Data protection
Data protection
2. information about the responsible person and the data protection officer
Responsible for data processing on this website within the meaning of the Law on Church Data Protection (KDG) and other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:
Gemeinnützige Gesellschaft der Franziskanerinnen zu Olpe mbH Maria-Theresia-Str. 42 a 57462 Olpe Tel. 02761 9265-0.
3. the data protection officer of the controller is:
Benjamin Musial Non-profit Society of the Franciscan Sisters of Olpe mbH Maria-Theresia-Str. 42 a 57462 Olpe
data protection(at)gfo-online.de
Any data subject may contact our data protection officer directly with any questions or suggestions regarding data protection.
4. collection and processing of personal data
Personal data is any information about identified or identifiable natural persons. An identifiable person is one who can be identified directly or indirectly. This may include, for example, your name, your e-mail address or your IP address. In accordance with the principle of data economy, we aim to collect, process or use no or as little personal data as possible. Your personal data will not be passed on to third parties without your express consent. All personal data will be collected, processed and used in accordance with the applicable regulations for the protection of personal data.
5. legal bases for the processing of personal data
Insofar as we obtain your consent for processing operations of personal data, Section 6 (1) lit. b KDG is the legal basis for the processing of your personal data.
In the case of processing of your personal data that is necessary for the performance of a contract with you, Section 6 (1) c KDG is the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
If processing of personal data is necessary for the fulfillment of a legal obligation on our part, Section 6 (1) (d) KDG is the legal basis.
If processing is necessary to protect a legitimate interest on our part or on the part of a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Section 6 (1) lit. g KDG is the legal basis for processing.
6. collection of personal data when visiting our website
When you visit our website, we only collect the personal data that your browser automatically transmits to our web server and temporarily store it in a server log file. These are:
- Browser type and the version used
- Operating system
- Internet service provider
- IP address shortened by 3 digits
- Date and time of access
- Internet pages from which you have accessed our website
- Internet pages that are accessed by you via our Internet site
This data is not merged with other data sources. The collected data is only used to ensure the functionality of our website.
The legal basis for the processing of the aforementioned data is our legitimate interest according to § 6 para. 1 lit. g KDG.
The data will be deleted as soon as they are no longer required for processing purposes. Temporary data for the provision of our website is deleted as soon as the session is ended. Server log files are deleted after 14 days at the latest.
7. hosting
We use the following hoster for the provision of our website:
SUNZINET GmbH Schanzenstraße 23 51063 Cologne, Germany.
Our hoster is the recipient of your personal data and acts as an order processor for us. Our hoster only processes your personal data if this is necessary for the fulfillment of its contractual obligations and is subject to our instructions regarding your personal data. This corresponds to our legitimate interest within the meaning of § 6 para. 1 lit. g KDG, not to have to maintain a server on our premises ourselves, server location is Germany.
7. cookies
This website uses cookies. We use cookies to personalize content and ads, provide social media features, and analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected as part of your use of the Services.
Cookies are small text files used by websites to make the user experience more efficient. By law, we may store cookies on your device if they are strictly necessary for the operation of this site. For all other cookie types, we need your permission, which means that cookies categorized as necessary are stored on the basis of Art. § 6 para. 1 lit. g KDG are processed. All other cookies that are not necessary, i.e. those from the categories preferences and marketing, are processed on the basis of Art. § 6 para. 1 lit. b KDG processed. This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages. You can change or revoke your consent at any time from the cookie statement on our website.
9. consent management platform / consent management service
We use the consent management service Cookiebot, of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Usercentrics). This allows us to obtain and manage the consent of the users of the website for data processing. The processing is necessary to comply with a legal obligation (Section 8 (5) KDG) to which we are subject (Section 6 (1) d KDG). For this purpose, the following data is processed with the help of cookies:
- Your IP address (the last three digits are set to '0').
- Date and time of consent
- Browser information
- URL from which the consent was sent
- An anonymous, random and encrypted key
- Your consent status as proof of consent
The key and consent status are stored in the browser for 12 months using the "CookieConsent" cookie. This preserves your cookie preference for subsequent page requests. With the help of the key, their consent can be proven and traced.
The functionality of the website is not guaranteed without the processing. Usercentrics is a recipient of your personal data and acts as a processor for us. The processing takes place in the European Union. You can find more information about objection and removal options vis-à-vis Usercentrics at: https://www.cookiebot.com/de/privacy-policy/.
Your personal data will be deleted on an ongoing basis after 12 months or immediately after termination of the contract between us and Usercentrics. Please refer to our general statements about deleting and deactivating cookies above.
8. contact forms
You have the possibility to contact us via provided contact forms. In case of use, your entered data will be processed and stored for processing the request. The data will only be passed on to third parties with your consent. All mandatory data are marked in the respective contact form.
The data will be stored exclusively for processing your request. There will be no data transfer to third parties. The legal basis for the processing of your data entered in the contact form is § 6 para. 1 lit. b KDG.
The data you enter in the contact form will remain with us until the purpose of processing no longer applies (e.g. completion of processing) or until you revoke your consent to storage. In the event of a revocation, case processing cannot be continued.
9. newsletter
You have the possibility to subscribe to newsletters on our website. With newsletters, we inform you about our offers at regular intervals. When registering for newsletters, your personal data entered in the registration mask, your IP address and the date and time of registration are transmitted to us and stored by us.
The data is stored exclusively for sending the newsletter. There is no data transfer to third parties. The legal basis for the processing of your data is § 6 para. 1 lit. b KDG.
Your data will be stored as long as you receive the newsletter. You can unsubscribe from the newsletter at any time, for this purpose each newsletter contains a corresponding link.
10. online presence in social media
We are active within social networks in order to inform you about news in the GFO Group in this way as well.
User data may be processed by the service provider outside the European Union. This may result in risks for the users, because it could, for example, make it more difficult to enforce the rights of the users.
As a rule, the service provider processes user data for market research and advertising purposes. For example, the interests of users resulting from their usage behavior can be used, for example, to place advertisements within and outside the platforms that could correspond to the interests of the users. Cookies are usually stored on the users' computers for this purpose. In addition, data may also be stored in the usage profiles regardless of the devices used (especially if the users are members of the respective platforms and are logged in to them).
In the following, we inform you about the processing of your personal data carried out by us in the context of the online presences provided by us. In its ruling of June 5, 2018, the ECJ confirmed the joint responsibility of the service providers and the page operator.
The social media site you visit offers you the opportunity to respond to our posts, comment on them, create a user post yourself and send us private messages with personal concerns. The data you provide in this context and which may be accessible to us (e.g. user name, pictures, interests if applicable, contact data) will be used by us exclusively for the purpose of customer and interest communication. It is in our interest to provide you with a platform on which we can display up-to-date information and with the help of which you can address your request to us and we can respond to your request as quickly as possible.
GFO uses photos and video recordings for marketing purposes on social media platforms. Contained personal data are processed only with the consent of the data subject. Data subjects have the option to have the stored data deleted at any time. The data subject shall receive information about the personal data stored about him or her at any time. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or consent is revoked.
We do not carry out any further data processing apart from the basic functions by means of the site. Please note that the service provider may use tracking tools as well as cookies, regardless of our use of the site.
For a detailed description of the respective processing and the possibilities to object (opt-out), we refer to the information of the providers linked below.
Also in the case of requests for information and the assertion of user rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, then you can contact us.
Facebook: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland - Privacy Policy: https://www.facebook.com/about/privacy/, Opt-Out: https: //www.facebook.com/settings?tab=ads
LinkedIn: (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) - Privacy policy: https://www.linkedin.com/legal/privacy-policy, Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out,
Xing: (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) - Privacy Policy / Opt-Out: https://privacy.xing.com/de/datenschutzerklaerung
Instagram: (Instagram Inc., 1601 Willow Road, Menlo Parl, CA, 94025, USA) - Privacy Policy / Opt-Out: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect&__coig_consent=1
YouTube: (YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA, a Google Inc. company, Amphitheatre Parkway, Mountain View, CA 94043, USA. The responsible entity in Europe is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). - Privacy policy: https://policies.google.com/privacy
11. matomo
We use the open source software Matomo on our Internet pages to analyze and statistically evaluate the use of the Internet pages. Cookies are used for this purpose. The information about website usage obtained in this way is transmitted exclusively to our servers and summarized in pseudonymous Internet pages. We use the data to evaluate the use of the Internet pages. The data collected is not passed on to third parties. The IP addresses are anonymized (IP masking), so that an assignment to individual users is not possible.
If you consent to the analysis, the following data, for example, will be collected when individual pages of our website are called up:
- anonymized IP address
- Internet page called up
- length of stay
- clicks on the website
- Internet page from which the user accessed our Internet pages
- date and time
The processing of the data is based on § 6 para. 1 lit. b KDG. You can revoke your consent at any time by deleting the cookies in your browser or changing your privacy settings.
14. gina webmail service
For encrypted communication via e-mail we used the GINA webmail service. Registration is required before use. The information required for registration is marked with *.
The registration data you provide (hereinafter the "GINA data") will be processed by us in compliance with the provisions of applicable data protection law and solely for the purpose of registering you as a recipient and sender of confidential e-mails via GINA technology. Your GINA data will not be passed on to third parties. Your GINA data will only be stored by us until you instruct us in writing or by e-mail to irretrievably delete your registration and thus the GINA data. Please send your request for deletion of your GINA data to: support@gfo-its.de.
We expressly point out that after deletion of the GINA data you will no longer be able to access your confidential e-mails, which you have received and sent via GINA technology. If you still wish to access the contents of these confidential e-mails at a later date, we therefore recommend that you save copies of the e-mail texts using the "save as" command before requesting deletion.
Your registration is voluntary, you can always use another secure method of communication (e.g. correspondence by mail). The legal basis for the processing of your GINA data is § 6 para. 1 lit. b KDG.
Right of information and revocation, right of complaint and right to data portability, to restriction of processing, to correction and deletion.
You have the right at any time to receive information about your data stored by us and the purpose of storage. You can revoke your consent to the storage or use of your personal data in writing at any time. In addition to the revocation, you have the right to demand the correction as well as the restriction of processing and blocking or deletion of your data, insofar as this does not conflict with any legal obligation to retain data. In addition, you have the right to receive the data you have provided in a common machine-readable format for transmission.
You have the right to contact the competent supervisory authority for data protection in the event of violations of applicable data protection laws. You can reach the competent supervisory authority for data protection under the following contact details:
Katholisches Datenschutzzentrum - Körperschaft des öffentlichen Rechts Brackeler Hellweg 144 44309 Dortmund Phone: 0231/13 89 85-0 Fax: 0231/13 89 85-22 E-mail: info@kdsz.de
In addition, you have the right to receive the data you have submitted in a common machine-readable format for transmission.
If you have any questions regarding the processing of your personal data, you can also contact us directly (see responsible office and data protection officer). For all questions and requests for information, applications or complaints, you can also contact our data protection officer directly.
18 Online applications
Online applications in the facilities in the association of the Gemeinnützige Gesellschaft der Franziskanerinnen zu Olpe mbH are made via our career portal(https://gfo-online.career.softgarden.de/).
You can find the data protection information of the career portal here.
19. read aloud function (Read-Speaker)
Our website uses the read aloud function of the company ReadSpeaker, Princenhof park 13, 3972 NG Driebergen-Rijsenburg, The Netherlands. When activating the read aloud function, the selected text of the website is transmitted to the ReadSpeaker server with your IP address, where an audio file is generated and sent back to your IP address. Immediately after delivery of the audio file, the process and your IP address are deleted from the ReadSpeaker server. Your data will be processed exclusively in the EU.
When activating the read aloud function, technical cookies are stored on your used end device in order to retain the settings you have selected. The cookies are deleted after a maximum of 30 days.
The legal basis for offering a read aloud function is our legitimate interest (according to § 6 para.1 lit. g KDG) to provide you with an appealing user experience of our website. Data processing by ReadSpeaker only takes place when you use the read aloud function as a visitor to our website.
20. smart phone assistant
In some facilities, we use the telephone assistant of the provider Aaron GmbH, Schinkestr. 9, 12047 Berlin, to manage and process your requests (e.g. making appointments). With the telephone assistant, you can reach us at any time, even if we are looking after our patients or if you call us outside office hours. The telephone assistant will answer the phone and ask for the necessary information for your enquiry (e.g. making an appointment). You can also tell the telephone assistant how we can best reach you. Our practice team will receive this information on the computer and can contact you promptly - by telephone or text message - but only if the information requested in the dialogue has been provided (name, date of birth, request, health insurance). With the telephone assistant, your enquiry will be answered at any time and then processed by us in a targeted manner.
We have concluded an order processing agreement with Aaron.ai that fulfils the requirements of Section 29 KDG. Aaron.ai is legally and contractually obliged to maintain confidentiality and to protect your data. Data processing outside the European Union does not take place. After your request has been processed, your data will be deleted from the web-based application, but no later than 3 months after the process has been completed. Further information on data protection at Aaron.ai can be found in the provider's privacy policy at: https://www.aaron.ai/datenschutz
20. your rights as a data subject
You have the right at any time to receive information about your data stored by us and the purpose of storage. You can revoke your consent to the storage or use of your personal data in writing at any time. In addition to the revocation, you have the right to demand the correction as well as the restriction of processing and blocking or deletion of your data, insofar as this does not conflict with any legal obligation to retain data. In addition, you have the right to receive the data you have submitted in a common machine-readable format for transmission.
You have the right to contact the competent supervisory authority for data protection in the event of violations of applicable data protection laws. You can reach the competent supervisory authority for data protection under the following contact details:
Katholisches Datenschutzzentrum - Körperschaft des öffentlichen Rechts Brackeler Hellweg 144 44309 Dortmund Phone: 0231/13 89 85-0 Fax: 0231/13 89 85-22
E-mail: info@kdsz.de
22. online reception service 321 MED
Some websites use the online reception service 321 MED for digital, online-based communication and interaction between patients and healthcare facilities and/or medical practices. The service provider is 321 MED GmbH, Am heimlichen Grund 5, 92421 Schwandorf.
321 MED enables us to provide our patients with direct online care and to communicate quickly and easily with our patients. If you enter data, such as your contact details, on our website via our online reception for the purpose of communicating with us, this data will be stored on 321 MED's servers in Germany. Depending on the individual configuration and input, personal data and/or health data may be collected when using our online reception service.
The use of 321 MED is in the interest of an appealing presentation of our online offers and the provision of an immediate and fast service. This constitutes a legitimate interest; the legal basis is Art. 6 para. 1 lit. f GDPR. Data processing by 321 MED is carried out using the data provided/entered by you on the basis of your consent, Art. 6 para. 1 lit. a GDPR. If you provide optional data such as gender or health data, the data processing is based on your consent in accordance with Art. 9 para. 2 lit. a GDPR.
If you do not want your data to be transferred to 321 MED, you can revoke your consent to the processing of your personal data or health data at any time by sending us a message. If you withdraw your consent, your data will be deleted by us or by 321 MED. Please note, however, that in this case you may not (or no longer) be able to use all the functions of our online reception service. Data stored by us or 321 MED for other purposes will remain unaffected by this. The legality of data processing operations that have already taken place remains unaffected by the cancellation.
We have concluded a contract on order processing (AVV) with the provider 321 MED as required by data protection law. This is a contract that ensures that the respective provider processes the personal data of our website users only in accordance with our instructions and in compliance with the GDPR.
Further information on the data processed via 321 MED, as well as which cookies we use and how you can manage your cookie settings, can be found in 321 MED's privacy policy at https://321med.com/de/dataprotection.
23. iFrame content and consent
We use iFrames to display content from third-party providers within our website without the need to redirect to external pages. If embedded content sets cookies or uses comparable technologies or personal data is transmitted to the third-party provider, the integration only takes place after your consent (e.g. via our cookie banner). The legal basis is Art. 6 para. 1 lit. a GDPR (consent). The content will not be loaded without consent.
24. EyeAble Assist
On our website, we use “Eye-Able Assist”, a service provided by Eye-Able Web Inclusion GmbH, Florian-Geyer-Straße 1, 97076 Würzburg. The tool is designed to improve the accessibility of our website and enable users to customise the display and operation of the site.
According to the provider, Eye-Able Assist does not track any personal usage data and does not set any cookies. Individual settings made via the tool are stored in the local storage of the browser being used. This storage is carried out so that the selected display and operation options can be retained for a subsequent visit.
According to the provider, data processing takes place within the European Union. Further information on data processing by Eye-Able can be found in the provider’s privacy policy
25. Applicant Tracking System
Privacy Notice for the GFO Careers Page (karriere.gfo-online.de)
We attach particular importance to the protection and confidentiality of your personal data. To ensure the protection of your personal data, we have implemented technical and organisational measures to comply with data protection regulations. This privacy policy explains how we collect personal data as part of your application process and the purposes for which the data is processed. Your data will be processed in accordance with this privacy policy and the applicable data protection regulations.
This privacy policy applies to the careers portal and the applicant tracking system of the institutions within the Gemeinnützige Gesellschaft der Franziskanerinnen zu Olpe mbH (GFO) group.
a. Data processing on behalf of a controller
To ensure the efficient handling of application processes, we use an applicant tracking system provided by softgarden e-Recruiting GmbH, Tauentzienstr. 14, 10789 Berlin (contact: datenschutz@softgarden.de), which operates the applicant management system as a data processor within the meaning of Section 4(10) of the KDG. A contract for data processing in accordance with Section 29 of the KDG has been concluded with the provider, which ensures compliance with data protection regulations.
We remain your primary point of contact for exercising your rights as a data subject and for the handling of the application process. You may contact us directly using the details of the data controller provided above, or contact the Data Protection Officer in confidence.
b. Scope of data protection
The subject matter of data protection is the processing of personal data, in this case within the context of applicant management. According to Section 4(1) of the KDG, this includes all information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’) that is necessary for the conduct of the recruitment process and the establishment of an employment relationship.
In addition, when using the applicant management system, data relating to its use – known as usage data – is also collected. Usage data comprises data necessary for the operation of our websites, such as details regarding the start, end and scope of use of our website, including, for example, login details. This processing complies with the provisions of data protection and telemedia law.
As part of the application process and/or the use of the system, processing activities may also take place which are carried out either on the basis of a legitimate interest pursuant to Section 6(1)(g) of the KDG or on the basis of your consent pursuant to Section 6(1)(b) of the KDG. Processing activities may also be carried out where there is a legal obligation to process data or where there is a public interest, as set out in Section 6(1)(d) and (f) of the KDG, such as in the context of criminal prosecution or investigations by public authorities. You can determine and control the extent of the processing yourself through individual settings in your web browser, the configuration of the relevant cookie settings, and your user behaviour.
c.1. Application process
As part of the application process, once you have set up a username and password, you can create and manage an account on the careers portal. In addition to submitting a one-off application, you can make use of further options within the softgarden applicant tracking system and configure your individual settings (e.g. inclusion in a talent pool).
To ensure your application is efficient and successful, you can provide the following information as part of your application to us:
- Contact details (e.g. address, email, telephone number)
- CV details (e.g. education, vocational training, work experience, language skills)
- Social media profiles (e.g. XING, LinkedIn, Facebook)
- Documents relating to applications (e.g. application photos, cover letters, certificates, employment references, work samples, etc.)
The legal basis for processing data for the purposes of conducting the recruitment process and establishing an employment relationship is Section 53(1) of the KDG. Furthermore, the use of the applicant tracking system by the data controller is in its legitimate interests pursuant to Section 6(1)(g) of the KDG. If consent within the meaning of Section 6(1)(b) is required for a specific processing activity, this will be obtained from you separately and transparently by the data controller, provided that such consent does not already follow from your own clear and voluntary conduct in accordance with the principle of transparency, such as voluntary participation in a video interview.
c.2. Disclosure of data
Your data will not be disclosed to unauthorised third parties as part of the applicant management process and will be processed for the purposes set out in this privacy policy. For instance, access by internal departments and specialist managers of the data controller is in the legitimate interest of the data controller, insofar as knowledge of the information from the application process is necessary and permissible for the selection of candidates or for the company’s internal administrative purposes. For this purpose, your details may be forwarded to third parties within the company by email or via the management system. The legal basis for this may be Section 53(1), Section 6(1)(g) and (b) of the KDG.
Data is also disclosed to third parties within the framework of data processing on behalf of the controller pursuant to Section 29 of the KDG, i.e. in the context of processing activities in which the controller has a legitimate interest in outsourcing processing activities which it would otherwise be entitled to carry out itself. To this end, the data controller shall take the necessary measures to ensure compliance with data protection regulations.
Data may also be disclosed to external third parties for the purpose of defending legal claims on the basis of a legitimate interest, or in the context of investigations by or disclosure to public authorities, insofar as this is required by law or there is an obligation to disclose. The obligations to provide information to data subjects within the meaning of Sections 15 and 16 of the KDG are fulfilled prior to the relevant disclosure, insofar as these must be met separately.
c.3. Job subscription
To be kept informed about new job vacancies, you can subscribe to the job newsletter or view suitable vacancies on our careers board (RSS feed). You can refine your subscription by specifying your preferred role and location.
You will also need to provide your email address to subscribe. The legal basis for this is your consent to receive the newsletter in accordance with Section 6(1)(b) of the KDG. You may withdraw your consent to receive the newsletter at any time via the unsubscribe link in the newsletter (opt-out).
No personal data is processed via the RSS feed itself for the purpose of providing information about new job vacancies.
c.4. Softgarden Network
To help you manage your applications more easily and efficiently, softgarden offers you the option to register for the softgarden Network and create an account for this purpose. The softgarden Network is a cross-client talent pool operated by softgarden.
You can customise your Network account and view the status of your applications. You can enter the following details:
- Title, Surname, First name, Date of birth
- Profile picture
- Contact details (including email address and telephone number)
- Application documents (e.g. CV, education, work experience, language skills)
- Areas of interest (job category, career stage and preferred location)
The legal basis for creating a softgarden Network account is your consent, Article 6(1)(a) of the GDPR. Further information on the softgarden Network can be found here: https://softgarden.de/unternehmen/datenschutz-network/.
c.5. Online surveys
At the end of the application process, softgarden may display an invitation to take part in a survey via a link. The survey is conducted via a service provided by easyfeedback GmbH to gather feedback on the application experience. softgarden conducts this survey as the data controller within the meaning of Section 4(6) and processes the data collected in anonymised form for its own purposes (statistics, analysis, studies) as well as for the further development of softgarden products.
The collection of survey data is secured by default using SSL encryption, and softgarden does not establish any personal links during processing. You may discontinue the survey at any time. The data processed up to the point of discontinuation may be used for the purposes stated.
Your participation in the survey is entirely voluntary, and by taking part you are giving your consent, without which your participation would not be possible, in accordance with Section 6(1)(b) of the KDG (Article 6(1)(a) of the GDPR). The data is processed in an anonymised form. Anonymised data is therefore not subject to the material scope of the KDG (or the GDPR).
Further information on easyfeedback’s data protection policy can be found in the following guidelines: https://easy-feedback.de/privacy/datenschutzerklaerung.
c.6. Talent pool
As part of your application or via the ‘Get in touch’ button, you have the option to put yourself forward for our talent pool. This processing is necessary to enable you to be automatically considered for future job vacancies, including similar or otherwise suitable positions.
If you register for the talent pool via the ‘Get in touch’ button, you will be asked to provide the following details:
- Title, academic title (optional)
- First name, surname, email address
- Fields of work of interest
- Current career stage
- Preferred location(s)
- XING profile or CV
Inclusion in the talent pool is entirely voluntary, subject to your consent and via the use of an opt-in link. The legal basis is Section 6(1)(b) of the KDG. Furthermore, we will contact you after 6 months to ask whether you would still like to remain part of the talent pool.
5.7. Scheduling/calendar integration “Cronofy”
We use an integrated service provided by Cronofy Limited, 9a Beck Street, Nottingham, NG1 1EQ, UK, for the purpose of scheduling appointments and sending invitations.
Should we invite you to an interview via this function, you will receive an appointment invitation generated by Cronofy via email. This will transmit your email address, as well as the title of the appointment, a description and the location where the appointment is to take place. No further personal data about you will be transmitted to Cronofy.
The legal basis for the processing is Section 6(1)(g) of the KDG, to integrate appointment scheduling into our applicant tracking system and to plan and manage interviews and other appointments more efficiently.
Data processing takes place in an encrypted, isolated environment on a server in Germany. Data transfers to third countries (the USA) cannot be ruled out in this context. Adequate security standards for data processing have been agreed with the provider and verified by the provider. Further information can also be found at the following link: Scheduling Platform for Business | Cronofy the scheduling experts
Should you nevertheless not wish your data to be processed by Cronofy or require further information, please let us know before we coordinate your appointment.
c.8. CV parsing “Textkernel”
We process and analyse documents uploaded by you using AI to extract CV data and convert it into a structured format (known as ‘CV parsing’).
To ensure data subjects’ rights and security standards are upheld, a data processing agreement has been concluded with the service provider. The data processor is the ISO 27001-certified provider Textkernel B.V., Nieuwendammerkade 26 A 5, (1022AB) Amsterdam, Netherlands. Data processing takes place on a server in Germany within a secure environment.
The legal basis for the processing is Section 53 of the KDG and Section 6(1)(g) of the KDG, in order to initiate an employment relationship and to make the application process efficient for you. No personal data is transferred to non-EU countries. Your data is routinely deleted from the temporary storage once a week.
d. Deletion and use of data
Your data will be stored for the duration of the application process and in accordance with the legitimate retention periods following the conclusion of the application process. Data will be deleted 6 months after a rejection and 6 months after recruitment. Once the retention period has expired, the data will be fully anonymised. The processing of anonymised data records does not fall within the material scope of the data protection regulations; consequently, anonymised data may be processed for statistical and analytical purposes, for the preparation of market studies or for product development.
e. Your rights as a data subject
Data subjects are entitled at any time to find out whether their personal data has been stored and may exercise their right to access stored data (right of access), to verify its accuracy (right to rectification), to request that it be supplemented and updated, to request its erasure (right to be forgotten), to request the restriction of processing (right to restriction), and to transfer the data, or have it transferred, in a commonly used, machine-readable format (right to data portability). These rights apply provided there are no compelling and/or legitimate grounds on the part of the data controller that would prevent this. To exercise these rights, please contact datenschutz@gfo-online.de or write to the address given above.
In cases where we process data on the basis of your consent (Section 6(1)(b) of the KDG), you have the right at any time to withdraw your consent without giving reasons and with effect for the future. The relevant data processing will then cease in future; however, this does not affect the lawfulness of the processing carried out up to the time of withdrawal. Furthermore, you have the right to object to processing, for example if the data is or has been processed incorrectly, or if other reasons in the data subject’s interest preclude (further) processing. Data subjects also have the right to lodge a complaint with the supervisory authority responsible for data processing.
Please note that, in the event of an objection and/or withdrawal, certain services or processing activities may not be provided or utilised, insofar as processing is necessary for these purposes.
f. Automated decision-making
No automated decision-making takes place. Should this be or become necessary, we will obtain transparent consent in advance of the processing where appropriate.
g. Changes to this Privacy Policy
We reserve the right to amend or supplement this Privacy Policy at any time in light of the constantly changing legal, technical and organisational requirements relating to the processing of personal data. This also applies to any translation errors and differences regarding national data protection law requirements.