence of legal claims).
We shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Art. 16, 17 (1) and Art. 18 GDPR to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
Upon request, we shall inform you about those recipients.
You shall have the right to receive the personal data concerning your person, which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, provided that the conditions of Art. 20 (1) GDPR are met.
In addition, you shall have the right to have your personal data transmitted directly from us to another controller where technically feasible.
You subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6 (1) GDPR, including profiling based on those provisions.
Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning your person for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Insofar as the processing of personal data is based on your consent, you shall have the right to withdraw the consent at any time. If you do so, this will, however, not affect the lawfulness of processing based on consent before its withdrawal.
Without prejudice to any other administrative or non-judicial remedy, you shall have the right to lodge a complaint with a supervisory authority (in our case: Der Sächsische Datenschutzbeauftragte), if you assume that the processing of your personal data is not compliant with the GDPR.
The supervisory authority shall inform you on the progress or outcome of the complaint.

References: Art. 6
 Art. 6
 Art. 45
 Art. 15
 Art. 46
 Art. 18
 Art. 17
 Art. 17
 Art. 17
 Art. 16
 Art. 18
 Art. 20