March 29th, 2019
The following is to inform you about how we handle your personal data when you apply for employment with KuppingerCole Analysts AG
1. Name and contact details of the data processing controller
The controller for the processing of personal data, within the meaning of Art. 4 (7) of the General Data Protection Regulation (GDPR), is:
KuppingerCole Analysts AG
Wilhelmstr. 20-22
65185 Wiesbaden
Germany
Contact details for our Data Protection Officer:
Oscar Hernandez
KuppingerCole Analysts AG
Oscar.hernandez@kuppingercole.com
Our contact details for data protection matters:
KuppingerCole Analysts AG
Wilhelmstr. 20-22
65185 Wiesbaden
Germany
2. What personal data do we process and where does it come from?
We process the personal data you make available to us as part of your application, whether by sending the application documents and/or by the details you provide in job interviews. We receive your application documents either directly from you personally (by post or e-mail) or, if you apply via an online application platform (e.g. Stepstone) or via recruitment agencies, from them. We may also visit your profile on professionally oriented networks such as Xing and LinkedIn and may receive personal data from them.
In particular, we process your contact data (surname, first name, address, telephone number, email address) and information about your professional experience and skills (professional career, performance appraisals, etc.). Applications are made to us voluntarily. The provision of the personal data noted above is essential for us to be able to determine if you are suitable for the position you have applied for and for us to be able to make a personnel selection.
Of course, no personnel selection and no application procedure can be carried out without the provision of such personal data by you as an applicant.
We may also process your application photo and/or information on religion or marital status if you have provided us with such data yourself, although you are not legally obliged to do so.
As a matter of principle, we do not process any special types of personal data in the sense of Art. 9 GDPR, unless you have given use your express consent for this. If you provide us with such data unsolicited, e.g. because you would like us to take legal particularities into account, we will ask you for your consent or delete this data or return the corresponding documents to you.
3. What do we process your personal data for?
We process the personal data noted above for the purpose of your application for employment, but only to the extent necessary to decide whether an employment relationship with us is needed. The legal basis for this is Section 26 (1) in conjunction with Section (8) sentence 2 of the German Federal Data Protection Act (BDSG) and Art. 6 (1) (b) GDPR.
Some data are not required within the meaning of Section 26 (1) BDSG and Art. 6 (1) (b) GDPR; these include, for example, an application photo and information on religion or marital status. If you provide us with such data, although you are not legally obliged to do so, we may process it on the basis of Art. 6 (1) (a) GDPR.
If you provide us with information about a serious disability, we process this data to fulfil legal obligations under labour law, social security law and social protection law. The legal basis for this is Art. 9 (2) (b) GDPR, Sec. 26 (3) BDSG and Sec. 164 of Volume 9 of the German Social Security Code (SGB IX).
Furthermore, we may process personal data about you to the extent necessary to defend ourselves against legal claims asserted against us in the application process. The legal basis for this is Art. 6 (1) (f) GDPR. The legitimate interest here is, for example, the burden of proof in proceedings under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz - AGG).
If an employment relationship between you and us is achieved, we may undertake further processing of the personal data you have already provided for the purposes of the employment relationship, if this is necessary for the performance or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of employee representation arising from legislation or collective bargaining agreement, works agreement or service agreement (collective agreement). The legal basis for this is Sec. 26 (1) BDSG and Art. 6 (1) (b) GDPR. Irrespective of this, we would like to point out that before the conclusion of an employment contract we will inform you in good time in our data protection policy for employees what personal data relating to you we process in your capacity as an employee before, during and after the implementation of the employment relationship.
4. Data disclosure
We treat your application and your personal data confidentially. Within KuppingerCole AG, only the departments and employees who need your data to fulfil the above-mentioned purposes will have access to it. As a rule, these are only employees in the HR department and, where applicable, the specialist department in which the position is to be filled.
If necessary, we also transfer your personal data to other companies in the KuppingerCole group of companies. This may be the case if a position is to be filled for another company in the KuppingerCole group of companies, but the application is processed by the central HR department of KuppingerCole AG for compelling, operational organizational reasons. The legal basis for such processing is Art. 6 (1) (f) GDPR. If data is disclosed to recipients in countries outside the European Economic Area, an appropriate level of data protection according to Art. 44 et seq. GDPR is guaranteed.
Finally, your data is passed on to public authorities, such as the German Federal Employment Agency, if there is a legal obligation to do so. The legal basis for such processing is Art. 6 (1) (c) GDPR.
5. How long do we save your data?
We retain your personal data for as long as we are required to do so under applicable laws and regulations and/or until we have achieved the purpose for which your personal data is being processed. This includes the following cases:
If an employment contract between you and us does not materialize, we will erase your personal data no later than 6 months after the end of the application process, calculated from the date either of the withdrawal of your application by you or our rejection.
Erasure will be carried out unless you agree for us to continue to store your personal data in order to contact you in the future and to continue the application process in the event that you may be considered for another position with us or another KuppingerCole company. The legal basis for such processing is Art. 6 (1) (a) GDPR. Your consent is voluntary. There are no advantages or disadvantages to the application process if you do not give such consent. Please also take note of the information provided in connection with a possible declaration of consent.
6. What rights do you have regarding the processing of your personal data?
You have the right:
- under Art. 15 GDPR, to obtain information about your personal data processed by us. In particular, you can obtain information on the purposes of the processing, the categories of personal data, the categories of recipients to whom your data has been disclosed, the envisioned retention period, the right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data, if not collected by us, and the existence of automated decision-making including profiling and, where appropriate, meaningful information about their details;
- under Art. 16 GDPR, to obtain without undue delay the correction and/or completion of incorrect or incomplete personal data stored with us;
- under Art. 17 GDPR, to obtain the erasure of your personal data held by us, unless the processing is required for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
- under Art. 18 GDPR, to obtain restriction of the processing of your personal data, where you dispute the accuracy of the data, the processing is unlawful, but you reject deletion of the data and we no longer need the data, but you require the data for the establishment, exercise or defence of legal claims or you have lodged an objection to processing in accordance with Art. 21 GDPR.
- under Art. 20 GDPR, to receive your personal data provided to us in a structured, commonly used and machine-readable format or to request their transmission to another controller;
- under Art. 7 (3) GDPR, to withdraw the consent, which you have already granted to us, at any time. As a result, we are not allowed to continue the data processing based on this consent with future effect, and
- under Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or of our company headquarters.
If you would like to exercise your rights as noted above, please use our data subject request form.
7. Right to object
If your personal data is being processed on the basis of legitimate interests in accordance with Art. 6 (1) (f) GDPR, you have the right, in accordance with Art. 21 GDPR to lodge an objection to the processing of your personal data. In the event of an objection, we will no longer process your data for these purposes, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims. You have the right under Art. 21 (2) and (3) GDPR to object without restriction to any form of processing for direct marketing purposes.
If you would like to exercise your right to object, please use our data subject request form..
8. Withdrawal of a declaration of consent
Insofar as we process your data on the basis of your consent, you have the right to withdraw your consent at any time. Your data will then no longer be processed for the purposes covered by the consent. Please note that the lawfulness of the data processing, which took place before the time of the withdrawal, is not affected by the withdrawal.
As a matter of principle, you can exercise your withdrawal in any manner. For example, use our data subject request form..
9. Validity and amendment of this data protection policy
This data protection policy is currently valid with effect from September 2018.
It may be necessary to change this data protection policy due to the further development of our internal processes or to changed legal or regulatory requirements. The current privacy policy can be downloaded at any time from our website and will be sent to you on request at any time free of charge.