General information regarding the processing of personal data
This document will provide you with information which personal data are being collected for the purposes of providing our services (website and application), how these data are being processed by us and/ or third parties and what rights you have according to the General Data Protection Regulation (GDPR).
Invia SSC Germany GmbH
Dr. Tobias Walther-Merkwitz (chairman of the board),
Balint Gyemant, Boris Raoul
Contact of Data Protection Officer:
Invia SSC Germany GmbH
Data Protection Officer
Specific information regarding cookies and other tracking technologies
Cookies are small text files stored in the memory of your browser or device when you visit a website or press a specific button. Cookies allow a website to recognize a particular device or browser for a variety of purposes. These purposes may include: the usability of the website (for example, in the case of session cookies or cookies for recognizing the device and screen format) or, for example, information on whether a particular offer or specific advertising medium has been clicked. The collection of such data happens either anonymously or by means of pseudonymised usage profiles. That means, these are not intended to identify you as a person (if different, please refer to the technologies and cookies explained below). Although only pseudonymised data is collected and processed, in many cases this is still regarded as processing of personal data.
You can disable or remove cookies by using the settings or tools that are available as part of most browser technologies. The preferences must be set separately for each browser you use, with different browsers offering different functionality and options.
Other tracking technologies
With similar tracking technologies (or “technologies” for short) we refer to e.g. small graphics (such as “pixel tags” or “clear gifs”) that may be integrated into our websites, services or features. These typically work with cookies, which in turn regularly contain the pseudonymous identifier.
If you wish to disable the tracking technologies and related cookies, you can do so through special settings on your browser. However, some features of our website are only available through the deployment of cookies. If you disable or opt-out of cookies, your use of the Websites and Services may be restricted or unavailable.
For more information and tips on cookie preference management, please visit http://www.youronlinechoices.com/.
Technologies and cookies we use
a) Certain technologies and cookies are necessary to enable essential functionality of our website and to ensure the intended function of our online services. These include, for example, the HTTP session ID and session cookies, status, device and preference settings which are stored temporarily, local form data storage or information about voucher codes entered as well as the settings cookie, which saves your cookie preferences made at the beginning of the page visit. This includes technologies and cookies that serve technical error analysis and the ability to perform performance measurements (such as load times, server load allocations). Insofar as these data represent pseudonymous identifiers, we process them for the above-mentioned reasons based on legitimate interest, Art. 6 para. 1 p. 1 lit. f) GDPR. If you want to deactivate these cookies, you can only do so via special settings of your browser. If you disable or opt-out of these cookies, your use of the Websites and Services may be restricted or unavailable. Session cookies expire at the end of your browser session. Persistent cookies are stored between the browser sessions on your device until they are cleared by their browser settings.
b) Other tracking technologies allow us to anonymously analyze visitor numbers, site visitor sources, usage time, approximate geographic origins, and user interactions with our website to determine how our websites are used and which of our sub pages are particularly popular. They also allow us to associate specific page visits with key sales and affiliate partners and track subsequent user interactions. The basis for the use of these technologies and cookies is our legitimate interest, Art. 6 para. 1 p. 1 lit. f). DSGVO, because we need statistical analysis on the use of our website for the purpose of optimization:
For this purpose we use “Google Analytics”, a web analysis service of the Google LLC, in the EU via Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland).
IP-Masking: We use Google Analytics with the default “anonymizerIP” so that your IP-address is collected by Google in a way that it is shortened by the last eight digits. The above-mentioned data are provided by the recipient Google Ireland Ltd. processed on our behalf for a maximum of 180 days. However, Google is entitled to store the collected pseudonymised usage information on servers of the Google LLC in the USA. Google LLC is certified under the Privacy Shield Agreement:
You can prevent Google from processing usage profiles by downloading and installing the browser plug-in available at the following link:
Information regarding the processing of personal data in connection with an application
Purposes of the processing
We will process your personal data for the purposes of the application procedure if you submit your application via e-Mail, mail or online form. As far as you have given your consent, we store your data in our talent pool in order to take your application into account for future vacancies. In addition, we store your data for documentation and evidence purposes regarding our personnel decision.
Legal basis of the processing
The processing of personal data is based on Art. 6 (1) 1 point (b) GDPR (required prior entering into a contract).
In case of a rejection, the processing is based on our legitimate interest (Art. 6 (1) a point (f) GDPR) which lies in the ability to protect ourselves against claims or legal actions arising out of or in connection with the rejection of your application.
We will store and process your data in our talent pool solely if you have given your explicit consent (Art. 6 (1) 1 point (a) GDPR).
You will be informed at a later point of time about the processing of personal data in connection with the performance of the employment contract if your application was successful.
Obligation to provide data and consequences of failure to do so
The provision of personal data is a necessary requirement of the hiring decision. If you do not provide the requested information we cannot take your application into account.
Period for which the data will be stored
If we reject your application your data will be stored for a period of 90 days (beginning with the information about the rejection) and will be deleted afterwards. Notwithstanding the foregoing, the data will be stored in our talent pool if you have given your consent. In this case your data will be stored for a maximum of three years after your consent was given.
Categories of recipients
We are in charge of providing recruiting services to all affiliated companies of Invia Group with registered office in Germany. Hence, we will make available your data to the respective company that is responsible for the job offering in question. If your data is also stored in our talent pool we may also disclose your application and all personal data contained therein to other affiliated companies with future vacancies that might suit your profile.
Your personal data is also made available to the following recipients (processors):
provider of our personnel management system, provider of our project management system
Transfer of personal data to a third country
We intend to transfer your personal data to third countries (countries outside the European Union). Insofar as we transfer your data to a third country, we will solely do so on the basis of an adequacy decision of the European Commission pursuant to Art. 45 (1) GDPR or Standard Data Protection Clauses adopted by the European Commission (Art. 46 (2) point (c) GDPR.
Further information regarding the decisions of the European Commission can be obtained here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en). Additional information in connection with the Standard Data Protection Clauses are provided upon request by our Data Protection Officer.
If personal data are being processed you have the following rights pursuant to Articles 15 to 21 GDPR:
Right of access
Yous hall have the right to obtain from us confirmation whether or not your personal data are being processed. Where that is the case, you shall have the right to access all data as stipulated in Art. 15 (1) GDPR.
You have the right to be informed whether personal data concerning your person are / have been transferred to a third county or to an international organisation and – if yes – of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
Right to rectification
You shall have the right to obtain from us without undue delay the rectification of inaccurate the personal data. Furthermore, you shall have the right to have incomplete personal data completed.
Right to restriction of processing
You shall have the right to obtain from us the restriction of processing under the circumstance laid out in Art. 18 (1) GDPR.
Where the processing has been restricted, such personal data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims of for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You shall be informed by us before the restriction of processing is lifted.
Right to erasure
a) Obligation to erase personal data
You shall have the right to obtain from us the erasure of personal data concerning your person and we shall have the obligation to do so if one of the grounds as stipulated in Art. 17 (1) GDPR applies.
Where we have made the personal data public and we are obliged pursuant to Art. 17 GDPR to erase the personal data, we, taking account of available technology and cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing personal data that you have requested erasure by such controllers of any links to, or copy or replication of, those personal data.
The foregoing shall not apply to the extent that processing is necessary for the grounds as stipulated under Art. 17 (3) GDPR (compliance with legal obligations, exercise or defence of legal claims).
We shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Art. 16, 17 (1) and Art. 18 GDPR to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
Upon request, we shall inform you about those recipients.
Right to data portablilty
You shall have the right to receive the personal data concerning your person, which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, provided that the conditions of Art. 20 (1) GDPR are met.
In addition, you shall have the right to have your personal data transmitted directly from us to another controller where technically feasible.
Right to object
You subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6 (1) GDPR, including profiling based on those provisions.
We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning your person for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
Right to withdraw consent
Insofar as the processing of personal data is based on your consent, you shall have the right to withdraw the consent at any time. If you do so, this will, however, not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
Without prejudice to any other administrative or non-judicial remedy, you shall have the right to lodge a complaint with a supervisory authority (in our case: Der Sächsische Datenschutzbeauftragte), if you assume that the processing of your personal data is not compliant with the GDPR.
The supervisory authority shall inform you on the progress or outcome of the complaint.