VEDA® Group
Privacy and the Processing of Personal Data in the Hiring Process
Data Controller
The entity responsible for processing your personal data as part of the application process is: VEDA Group Holding GmbH Carl-Zeiss-Straße 14 52477 Alsdorf Data Protection Officer You can contact our Data Protection Officer at: datenschutz@veda.net
Processing of Your Personal Data
As part of the application process, we process personal data that you provide to us as part of your application or that we lawfully collect about you during the application process. This may include, in particular: - personal information such as your name and contact information; - details about your professional background and work experience to date; - Information regarding your education, qualifications, language skills, competencies, and other professional abilities; - Information and documents from your application, in particular your resume, cover letter, certificates, and other supporting documents; - Information you provide to us during interviews, phone calls, or other conversations, as well as throughout the rest of the application process; - Results of selection or aptitude procedures, if such procedures are conducted; - Information regarding any required residence or work permits, to the extent that this is necessary for employment; - Other personal data that you voluntarily provide to us as part of the application process. To the extent that it is necessary for assessing your professional qualifications and legally permissible, we may also take into account information from publicly available professional sources, such as professional online networks. Which personal data is processed in each individual case depends, in particular, on the specific vacant position and the course of the application process. As a general rule, we process only data that is necessary for the respective purposes or that you voluntarily provide to us. To the extent that special categories of personal data within the meaning of Article 9(1) of the GDPR are processed as part of the application process, this is done exclusively where there is a corresponding legal basis or valid consent.
Purposes and Legal Bases for Processing
We process your personal data, in particular, to conduct the application process, to assess your suitability for the advertised position, and to decide whether to establish an employment relationship. This is done, in particular, on the basis of Article 6(1), first sentence, letter b) of the GDPR in conjunction with Section 26(1), first sentence of the BDSG. To the extent necessary, we process particularly sensitive personal data on the basis of Article 9(2)(h) of the GDPR in conjunction with Section 22(1)(1)(b) of the BDSG. Sanctions List Screening: To the extent that this is relevant or necessary in the specific application process, we conduct an internal screening against relevant sanctions lists—in particular financial sanctions lists and terrorist lists—prior to establishing an employment relationship. The processing of personal data is based on Section 26(1) of the BDSG, to the extent that it is necessary for the decision regarding the establishment of the employment relationship. Background Check: We conduct a background check for new hires and internal promotions or appointments to certain management positions. This serves to verify integrity and identify potential conflicts of interest, as well as to ensure compliance with legal and internal corporate compliance requirements. The background check is conducted only shortly before the relevant decision is made and applies only to the group of individuals relevant to that decision. The processing of personal data is based on Section 26(1) of the Federal Data Protection Act (BDSG), to the extent that it is necessary for the decision regarding the establishment of the employment relationship.
Obligation to Provide Data
Providing the personal data necessary to process your application and make a decision regarding the establishment of an employment relationship is required to carry out the application process. If you do not provide the required personal data, this may result in our inability to process your application, either in whole or in part. The provision of any additional data is generally voluntary.
Recipients of Your Data
Companies within the VEDA Group Within VEDA Group Holding GmbH, your data is shared with those departments that need it to carry out the application process (data controller as defined by data protection law). This includes, in particular, the relevant employees in the Human Resources department, the managers responsible for the respective position, and other individuals involved in the selection process. VEDA Group Holding GmbH is part of the VEDA Group. Data will only be transferred and further processed within the VEDA Group to the extent that this is necessary and there is an appropriate legal basis under data protection law. To the extent that companies within the VEDA Group process personal data independently for their own purposes, they are each the data controller for such processing within the meaning of the GDPR. Data Processors In addition, we engage service providers who assist us in conducting the application process. These include, in particular, providers of applicant tracking systems as well as, where applicable, other service providers who assist us with selection and suitability procedures as part of the application process. To the extent that these service providers process personal data on our behalf and in accordance with our instructions, such processing is based on a data processing agreement pursuant to Article 28 of the GDPR. The data processors are not authorized to use the personal data for their own purposes. Other Recipients In addition, personal data may be transferred to other recipients to the extent that this is necessary for the application process and permitted under data protection law. This may include, for example, government agencies, courts, legal advisors, or other consultants bound by a duty of confidentiality.
Data Transfer to Third Countries
Your personal data is generally processed in Germany or within the European Union or the European Economic Area (EU/EEA). Transfers to third countries may occur in individual cases, particularly in connection with the processors we engage. To the extent that such a transfer is necessary, we ensure that the applicable data protection requirements—in particular those under Art. 44 et seq. of the GDPR—are complied with and that appropriate safeguards are in place to ensure an adequate level of data protection. It is the VEDA Group’s policy, in accordance with its internal guidelines, to prioritize processing within the European Union or the European Economic Area (EU/EEA) whenever possible.
Automated Decision-Making
No automated decision-making, including profiling, pursuant to Article 22 of the GDPR will take place in connection with your application.
Retention Periods, Retention and Deletion Deadlines
As a general rule, we store your personal data only for as long as is necessary to complete the application process or until any consent you have given is revoked. If your application is unsuccessful, we generally store your application documents for up to six months after the application process is completed, unless longer storage is necessary to assert, exercise, or defend legal claims. If you have expressly consented to the inclusion of your data in our applicant or talent pool, we may store your application data for the period specified in your consent so that we can consider you for future job openings. You may revoke this consent at any time with future effect. This will not result in any disadvantages for you as an applicant. Upon expiration of the respective retention period, your personal data will be deleted or destroyed in accordance with data protection regulations, provided that no statutory retention obligations or other legal grounds preclude such deletion.
Your Rights
As a data subject, you have the right to - access the personal data stored about you, Art. 15 GDPR, - rectification of inaccurate or incomplete data, Art. 16 GDPR, - erasure of personal data, Art. 17 GDPR, - restriction of processing, Art. 18 GDPR, - data portability, Art. 20 GDPR, - the right to object to processing, Art. 21 GDPR, - the right to withdraw consent that has already been given with effect for the future, Art. 7(3) GDPR, - the right to lodge a complaint with a supervisory authority, Art. 77 GDPR. To exercise these rights, you can contact us at any time at Humanresources@veda.net. Of course, you have the right to withdraw your application at any time. Please send general questions regarding data protection to datenschutz@veda.net.