We are delighted that you are interested in employment with our company. The following information explains to you how we process your personal data in the course of handling your job application.

1. Who is responsible for the processing of your personal data?

quintessence consulting GmbH, Grosser Kolonnenweg 18C, 30163 Hanover (hereinafter: “we”), is responsible (the “controller”) within the sense of the EU General Data Protection Regulation (“GDPR”).

2. Contact for data protection for job applications

If you have any questions concerning the processing of your personal data and the exercise of your rights pursuant to the GDPR with respect to issues involving your job application, you may contact Gabriele Kremer for advice. You can reach her at the phone number 0511-64 664-133 or at the email address gkremer@quintessence.net.

3. For what purposes and on what legal grounds do we process personal data?

We process personal data concerning you for the purpose of processing your application for employment insofar as this is necessary for the decision regarding the establishment of an employment relationship with us. The legal basis here is Section 26 (1) in conjunction with Section 26 (8) second sentence BDSG [Federal Data Protection Act].

Moreover, we may process personal data concerning you insofar as this is necessary for the defence against legal claims asserted against us arising from the application process. The legal basis for this is point (f) of Art. 6 (1) GDPR; the legitimate interest in this case is, for instance, the onus of proof in proceedings based on the General Equal Treatment Act (AGG).

If and when an employment relationship is established between you and us, we may, in accordance with Section 26 (1) BDSG, process further the personal data we have received from you for the purposes of the employment relationship as required for the performance or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of the employees’ representatives pursuant to a law or collective bargaining agreement or a works or service agreement (collective agreement).

4. What categories of personal data do we process?

We process data that are related to your job application. They may include general data about your person (such as name, address and contact data), information about your professional qualifications and education or information about advanced professional training or any other information you provide to us as part of your job application. Moreover, we may also process professional information you have made publicly accessible such as a profile you have created in professional social media networks

5. What are other sources of personal data if we have not collected them from you?

Insofar as we do not collect the data directly from you and you have an active profile (e.g. at StepStone or similar services) or you have notified us of an inactive or only partially active profile, we may also obtain personal data from these sources.

6. What categories of data recipients are there?

We may transfer your personal data to service providers we have engaged insofar as this is permissible within the scope of the purposes and legal grounds described in point 3. In all other respects, personal data are processed on our behalf on the basis of contracts pursuant to Art. 28 GDPR, in particular by companies that assist us in the selection of employees.

7. Is there any intention to transfer data to a third country?

We do not intend to transfer any data to a third country.

8. How long are your data stored?

We store your personal data as long as this is necessary to make a decision regarding your job application. If and when an employment relationship between you and us is not established, we can continue to store your data insofar as this is necessary for the defence against possible legal claims. In this case, the application documents will be erased four months after announcement of the rejection decision insofar as longer storage is not required owing to legal disputes.

9. What rights do you have?

As a job applicant, you have the following data protection rights (depending on the situation in the specific case) that you may exercise at any time by contacting us or a data protection officer we have engaged and designated at the contact data given in points 1 and 2.

a. Access

You have the right to obtain information about your personal data we have processed and to request access to your personal data and/or copies of these data. This includes information about the purpose of the use, the category of the data used, the recipients of the data and the parties authorised to access the data and, if possible, the envisaged period of the data storage or, if this is not possible, the criteria for determining this period.

b. Rectification, erasure or restriction of the processing

You have the right to request from us the rectification without undue delay of any inaccurate personal data concerning you. You have the right to request the completion of any incomplete personal data — including by means of providing a supplementary statement — taking into account the purposes of the processing.

c. Right to object

Insofar as the processing of personal data concerning you is based on point (f) of Art. 6 (1) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of these data. We will no longer process these personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.

d. Right to withdraw consent

If the processing is based on your consent, you have the right to withdraw the consent at any time without prejudice to the lawfulness of the processing based on the consent prior to the withdrawal. You may at any time contact us or a data protection officer we have engaged and designated for this purpose using the aforementioned contact data.

e. Right to erasure

You have the right to request the erasure without undue delay of the personal data concerning you. We are then obligated to erase personal data without undue delay insofar as one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You object to the processing in accordance with point 8.c above and there are no overriding legitimate reasons for the processing.
• The personal data have been unlawfully processed.
• The personal data must be erased in compliance with a legal obligation in EU law or member state law to which we are subject.

The above provisions do not apply if and when the processing is necessary:

• For the fulfilment of a legal obligation that requires the processing in accordance with EU law or member state law to which we are subject;
• For the establishment, exercise, or defence of legal claims.

f. Right to restriction of processing

You have the right to request from us the restriction of processing if one of the following prerequisites has been met:

• You contest the accuracy of the personal data; the processing is restricted pending our verification of the accuracy of the personal data;
• The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
• We no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• You have objected to the processing pursuant to number 8.c above; the processing is restricted pending verification of whether our legitimate interests override yours.

• Where processing has been restricted pursuant to this point 9.c, these personal data may, with the exception of storage, be processed solely with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state.

If you have obtained restriction of the processing, we will notify you before the restriction is lifted.

g. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

10. Requirement to provide personal data

The provision of personal data is required neither by law nor by contract, nor are you obligated to provide the personal data. Nevertheless, the provision of your personal data is required for the consideration of your application as well as for the conclusion of a contract for employment with us. In other words, insofar as you do not provide personal data to us in your application, we will be unable to consider you among the applications and to establish an employment relationship with you.

11. No automated decision-making

There is no automated individual decision-making in the sense of Art. 22 GDPR; i.e. the decision about your application is not based on automated processing.