data protection
online application

Processing (Personal) Data by the Entity Responsible for the Online Application Process

I. General Information 

We have created this privacy statement to inform you about the handling of your personal data in connection with your application process, the initiation of such a procedure, and the personal data collected for these purposes. This privacy statement supplements the privacy statement at www.primekliniks.de.

II. Controller within the meaning of the GDPR 

The controller within the meaning of the GDPR is: 

primekliniks GmbH, 

Lilienthalstraße 5, 

64347 Griesheim, 

Germany, 

Tel.: +49 (0) 1718173789, 

Email: info@primekliniks.de, 

Trade Register # HRB 105690, 

Amtsgericht Darmstadt, 

Managing Director: Olimpia Best

III. Processing of Personal Data Before and During the Application Process

1. Publicly Accessible Data Sources 

We process certain categories of your personal data, i.e., master data, details of your professional experience, and contact data, which we have lawfully obtained from publicly accessible sources (e.g., from the internet, including relevant business/recruitment platforms such as XING, linkedin.com) or which have been lawfully communicated to us by other companies, provided that the processing of this data is necessary to review your application and contact you for the purposes of your application. In this case, the legal basis for processing your data is Article 6 (1f) GDPR, which we invoke based on our legitimate interest in recruiting new employees by identifying potentially qualified applicants and inviting them to submit an application.

1. Online Application 

Notwithstanding the aforementioned provisions, we will process the personal data you provide to us during the online application process to the extent necessary to process your application. Your personal data will be processed solely for the purpose of managing the application process for the position you are applying for. In certain cases, the application process may result in us offering you a position in another role. The provisions in this document also apply in this case unless you receive separate information. Your personal data particularly includes your first and last name, your email address, and a reference to the position you are applying for, as we would otherwise not be able to process your application (in accordance with your interests). You may voluntarily provide us with other personal data that may be relevant to the application process. This data includes, in particular, your additional contact and master data (address, date of birth, nationality), family data (e.g., marital status, children), identification data (e.g., official identification documents, residence and work permits), details of your qualifications and previous employers, including reference letters, resumes, work samples, salary expectations, earliest start date, and similar information. The legal basis for processing the data for these purposes is Art. 6 (1 lit. b), 88 GDPR in conjunction with § 26 (1) and (8 sentence 2) GDPR.

1. Unsolicited Applications 

If you send us your unsolicited application, we will process your personal data as necessary for your unsolicited application. The legal basis in this case is Art. 6 (1 lit. b), 88 GDPR in conjunction with § 26 (1) and (8 sentence 2) GDPR (III. 2. applies otherwise).

1. Special Categories of Personal Data 

In cases where we collect/process special categories of personal data, e.g., because you have provided us with personal data classified as belonging to a specific category, we will process the data only to the extent necessary and based on Art. 88 GDPR § 22, 26 (2) and (3) BDSG. Consent pursuant to Art. 9 (2 lit. a), 88 GDPR § 26 (2) and (3) BDSG may serve as the legal basis in certain cases (see also III. 5.).

1. Consent 

If you have given us your consent to process certain personal data for specific purposes, we will process this personal data based on your consent in accordance with Art. 6 (1 sentence 1 lit. a.), 88 GDPR in conjunction with § 26 (2) and (8 sentence 2) (or Art. 9 (2 lit. b)), 88 GDPR in conjunction with § 26 (3) BDSG, see also III. 4.). The scope and purpose of data processing are set out in the relevant consent declaration you have provided. You may revoke your consent at any time with prospective effect. A revocation of consent does not affect the lawfulness of any data processing carried out based on your consent prior to your revocation. We would like to inform you explicitly about two specific scenarios: (i) We may invite you to participate voluntarily in a video interview at a certain point during the application process. In this case, your personal data, consisting of your name, email address, and candidate status, will be communicated to and processed by the respective service provider. The service provider also processes recordings of you during the interview. (ii) In certain cases, we may also offer to retain your personal data after an unsuccessful application process and use the data to contact you about future job openings that may be of interest to you (talent pool). In these cases, we will always contact you separately and ask you to provide us with your written consent. You may give or refuse consent at your discretion. We expressly point out that you will not be discriminated against if you refuse consent or revoke previously given consent, especially concerning a current application.

1. Duration of Data Storage 

The general rule is that your personal data is stored in a format that allows your identification only as long as necessary for the purposes of data processing. However, if you contact us within the meaning of III. 1. but are not interested in continuing the application process, we will delete your data immediately. If your application is unsuccessful, we will store your data for a period of 6 months from the date you receive the letter informing you of the negative outcome of your application. The data is stored to ensure compliance with legal obligations and to defend against any potential claims arising from the application process. The legal basis for storing the data in this format is Art. 6 (1 lit. f) GDPR, which we invoke based on our legitimate interest in defending against potential claims; your rights and interests do not override such storage, as your personal data will not be processed for other purposes during this period, and therefore our interest in preserving our interests prevails. If you have consented to the processing of your personal data for the purposes of our talent pool (see also III. 4.), we will store your personal data for a period of 2 years from the date you receive the letter informing you of the negative outcome of your application. This storage of your data is based on your consent pursuant to Art. 6 (1 sentence 1 lit. a) GDPR, 88 GDPR in conjunction with § 26 (8 sentence 2) BDSG. We will delete or anonymize your data after the respective storage period has expired. Anonymized data will then only be available to us in the form of so-called metadata for statistical evaluations (e.g., male/female ratio of applicants, number of applications within a period, etc.) and will not contain any personal information. If the application process results in us offering you a position and you accept our offer, we will process your personal data concerning the employment relationship based on Art. 6 (1 lit. b) GDPR, 88 GDPR in conjunction with § 26 (1) BDSG beyond the completion of the application process for purposes related to your employment. We will store your personal data after the termination of the employment relationship for as long as the respective purpose has not been achieved for a period of 4 years unless a statutory retention period dictates otherwise. In this case, you will receive a new privacy statement that expressly provides for this scenario.

1. No Obligation to Disclose Personal Data 

You are neither contractually nor legally obligated to disclose personal data within the meaning of this section III for the purposes of the application process. However, providing your first and last name as well as your email address is necessary for us to accept your application in our application process. Refusal to disclose your first and last name as well as your email address may result in the disqualification of your application. Your first and last name will, in any case, be required for a later employment contract. Disclosing additional information helps us gain a comprehensive impression of you and your application; refusal to disclose additional personal data such as professional experience, reference letters, etc.

IV. Recipients of Your Personal Data 

Only authorized personnel in the human resources department and/or staff involved in the application process and/or management of our company can access your data. We may use technical web-based solutions from third-party providers to assist us in processing applications and achieving the aforementioned purposes. This means that our service providers have access to your personal data. Our service providers act in accordance with our instructions as contract data processors pursuant to Article 28 GDPR. Candidate data is generally hosted on a server in the EU. If personal data is transferred to a third country with different data protection standards and for which no adequacy decision has been made by the EU Commission, we ensure that these service providers process personal data in accordance with European data protection laws by entering into appropriate contractual agreements aimed at ensuring a high level of data protection, e.g., by implementing standard contractual clauses. We currently do not intend to transfer data to such third countries. Personal data is not shared with any other recipient unless the disclosure is lawful (e.g., we have informed you about the disclosure) or you have given your consent to such disclosure.

V. Rights of Data Subjects 

Data subjects wishing to exercise their rights under the GDPR can contact our data protection officer at any time by sending an informal message using the contact details provided under 1. c). Data subjects have the following rights:

• the right to receive information about data processing and a copy of the processed data (right of access, Art. 15 GDPR),

• the right to request the rectification of inaccurate data or the completion of incomplete data (right to rectification, Art. 16 GDPR),

• the right to request the deletion of personal data and, if the personal data has been published, to inform other controllers about the request for deletion (right to be forgotten, Art. 17 GDPR),

• the right to request a restriction of data processing (right to restriction of processing, Art. 18 GDPR),

• the right to receive the personal data relating to the data subject in a structured, commonly used, and machine-readable format and the right to request the data to be transferred to another controller (right to data portability, Art. 20 GDPR),

• the right to object against processing of personal data on the basis of Art. 6 (1 lit. e) or (6 lit. f) GDPR resulting from the data subject's special circumstances; the controller will discontinue the processing of the personal data in the case of an objection, unless the controller’s compelling and demonstrable interests in the processing of the personal data prevailed over the rights and freedoms of the data subject, or if the processing serves the purpose of exercising, asserting or defending legal interests. Data subjects may at any time object to the processing of their personal data for direct advertising purposes, including profiling measures (right to object, Article 21 GDPR),

• the right to revoke a previously granted consent at any time and thereby prevent the processing of your data that is based on that consent. A revocation of consent does not prejudice the lawfulness of any data processing based on your consent prior to your revocation of consent (right to revoke consent, Art. 7 GDPR),

• the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes against the GDPR (right to lodge a complaint with a supervisory authority, Art. 77 GDPR).

VI. Final Provisions 

We reserve the right to change this privacy statement at any time to ensure that it complies with current legal requirements or to reflect changes in the application procedure or similar. The new privacy statement will govern all future visits to this recruitment website. In addition to this privacy statement, we would like to draw your attention to www.primekliniks.de/privacy and ask you to read our general privacy statement.