Information pursuant to Art. 13, 14 & 21 of the General Data Protection Regulation (GDPR) about the use of your personal data

Responsible entity and contact details

The responsible party in terms of data protection law is

Nexia GmbH
Wirtschaftsprüfungsgesellschaft | Steuerberatungsgesellschaft
Georg-Glock-Straße 4, 40474 Düsseldorf, Germany

You will find further information about our company, details of the persons authorized to represent it and also further contact options in our legal notice on our website. https://www.nexia.de/legal-notice

Contact details of the data protection officer: datenschutz@nexia.de

Legal bases and purpose of processing

If you send us an application, we process your associated personal data insofar as this is necessary to decide on the establishment of an employment relationship. 

We process your personal data as part of your application for internal coordination throughout the application process in accordance with the provisions of the GDPR, the German Federal Data Protection Act (BDSG) and other applicable data protection regulations.

Legal bases for the processing are § 26 BDSG (initiation of an employment relationship), Art. 6 (1)(b) GDPR (fulfillment of a contract, implementation of pre-contractual measures, general contract initiation), Art. 6 (1)(f) GDPR (legitimate interest), Art. 6 (1)(c) GDPR (legal obligation), Art. 6 (1)(e) GDPR (public interest) and - if you have given your consent - Art. 6 (1)(a) GDPR. Consent can be revoked at any time.

Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data you submitted will be stored in our data processing systems on the basis of § 26 of the German Federal Data Protection Act (BDSG) and Art. 6 (1)(b) GDPR for the purpose of implementing the employment relationship.

If the data may be required for legal prosecution after completion of the application process, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular to safeguard legitimate interests pursuant to Art. 6 (1)(f) GDPR (assertion or defense of claims), insofar as this is necessary to fulfill legal obligations or to defend asserted legal claims against us. The legitimate interest is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act.

Data categories

We process the data you have sent us in connection with your application in order to assess your suitability for the position (or other open positions in our companies, if applicable) and to carry out the application process.
We may legally process data received from third parties or public sources (such as trade registers, media, etc.) if this is necessary for the contract or application and permitted by law. Different categories of data may be generated as part of the application process, depending on the applicant's documents sent to us. Here are some examples: Personal identification information (name, address, phone number, email address, date of birth), education and work experience (schooling, higher education, vocational training, previous jobs, internships, professional skills and certificates), application documents (resume, cover letter, references, certificates, portfolio, if applicable), online presence (information from social networks such as LinkedIn, Face-book etc., personal websites or blogs, publications), feedback and evaluations (evaluations from previous employers, references), self-disclosure and answers to interview questions (information from interviews and tests), possible further data (nationality, work authorization, information on equality, if applicable, salary expectations), etc.

Recipients of data

Your personal data will only be passed on within our company to persons who are involved in processing your application.
Your application data will be reviewed by the HR department after receipt of your application. Suitable applications are then forwarded internally to the department managers responsible for the respective open position. The further procedure is then coordinated. In principle, only those persons in the company have access to your data who require this for the proper conduct of our application process.

We may transfer your personal data to companies affiliated with us, insofar as this is permissible within the scope of the purposes and legal bases. In this case, the recipients are providers of applicant management systems (Personio GmbH), providers of data exchange servers (Schuster& Walther IT Business GmbH) and providers of data servers (Microsoft GmbH). Your personal data is processed on our behalf on the basis of order processing contracts pursuant to Art. 28 DSGVO.

You can find further information on data privacy of the companies here:

Personio: https://www.personio.com/privacy-policy/

Microsoft: https://www.microsoft.com/de-de/trust-center/privacy/

Schuster & Walther: https://www.schuwa.de/datenschutz/
 

Transfer of data to third countries

The transfer to a third country outside the EU does not take place in principle.

The data is processed exclusively in data centers in the EU.

Data storage period

We store your data for a period of the application process. If you agree to join our talent network, the storage of your data will be extended for the period of your affiliation.
If you are awarded a position during the application process, your data will be transferred from the applicant data system to our HR information system.
If we are unable to make you a job offer, if you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted for up to six months from the end of the application process (rejection or withdrawal of the application) on the basis of our legitimate interests (Art. 6 (1)(f) GDPR). The data will then be deleted and the physical application documents destroyed. This storage serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued storage no longer applies.
Longer storage may also take place if you have given your consent (Art. 6 (1)(a) GDPR) or if legal storage obligations prevent deletion. 

Inclusion in the applicant pool

If we do not provide you with a job offer, it may be possible to include you in our applicant pool. In the event of inclusion, all documents and details from the application will be transferred to the applicant pool in order to contact you in the event of suitable vacancies.
Inclusion in the applicant pool takes place exclusively on the basis of your express consent (Art. 6 (1)(a) GDPR). The provision of consent is voluntary and is not related to the current application process. The data subject may revoke his/her consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless there are legal reasons for retention.

Rights of the data subjects

You have the following rights towards the data controller:
1. the right to information regarding your stored data,
2. the right to rectification if data is incorrect,
3. the right to erasure or restriction of processing, provided that the data is not required for the fulfillment of obligations for the initiation of a contract, and
4. the right to data portability.
5. the right to object to the processing of personal data with effect for the future.

Furthermore, you have the right to lodge a complaint with the supervisory authority responsible for you.


Date Privacy Notice: 10/2023

Our privacy notice about our data processing may change from time to time. Any changes will be posted on this page.