Privacy Policy

The controller responsible for processing your personal data in connection with the application process is the specific company within the DERTOUR Group to which you are applying, or to which you are submitting a speculative application. In addition, DERTOUR Deutschland GmbH Recruiting and DERTOUR Group GmbH HR International Recruiting act as internal service providers for applicant management.

You can contact our Data Protection Officer, at any time:

DERTOUR Group GmbH 
Data Protection Officer / Data Protection Team
Emil-von-Behring-Straße 6  
60424 Frankfurt  

Email: datenschutz@dertour.com 

In the context of the application process, we process all required information necessary to handle your application, as well as any additional data you voluntarily provide.

If you provide personal data relating to third parties (e.g. in your role as a recruiter), you are responsible for ensuring that these individuals have consented and are informed about this data transfer and processing.

This may include the following data:

• Identification data: name, title, salutation, gender
• Nationality
• Contact data: email address, phone number, address
• CV including educational and professional background, references and certificates
• Hobbies and interests
• Application photo
• Salary expectations, earliest possible start date, how you found us
• Driving licence status
• Knowledge and skills, language proficiency
• Personal qualities relevant to the position
• Data from aptitude or assessment tests (e.g. personality and performance data)
• Publicly available data from professional social networks (e.g. Xing, LinkedIn)
• Data required to document your consent, e.g. for inclusion in our applicant pool
• Data you submit via web forms on websites managed by DERTOUR Group or in other forms of contact

You are not legally obliged to provide your data. However, the mandatory information is required for the application process. Without this data, we cannot process your application. If your application leads to an employment relationship with a company of DERTOUR Group, the information you provided during the application process will be forwarded to the responsible HR department.

5.1 Conducting the application process

You may apply online, via email, or by post. Data transmission through the online system is encrypted. Your data will be received by the relevant recruiting personnel, processed, and forwarded to the responsible department within the company.

Legal basis: Article 6(1)(b) GDPR and Section 26(1) Sentence 1 of the German Federal Data Protection Act (BDSG).

If an employment contract is concluded, we will continue to process your data for purposes related to the employment relationship.

Legal basis: Article 6(1)(b) GDPR and Section 26(1) BDSG.

 5.2 Defence against legal claims 

We process your data where this is necessary to defend against legal claims arising from the application process. The legal basis is Article 6(1)(f) of the GDPR (balancing of interests), based on the legitimate interest of the respective company of the DERTOUR Group to which you are applying or submitting a speculative application, to defend itself in proceedings under the German General Equal Treatment Act (AGG), as well as in any other legal proceedings.

 5.3 Applicant pool (extended use of your application data) 

If your application does not match the requirements of the advertised position and/or there are several suitable candidates for a role, and your profile appears relevant for other positions within the DERTOUR Group, we may retain your data in our applicant pool.
If you consent to this, your data will be processed beyond the specific application procedure described in section 5.1. This allows recruiters from DERTOUR Group companies to contact you at a later stage regarding job opportunities that align with your qualifications and interests.
You will only be included in the applicant pool and considered for future positions if you have given your explicit consent.
The legal basis for this processing is Article 6(1)(a) GDPR (consent). Your data will be deleted six months after it has been added to the applicant pool.

5.4 Cookies  

Cookies are text files that are stored on the hard drive of your device. They allow information to be retained over a certain period and enable your device to be identified. We also use what are known as session cookies, which are automatically deleted when you close your browser. You can configure your browser to notify you whenever cookies are set. This way, the use of cookies becomes transparent to you. Important: If you completely disable the use of cookies, some features of our website may no longer function properly.

We use the following category of cookies on our website:

• Strictly necessary cookies

These cookies are essential to allow you to navigate the website and use its features. The legal basis for this type of data processing is a balancing of interests in accordance with Article 6(1)(f) GDPR, based on our legitimate interest in ensuring the functionality of the website.

5.5 Applicant feedback survey

Immediately after submitting your application via the online application tool, you will receive access to our feedback form via a link. In this form, we ask you about your experience with the application process.

Participation in the survey is voluntary. The data collected is processed in an anonymised or pseudonymised form (unless you actively enter personal data in the free-text fields) and is used solely to improve the quality of our recruitment process. The responses are processed without any link to your application documents.

The legal basis for this processing is our legitimate interest in improving the applicant experience, pursuant to Article 6(1)(f) GDPR.

5.6 Redirects to social media services

Our website contains links to the social media services Xing, LinkedIn and Instagram. You can recognise these links by the corresponding description. If you click on such a link, you will be redirected to the respective social media platform.

When you activate a link to a social media service, a connection is established with that service’s servers. This connection notifies the provider that you have visited our website. In addition, the following data may be transmitted to the provider:

• The URL of the website on which the activated link is located
• The date and time the website was accessed and the link was activated
• Information about the browser and operating system used
• Your IP address

If you are already logged in to the respective social media service at the time you activate the link, the provider may be able to identify your user account and, in some cases, your real name. This allows the provider to associate the visit to our website with your personal social media profile. You can prevent this association by logging out of your user account before activating the link.

You may also choose to share your applicant profile stored on such services with us as part of your application.

Legal basis: Section 25(1) of the German Telecommunications-Telemedia Data Protection Act (TTDSG) in conjunction with Article 6(1)(a) GDPR (consent).

Please note that the servers of social media services may be located in the United States or other countries outside the European Union. This means that your data may also be processed in jurisdictions that do not offer the same level of data protection as within the EU.

Please also be aware that we have no influence over the scope, nature, or purpose of the data processing carried out by the social media providers. For further information on how your data is processed, please refer to the privacy policy of the respective service.

Within the company of the DERTOUR Group to which you are applying or submitting a speculative application, only those individuals who require access to your data in order to perform their assigned duties will receive such access. This generally includes the recruiters responsible for the vacancy and the department in which the position is located.

If you have consented to be included in the applicant pool, the recruiters of DERTOUR Deutschland GmbH Recruiting and DERTOUR Group GmbH HR International Recruiting may also access your application data in order to contact you regarding suitable job opportunities within the DERTOUR Group.

In addition, service providers who support us in fulfilling our responsibilities may have access to your data. These service providers fall into the following categories:

• Hosting providers responsible for operating our servers
• Development service providers for programming, development, maintenance, and support of software applications, particularly the online application system
• Scanning service providers for the digitalisation of paper documents
• IT service providers supporting and delivering our services
• Providers of aptitude and pre-employment assessment tests
• Recruitment service providers supporting us in candidate selection
• Providers of electronic signature solutions

All service providers engaged by us are contractually bound to strict confidentiality obligations. They are granted access to your data only to the extent and for the duration necessary to perform their specific tasks.

We transfer your data to recipients located outside the territorial scope of the EU General Data Protection Regulation (GDPR) only in cases where no adequacy decision pursuant to Article 45(3) GDPR exists and no appropriate safeguards pursuant to Article 46 GDPR (including binding corporate rules) are in place – and only if the transfer is necessary:

• for the conclusion or performance of a contract with you, or for the implementation of pre-contractual measures at your request
• for the performance of a contract concluded in your interest between the controller and another natural or legal person
• for the establishment, exercise or defence of legal claims
• to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving consent
• if you have explicitly given us your consent

These data transfers are based on the derogations provided for under Article 49 GDPR.

Where data transfers outside the scope of the GDPR are carried out on the basis of our overriding legitimate interests or your explicit consent, such transfers are secured, inter alia, through the use of EU Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. Where necessary, these clauses are supplemented by additional contractual guarantees.

Further information is available upon request via the contact details provided in section 2.

We store your data for as long as it is necessary to reach a decision regarding your application. If no employment relationship is established, we may continue to store your data beyond this point where necessary for the defence of possible legal claims and/or if you have given your consent to be included in the applicant pool for the relevant purposes.

As a rule, your application documents will be deleted six months after the rejection decision has been communicated, unless longer retention is required due to legal disputes. If we conclude an employment contract with you, your data will be transferred from the online application system to our HR information system.

9.1 Right of access (Article 15 GDPR)

You have the right to obtain information about the personal data we process about you.

9.2 Right to rectification (Article 16 GDPR)

If your personal data is incorrect or no longer accurate, you may request its rectification. If your data is incomplete, you may request its completion.

9.3 Right to erasure (Article 17 GDPR)

You have the right to request the erasure of your personal data. Please note that this right only applies if there is a valid legal basis for the deletion and no statutory retention obligations prevent us from erasing your data.

9.4 Right to restriction of processing (Article 18 GDPR)

You have the right to request the restriction of the processing of your personal data. Please note that this right applies only if certain conditions are met that justify such a restriction.

9.5 Right to object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on our legitimate interests (Article 6(1)(f) GDPR).
In the event of a justified objection, we will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

9.6 Right to lodge a complaint (Articles 77 and 79 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you believe that your personal data is being processed unlawfully. A current list of the competent supervisory authorities can be found at:
https://www.bfdi.bund.de/EN/Service/Kontakt/kontakt_node.html

9.7 Right to data portability (Article 20 GDPR)

You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format.

9.8 Right to withdraw consent (Article 7(3) GDPR)

You have the right to withdraw your consent to the processing of your personal data at any time with effect for the future.
The easiest way to withdraw your consent is by contacting us using the contact details provided in section 2.
Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.