Data protection notice

I. Scope

The following information relates to the Processing of Personal Data from you as a job applicant and/or employee in the context of the use of our HR management software Personio (Data Subject and hereinafter referred to as “you” / “your”).

II. Definitions

For the purpose of this data protection information, the terms listed in this section II., when used in their capitalized form, shall have the meaning set forth below

“GDPR” means General Data Protection Regulation (Regulation (EU) 2016/679).

“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Art. 4 sec. 1 GDPR).

“Processing” means any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 sec. 7 GDPR).

“Data Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law (Art. 4 sec. 7 GDPR).

‘Data Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing (see Art. 4 sec. 9 GDPR).

III. Data Controller and data protection officer

1. Data Controller

Unless otherwise specified in this Data Protection Information, the Controller for the processing of your Personal Data is:

Banxware GmbH
Invalidenstraße 117
10115 Berlin
info@banxware.com
hereinafter referred to as “Banxware”, “we” or “our”.

2. Data protection officer
Banxware has appointed a data protection officer which can be contacted under:

Data Protection Officer

Banxware GmbH

Invalidenstraße 117

10115 Berlin

Email: datenschutz@banxware.com

IV. Situations, purposes and legal bases of Processing your Personal Data
1. Registration on / login to HR management software

We are Processing your username, password and email address when you register for and login to your user account on our HR management software (Legal base(s): Necessary Processing in order to take steps at the request of the Data Subject prior to entering into contract, Art. 6 (1) 1 lit. b GDPR / Necessary Processing for the purpose of recruitment, Art. 88 GDPR in conjunction with § 26 (1) 1 BDSG).

3. Job application handling

We are processing your Personal Data like your contact data (e.g. first and last name, address, phone number and email address) and the provided job application data (e.g. information on job and work history, education, language fluency etc.) to handle your job application, which i.a. includes reviewing your job application, set up job interviews, deciding on a job offer, negotiating and preparing of an employment contract (Legal base(s): Necessary Processing in order to take steps at the request of the Data Subject prior to entering into contract, Art. 6 (1) 1 lit. b GDPR / Necessary Processing for the purpose of recruitment, Art. 88 GDPR in conjunction with § 26 (1) 1 BDSG).

4. Reference/Background checks

Where necessary to verify the information provided in your application, we may use your personal data to carry out reference checks, for example by visiting your LinkedIn profile. In light of our position as an obligated party under the German Money Laundering Act, background checks, including criminal record checks, checks against EU anti-terrorism lists/sanctions lists/PEP lists and/or credit checks may also be carried out to ensure that there are no facts indicating that you are not suitable for the position in question (Legal base(s) i.a.: Necessary Processing to comply with legal obligations under the Money Laundering Act and the European Anti-Terrorism Regulations 2580/2001 and 881/2002, for our legitimate interests and to carry out pre-contractual measures (e.g. verification of information / prevention of risks in the area of property and criminal law): Art. 6 (1) lit. b, c, f GDPR), Art. 88 GDPR in conjunction with § 26 (1) 1 BDSG).

6. Candidate Pool

If you have given your prior consent, we keep your personal data in our candidate pool and may inform you about other potentially suitable job advertisements, even if the application for the specific position for which the data were originally collected was unsuccessful.

Your consent can be withdrawn at any time by via email to info@banxware.com. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal (Legal base: Processing based on consent, Art. 6 (1) 1 lit. a GDPR)

7. Time Tracking
If you are an employee, we are processing your attendance and absence times and their reasons (such as working hours, vacation, illness, business trips, maternity leave, parental leave, etc.) to document and monitor compliance with contractual and/or legal rights and obligations (e.g. working hours, salary, vacation, continued payment of wages in case of illness, etc.) (Legal base(s): Necessary Processing for the performance your employment contract, Art. 6 (1) 1 lit. b GDPR; Art. 88 GDPR in conjunction with § 26 (1) 1 GDPR / Necessary Processing for compliance with legal obligations, Art. 6 (1) 1 lit. c GDPR in conjunction with i.a. Arbeitszeitgesetz, Bundesurlaubsgesetz, Entgeltfortzahlungsgesetz etc.).

V. Categories of Data Recipients

Your Personal data is disclosed internal, especially to the employees responsible for human resources.

Your Personal Data is also disclosed to our external service providers which provide the tools and platforms used in our recruitment process and which process your Personal Data on our behalf as Data Processors.

For background checks described under section IV. 4. Personal Data might also be transferred to the entities involved in performing the background checks (e.g. credit agencies).

VI. Storage periods

In case of a rejection of your application, your applicant account and your provided Personal Data will be deleted or anonymized 6 months after receiving the rejection, unless you have consented to be included in our talent pool. In the latter case, your Personal Data (including your applicant account) will be deleted upon request (e.g. withdrawal of your consent) or automatically 6 months after consent has been received.

In case of an employment, your Personal Data in your applicant account will be migrated to an employee account.

Your employee account including all Personal Data in it will be deleted in 10 years after your leaving. During this period, processing of your retained Personal Data is restricted from Processing for purposes other than the fulfilment of post-contractual obligations, the establishment, exercise or defense of legal claims from or against you and accounting and tax audits.

VII. Your data protection rights

In accordance with the applicable data protection regulations, you have the following rights concerning your Personal Data processed by us:

Right of access (Art. 15 GDPR),
Right to rectification (Art. 16 GDPR),
Right to erasure (“Right to be forgotten”) (Art. 17 GDPR),
Right to restriction of Processing (Art. 18 GDPR) and
Right to data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR)

In cases we are Processing your Personal Data according to section IV. of this Data Protection Information on the basis of our legitimate interests pursuant to Art. 6 sec. 1 lit. f GDPR, you have the right to object to the respective Processing at any time on grounds relating to your particular situation. We will then no longer process your data for this / these purpose(s) unless our legitimate interests in processing overweights or the processing serves to establish, exercise or defend legal claims (Art. 21 sec. 1 GDPR).

Please direct your requests to exercise these rights by email to info@banxware.com. To handle your request and for authentication we will also process Personal Data from you. Your request and our answer will be stored for up to three years (Legal base: Necessary Processing for compliance with legal obligation, Art. 6 (1) 1 lit. c GDPR) / Necessary Processing for our legitimate interest (i.a. accountability; establishment, exercise or defence of legal claims), Art. 6 (1) 1 lit. f GDPR)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Spontaneous Application / Initiativbewerbung

We are looking forward to hearing from you!

Documents