Data privacy statement for the applicant system


1. Introduction

Definitions according to Art. 4 GDPR

In this privacy policy, we use, among other things, the following terms:

personal data

Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

affected person

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

Controller or data controller

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law.

Data processor

A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient

A recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not considered recipients.

Third

A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Profiling

Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

Pseudonymization

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Responsibilities

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

ORGATEX GmbH

Management: Jürgen May, Patrick Mueller

Albert-Einstein-Str. 19
40764 Langenfeld
Germany

Contact:
Telephone: +49 2173 1064-0

Fax: +49 2173 1064-50
Email: info@orgatex.de

The following person has been appointed as data protection officer:

Markus Kowall

IT Südwestfalen AG

Kalver Street 23

58515 Lüdenscheid

Tel. +492351-67257300

Email: datenschutz@itswf.citadelle.ag

3. Legal basis for processing

Below we inform you about the legal basis for the processing of personal data:

  • Article 6 paragraph 1 letter a) GDPR (in conjunction with Section 25 paragraph 1 TTDSG) serves as the legal basis for our company for processing operations where we obtain consent for a specific processing purpose.
  • If the processing of personal data is necessary for the performance of a contract, then Article 6(1)(b) GDPR serves as the legal basis. Processing purposes for this purpose may include, for example, the delivery of goods, the provision of services, or processing operations for carrying out pre-contractual measures, such as inquiries about our products or services.
  • If our company is subject to a legal obligation which necessitates the processing of personal data, such as for the fulfillment of tax obligations, the processing is based on Art. 6 para. 1 lit. c) GDPR.
  • The processing of personal data may also be necessary to protect the vital interests of the data subject or another natural person. In these cases, the processing is based on Article 6(1)(d) GDPR.
  • Processing based on Article 6(1)(f) GDPR serves to protect the legitimate interests of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override those interests. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator. The legislator took the view that a legitimate interest could be assumed if you are a customer of our company (Recital 47, second sentence, GDPR).

4. Storage duration

We adhere to the principles of data avoidance and data minimization. Therefore, we only store your personal data for as long as is necessary to achieve the purposes stated here or as required by the various retention periods stipulated by law. Once the respective purpose ceases to apply or these periods expire, the corresponding data is routinely blocked or deleted in accordance with legal regulations, unless it is still required for contract fulfillment or initiation.

5. Data transfer to third parties

Your personal data will not be transmitted to third parties for purposes other than those listed below.

We only share your personal data with third parties if:

  • consent exists in accordance with Art. 6 para. 1 lit. a) GDPR,
  • The transfer is permissible under Article 6(1)(f) GDPR for the purposes of our legitimate interests and there is no reason to assume that you have an overriding legitimate interest in not having your data transferred,
  • in the event that there is a legal obligation to disclose the data pursuant to Article 6(1)(c) GDPR, as well as
  • This is legally permissible and necessary for the performance of a contract with you in accordance with Article 6(1)(b) GDPR.

Notice regarding the processing of your data collected on this website in the USA by third-party services and content

As part of the processing operations described here, it is possible that personal data may be transferred to the USA. The European Court of Justice describes the USA as a country with an inadequate level of data protection according to EU standards (ECJ: Schrems II ruling). Your data could be accessed and processed within the USA by institutions such as US authorities without further oversight. We have no control over these processing activities. To protect your data, we have concluded data processing agreements based on the European Commission's Standard Contractual Clauses. If the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Art. 49 para. 1 lit. a) GDPR can serve as the legal basis for the transfer to third countries. This does not apply, however, to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

6. Data protection in applications and the application process

The data controller collects and processes the personal data of applicants for the purpose of processing the application. Processing may also be carried out electronically. This is particularly the case when an applicant submits application documents electronically, for example, by email or via a web form on the website. If the data controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If the data controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted two months after notification of the rejection decision, unless other legitimate interests of the data controller preclude deletion. A legitimate interest in this sense is, for example, the need to retain evidence in proceedings under the German General Equal Treatment Act (AGG).

The legal basis for processing your data is Art. 88 GDPR in conjunction with § 26 para. 1 BDSG.

7. Technology

  • SSL/TLS encryption

For security reasons and to protect the transmission of confidential information that you send to us as the website operator, our website uses SSL or TLS encryption. This means that data you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the "https://" in your browser's address bar and the padlock icon in the browser bar.

  • Server log files

The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. This may include the following data:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of server request
  • IP address

This data is not combined with other data sources. It is required to display the content of our website correctly, to ensure the continued functionality of our IT systems, and to facilitate cooperation with law enforcement agencies in the event of a cyberattack. The legal basis for this data processing is Article 6(1)(f) GDPR.

8. Use of cookies

This website uses so-called cookies. Cookies are text files that are placed and stored on a computer system via an internet browser.

Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that allows websites and servers to associate the cookie with the specific web browser in which it was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from other web browsers that contain different cookies. A specific web browser can be recognized and identified via the unique cookie ID.

By using cookies, we can provide users of this website with more user-friendly services that would not be possible without setting cookies. We also use cookies to statistically analyze the use of our website and to evaluate our services for optimization purposes. These cookies allow us to automatically recognize that you have visited our website before when you return. These cookies are automatically deleted after a defined period. The specific storage duration of the cookies can be found in the settings of the consent tool used.

The data processed by the cookies, which are required for the proper functioning of the website, are therefore necessary to protect our legitimate interests and those of third parties in accordance with Art. 6 para. 1 lit. f) GDPR.

For all other cookies, you have given your consent via our opt-in cookie banner in accordance with Art. 6 para. 1 lit. a) GDPR.

  • Consent Tool

This website uses the CookiesYes plugin from Mozilor Limited, 3 Warren Yard, Wolverton Mill, Milton Keynes, England, MK12 5NW, United Kingdom (“CookieYes”) to store your cookie consents and document them in accordance with data protection regulations.

When you visit our website, a connection is established to CookieYes' servers to set your cookie preferences. CookieYes then stores a cookie in your browser to associate your preferences. This data is stored by CookieYes until you withdraw your consent, delete it yourself, or the purpose for which it was stored no longer applies. Mandatory legal retention obligations remain unaffected.

Details regarding CookieYes' data processing can be found at https://www.cookieyes.com/privacy-policy/

Legal basis: Art. 6 para. 1 lit. c) GDPR

9. Presence on social networks

To offer you a way to communicate with us, we are present on certain social networks. When you visit a page provided via these networks, we are jointly responsible with the provider of the respective platform for the processing operations triggered thereby, in accordance with Article 26 GDPR.

We are not the original provider of these pages, but merely use them within the framework of the possibilities offered to us by the respective providers.

We would therefore like to point out that user data may be processed outside the European Union without our being able to influence this.

The processing of personal data is based on legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. If you, as a user, are required to give your consent to data processing to the respective providers, the legal basis is Art. 6 para. 1 lit. a) GDPR in conjunction with Art. 7 GDPR.

Data protection-related inquiries should be directed to the respective platform providers.

A list of providers is provided below:

  • Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), Facebook Pages based on a joint controllership agreement – ​​Privacy Policy: https://www.facebook.com/about/privacy/, Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com
  • LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn).
    If you wish to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
    Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.
    For details on how LinkedIn handles your personal data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy .
  • Xing (New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany).
    For details on how they handle your personal data, please refer to XING's privacy policy: https://privacy.xing.com/de/datenschutzerklaerung .
  • Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).
    Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.
    For details on how they handle your personal data, please see Instagram's privacy policy: https://help.instagram.com/519522125107875 .
  • YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
    For details on how they handle your personal data, please refer to YouTube's privacy policy: https://policies.google.com/privacy?hl=de .
  • Pinterest (Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA).
    For details on how Pinterest handles your personal data, please see their privacy policy: https://policy.pinterest.com/de/privacy-policy

10. Analysis tools

  • Google Analytics

Our website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows website operators to analyze the behavior of website visitors. The website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user's origin. This data is assigned to the respective user's device. It is not linked to a device ID.

Furthermore, we can use Google Analytics to record your mouse movements, scrolling, and clicks, among other things. Google Analytics also uses various modeling approaches to supplement the collected data and employs machine learning technologies for data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to and stored on a Google server in the USA.

The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and 25 para. 1 TTDSG. You can withdraw your consent at any time. Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs

This plugin allows us to create anonymized statistics about your visit to our website. This includes, among other things, the duration of your visit, the number of visitors, and visits to subpages.

For example, the following data is collected:

  • Address of the accessed website
  • Address of the previously visited website
  • Browser type and browser version
  • Hostname and IP address of the accessing device
  • Date and time of access
  • Clicks on the website

This data will not be shared.

Storage duration

The data will be stored locally on our web server until it is no longer needed for the purposes mentioned above.

The legal basis is the granting of your explicit consent in accordance with Art. 6 para. 1 lit. a) GDPR.

  • WP Statistics

Our website uses "WP Statistics". This is a WordPress tool that statistically analyzes visitor traffic. The provider of "WP Statistics" is Veronlabs, 5460 W Main St, Verona, NY 13478, United States.

This plugin allows us to create anonymized statistics about your visit to our website. This includes, among other things, the duration of your visit, the number of visitors, and visits to subpages.

For example, the following data is collected:

  • Address of the accessed website
  • Address of the previously visited website
  • Browser type and browser version
  • Hostname and IP address of the accessing device
  • Date and time of access
  • Clicks on the website

This data will not be shared.

Storage duration

The data will be stored locally on our web server until it is no longer needed for the purposes mentioned above.

The legal basis is the granting of your explicit consent in accordance with Art. 6 para. 1 lit. a) GDPR.

  • Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager is a tool that allows us to integrate tracking and analytics tools and other technologies into our website. The Google Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It serves solely to manage and deploy the tools integrated through it. However, the Google Tag Manager does collect your IP address, which may also be transferred to Google's parent company in the United States.

The use of Google Tag Manager is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the quick and easy integration and management of various tools on their website. If corresponding consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

  • Facebook Pixel

For conversion tracking purposes, our website uses the so-called Facebook Pixel. The provider is Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”).

This allows us to track website visits resulting from clicks on Facebook ads. This analysis enables us to continuously improve and optimize our advertising. The data collected for this purpose is anonymized and does not allow us to personalize the experience.

If you have a Facebook user account and perform the click while logged in, Facebook may be able to draw conclusions about you personally.

We, as the website operator, have no control over this use of the data.

Further information can be found in Facebook's privacy policy:

https://www.facebook.com/about/privacy/. You can also deactivate the "Custom Audiences" remarketing feature in the ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged into Facebook to do this. If you do not have a Facebook account, you can deactivate Facebook's interest-based advertising on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/ .

  • LinkedIn Insight Tag

When you visit our website, a so-called LinkedIn Insight Tag is set through the integration of LinkedIn. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.

This insight tag collects data such as:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of server request
  • IP address

LinkedIn anonymizes this data and automatically deletes it after 90 days. The collected data does not allow for any personal identification.

For more information, please visit: https://www.linkedin.com/help/linkedin/answer/a427660

and in LinkedIn's privacy policy: https://de.linkedin.com/legal/privacy-policy .

11. Advertising

  • Google AdWords (Google Ads) / Google Remarketing

Our website uses “Google Ads”. The provider of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

This allows us to use Google search results for advertising purposes.

Technically, this is achieved through the use of cookies in your browser, which are set by Google. The data collected is pseudonymized by Google.

The legal basis is the granting of your explicit consent in accordance with Art. 6 para. 1 lit. a) GDPR.

You can view Google Ads' privacy policy and further information at: https://www.google.com/policies/technologies/ads/

12. Plugins and other services

  • Google Web Fonts

Our website uses web fonts provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to ensure consistent font display. When you access a page, your browser loads the necessary web fonts into its cache to display text and fonts correctly.

For this purpose, your browser must connect to the servers hosting the fonts. These are generally our own servers, so third parties like Google typically do not have access to your personal internet data for this purpose. However, due to the use of a content management system on our site, various plugins are integrated, some of which nevertheless establish a connection to Google and load the fonts from there. This allows Google to know that our website was accessed via your IP address.

The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f) GDPR.

Further information about Google Web Fonts and Google's privacy policy can be found at: https://developers.google.com/fonts/faq; https://www.google.com/policies/privacy/ .

  • Google Maps

Our website uses the Google Maps service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This is a web service for displaying interactive maps. Using this service, we can, for example, show you our location to help you find us.

When you access pages on our website that include a Google Maps map, information about your use of our website (such as your IP address) is transmitted to and stored on Google servers. This may also involve transmission to the servers of Google LLC in the USA. This occurs regardless of whether you have a Google account and are logged in. If you are logged into Google, your data will be directly associated with your account. If you do not want this association with your Google profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and analyzes them. The collection, storage, and analysis are carried out in accordance with Article 6 Paragraph 1 Letter f) GDPR based on Google's legitimate interest in displaying personalized advertising, conducting market research, and/or designing Google websites to meet user needs. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

To prevent unauthorized and uncontrolled data flow from the moment you visit our website, we implement the integration of the plugin using a so-called 2-click solution. This means that Google Maps is only permitted to set cookies or receive information about your visit to our website if you have actively clicked on the plugin to display the map. By visiting our website without your confirmation via the 2-click solution, no data is transmitted to Google. The legal basis for the data transfer to Google is your consent pursuant to Art. 6 para. 1 lit. a), 7 GDPR.

You can view Google's terms of service at https://www.google.de/intl/de/policies/terms/regional.html, and the additional terms of service for Google Maps at https://www.google.com/intl/de_US/help/terms_maps.html

Detailed information on data protection in connection with the use of Google Maps can be found on Google's website ("Google Privacy Policy"): https://www.google.de/intl/de/policies/privacy/

13. Rights of the data subject

  • Right of access of the data subject pursuant to Art. 15 GDPR: Information about your data stored by us and its processing,
  • Right to rectification pursuant to Art. 16 GDPR: Rectification of inaccurate personal data,
  • Right to erasure pursuant to Art. 17 GDPR: Erasure of your data stored with us,
  • Right to restriction of processing pursuant to Art. 18 GDPR: Restriction of data processing if we are not yet permitted to delete your data due to legal obligations,
  • Right to data portability pursuant to Art. 20 GDPR: Data portability if you have consented to the data processing or have concluded a contract with us,
  • Right to object pursuant to Art. 21 GDPR: You may object to the processing of your data by us.
  • Revocation of consent under data protection law: Consent to the processing of personal data can be revoked at any time with effect for the future and
  • Complaint to a supervisory authority: You may lodge a complaint with a data protection supervisory authority regarding our processing of personal data.