Data protection for applicants

Information on data protection regarding our processing of applicant data in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

1. Controller responsible for data processing and contact details

Responsible body within the meaning of data protection law:

SM Motorenteile GmbH
Alleenstraße 70
71679 Asperg

E-mail: info@sm-original-germany.com

Contact details of our data protection officer:

Data Protection Officer
SM Motorenteile GmbH
Alleenstraße 70
71679 Asperg

E-Mail:DSB@sm-original-germany.com

2. Purposes and legal basis on which we process your data

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable data protection regulations. Details in the following. Further details or additions to the purposes of data processing can be found in the respective contract documents, forms, a declaration of consent and other information provided to you.

2.1 Purposes within the scope of your consent (Art. 6 para. 1 a GDPR)

Your personal data may also be processed for certain purposes (e.g. obtaining references from previous employers or using your data for subsequent vacancies) on the basis of your consent. As a rule, you can withdraw your consent at any time. You will be informed separately about the purposes and consequences of revoking or refusing consent in the relevant text of the consent. In principle, the revocation of consent is only effective for the future. Processing that took place before consent was withdrawn is not affected and remains lawful.

2.2 Purposes for the fulfillment of a contract or pre-contractual measures (Art. 6 para. 1 b GDPR)

Your personal data is processed to process your application for a specific job advertisement or as a speculative application, and in this context in particular for the following purposes: examination and assessment of your suitability for the position to be filled, performance and behavioral assessment to the extent permitted by law, if necessary for registration and authentication for the application via our website, if necessary for the preparation of the employment contract, verifiability of transactions, orders and other agreements as well as for quality control through appropriate documentation, measures to comply with general duties of care, statistical evaluations for corporate management, travel and event management, travel booking and travel expense accounting, authorization and ID card management, cost recording and controlling, reporting, internal and external communication, billing and tax assessment of company services (e.g. canteen meals, billing and tax assessment of company services).B. canteen meals), billing via company credit card, occupational health and safety, contract-related communication (including appointments) with you, assertion of legal claims and defense in legal disputes; ensuring IT security (including system and plausibility tests) and general security, including Building and system security, safeguarding and exercising domiciliary rights through appropriate measures and, if necessary, video surveillance to protect third parties and our employees and to prevent and secure evidence in the event of criminal offenses; ensuring the integrity, prevention and investigation of criminal offenses; authenticity and availability of data, control by supervisory bodies or control instances (e.g. auditing).

2.3 Purposes for compliance with legal requirements (Art. 6 para. 1 c GDPR) or in the public interest (Art. 6 para. 1 e GDPR)

Like everyone involved in business, we are also subject to a large number of legal obligations. These are primarily legal requirements (e.g. Works Constitution Act, Social Security Code, commercial and tax laws), but may also include regulatory or other official requirements (e.g. employers' liability insurance association). The purposes of processing may include identity and age verification, fraud and money laundering prevention (e.g. comparisons with European and international anti-terror lists), company health management, ensuring occupational safety, fulfilling control and reporting obligations under tax law and archiving data for data protection and data security purposes as well as for the purposes of audits by tax consultants/auditors, tax and other authorities. In addition, the disclosure of personal data may become necessary in the context of official/judicial measures for the purposes of gathering evidence, criminal prosecution or the enforcement of civil law claims.

2.4 Purposes within the scope of a legitimate interest of us or third parties (Art. 6 para. 1 f GDPR)

We may process your data beyond the actual fulfillment of the (preliminary) contract if this is necessary to protect our legitimate interests or those of third parties. Your data will only be processed if and to the extent that there are no overriding interests on your part against such processing, in particular for the following purposes: measures for the further development of existing systems, processes and services; comparisons with European and international anti-terror lists to the extent that they go beyond the legal obligations; enrichment of our data, e.g. through the use or research of publicly available data where necessary; data analysis and analysis of the data of third parties.This includes using or researching publicly available data where necessary; benchmarking; developing scoring systems or automated decision-making processes; building and facility security (e.g. through access controls and video surveillance), where this goes beyond the general duty of care; internal and external investigations, security checks;

3. The categories of data processed by us, insofar as we do not receive data directly from you, and their origin

Insofar as this is necessary for the contractual relationship with you and the application you have submitted, we may process data legitimately received from other bodies or other third parties. We also process personal data that we have legitimately obtained, received or acquired from publicly accessible sources (e.g. commercial and association registers, population registers, press, Internet and other media), insofar as this is necessary and we are permitted to process this data in accordance with the statutory provisions.

Relevant personal data categories may include in particular

• Address and contact data (registration and comparable data, e.g. e-mail address and telephone number)
• Information about you on the internet or in social networks

4. Recipients or categories of recipients of your data

Within our company, those internal departments or organizational units receive your data that need it to fulfill our contractual and legal obligations (such as managers and specialist managers who are looking for a new employee or are involved in the decision to fill a position, accounting, company doctor, occupational safety, employee representatives, etc.) or as part of the processing and implementation of our legitimate interest. Your data will only be passed on to external bodies

• for purposes for which we are obliged to provide information, report or pass on data in order to comply with legal requirements (e.g. tax authorities) or are entitled to do so or the data transfer is in the public interest (see section 2.4);
• to the extent that external service providers process data on our behalf as processors or function providers (e.g. credit institutions, external data centers, travel agencies/travel management, printers or companies for data disposal, courier services, postal services, logistics);
• on the basis of our legitimate interest or the legitimate interest of the third party for the purposes specified in section 2.2 (e.g. to authorities, credit agencies, lawyers, courts, experts, group companies and bodies and supervisory authorities);
• if you have given us your consent to transfer your data to third parties.

We will not pass on your data to third parties unless we inform you of this separately. If we commission service providers as part of order processing, your data will be subject to the security standards specified by us in order to protect your data appropriately. In all other cases, the recipients may only use the data for the purposes for which it was transmitted to them.

5. Duration of the storage of your data

In principle, we process and store your data for the duration of your application. This also includes the initiation of a contract (pre-contractual legal relationship).

In addition, we are subject to various retention and documentation obligations, including those arising from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified therein are up to ten years after the end of the contractual relationship or the pre-contractual legal relationship. Your application documents will be returned in the original after six months if you are not hired. Electronic data will be deleted accordingly after six months. If we wish to store your data for longer for subsequent vacancies or if you have entered your data in an applicant pool, the data will be deleted at a later date; you will be informed of the details in connection with the respective process.

If the data are no longer required for the fulfillment of contractual or legal obligations and rights, they are regularly deleted, unless their - temporary - further processing is necessary to fulfill the purposes listed under section 2.2 for an overriding legitimate interest of our company. Such an overriding legitimate interest exists, for example, if deletion is not possible or only possible with disproportionately high effort due to the special type of storage. In these cases, we may also store your data after the end of our contractual relationship for a period agreed with the purposes and, if necessary, use it to a limited extent. In these cases, processing is generally restricted instead of erased. In other words, the data will be blocked against the usual use by appropriate measures.

6. Processing of your data in a third country or by an international organization

Data is transferred to bodies in countries outside the European Economic Area EU/EEA (so-called third countries) if it is necessary to fulfill a contractual obligation towards you (e.g. application for a job abroad), or if it is in our or a third party's legitimate interest or if you have given us your consent.

Your data may also be processed in a third country in connection with the involvement of service providers as part of order processing. If there is no decision by the EU Commission on an adequate level of data protection in the country in question, we ensure that your rights and freedoms are adequately protected and guaranteed in accordance with EU data protection regulations by means of appropriate contracts. Information on the suitable or appropriate guarantees and the possibility of how and where to obtain a copy of these can be obtained on request from the company data protection officer or the HR department responsible for you.

7. Your data protection rights

Under certain conditions, you can assert your data protection rights against us. Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure. There is also a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG).

If possible, your requests to exercise your rights should be sent in writing to the address given above or directly to our data protection officer.

8. Scope of your obligations to provide us with your data

You only need to provide the data that is required for processing your application or for a pre-contractual relationship with us or that we are legally obliged to collect. Without this data, we will generally not be able to continue with the application and selection process. If we request additional data from you, you will be informed separately about the voluntary nature of the information.

9. Existence of automated decision-making in individual cases (including profiling)

We do not use any purely automated decision-making processes in accordance with Article 22 GDPR. If we do use such a procedure in individual cases in the future, we will inform you of this separately if this is required by law.

Information about your right to object Art. 21 GDPR

1. you have the right to object at any time to the processing of your data on the basis of Art. 6 para. 1 f GDPR (data processing on the basis of a balancing of interests) or Art. 6 para. 1 e GDPR (data processing in the public interest). However, there must be grounds for your objection that arise from your particular personal situation. This also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR.

 If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

You can of course withdraw your application at any time.

 2. it is not planned to use your personal data for direct marketing purposes. Nevertheless, we must inform you that you have the right to object to advertising at any time; this also applies to profiling insofar as it is associated with such direct advertising. We will observe this objection for the future.

The objection can be made informally and should preferably be addressed to

Human Resources Department
SM Motorenteile GmbH
Alleenstraße 70
71679 Asperg