Information for applicants pursuant to Art. 13 GDPR

I. Name and contact data of the controller

foodspring GmbH
Lobeckstr. 30-35
10969 Berlin

Email: data-protection@foodspring.com

Contact data oft he data protection officer:
JBB Data Consult GmbH
Friedrichstraße 95
10117 Berlin
Email: datenschutzbeauftragter@foodspring.com

II. Categories of data

We process the following categories of your personal data:
  • Name,
  • Email address and email communication,
  • Address,
  • Phone number,
  • CV (as attachment),
  • letter (voluntarily),
  • LinkedIn profile (voluntarily),
  • Website (voluntarily),
  • How you heard from us (voluntarily),
  • Salary expectations,
  • If you have a valid visa,
  • Possible start of employment,
  • Score Card,
  • Results of personell test.

III. Purpose and legal basis of processing

We use the personal data for the purposes of the application procedure, especially to assess you and your qualification, to invite you to us, to conduct interviews. The legal basis for these processing is Art. 88 par. 1 GDPR (General Data Protection Regulation) and Sec. 26 par. 1 BDSG (Bundesdatenschutzgesetz/German Federal Data Protection Act).

If your application is not successful, we may ask for your informed consent to retain your data in our talent pool to contact you for future positions. Legal basis for such processing is Art. 6 par. 1 lit. a) GDPR.

IV. Recipients or Categories of Recipients of Personal Data

Internally, the following departments process your personal data:
  • Human Resources Department,
  • Executive Management,
  • Managers for employees assigned to them.
Externally, we use service provider that will process your personal data. Additionally, our group companies may have access to your personal data (for more information, please refer to the respective section below).

V. Intention to transfer personal data to a third country

We use a technical service provider that processes personal data in the United States of America. However, our service provider has a valid EU-US-Privacy Shield certification. Hence, an adequate level of protection of your personal data is ensured (you can validate our service providers certification under: https://www.privacyshield.gov/participant?id=a2zt00000004U1KAAU&status=Active). Otherwise, we do not intend to transfer your data to a third country.

VI. Retention period

We process your data for the duration of the application procedure. After its end, we will retain your data 6 months after its end. If you provide us with your informed consent to store your data in our talent pool, we will retain it until you withdraw your informed consent.

VII. Rights of the data subject

If the respective requirements are met, the GDPR grants you certain rights as a data subject.
  • Art. 15 GDPR – Right of access: You shall have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain information.
  • Art. 16 GDPR – Right to rectification: You shall have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
  • Art. 17 GDPR – Right to erasure: You shall have the right to obtain from us the erasure of personal data concerning you without undue delay.
  • Art. 18 GDPR – Right to restriction of processing: You shall have the right to obtain from us the restriction of processing.
  • Art. 20 GDPR – Right to data portability: You shall have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you shall have the right to transmit those data to another controller without hindrance from us. You shall also have the right to have the personal data transmitted directly from us to another controller, where technically feasible.
  • Art. 21 GDPR – Right to object: You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, which is based on legitimate interests or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such case, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or where the processing is necessary for the establishment, exercise or defence of legal claims.
  • Art. 77 GDPR – Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
Where the processing is based on your informed consent, you shall have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Therefore, you may send us a message to one of our contact addresses mentioned above.

IVIII. Statutory or contractual requirements for the provision of personal data

You have no statutory or contractual obligation to provide us with any personal data. However, we may not be able to if you decide not to do so.

IX. Existence of automated decision-making, including profiling

We do not use automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.

X. Joint Controllership

Within our group of companies, we cooperate closely. Our group consists of the Foodspring GmbH, Lobeckstr. 30-35, 10969 Berlin, the enduria GmbH, Lobeckstr. 30-35, 10969 Berlin and the Goodminton AG, Lobeckstr. 30-35, 10969 Berlin. Insofar as it is required to ensure the most efficient fulfillment of the task or request on the highest possible standard, other group companies may have access to the personal data. This may also be the case if access is required for purposes in the interest of the group itself, such as a group wide reporting. The respective purposes constitute our legitimate interests we pursue with such processing (Art. 6 par. 1 lit. f) GDPR).
However, this means no disadvantage for you. We concluded a joint controllership agreement pursuant to Art. 26 GDPR between the group companies. In this agreement we determined that you can contact all companies regarding your rights as a data subject. While your data is processed, we will ensure the compliance with all data protection regulation obligations.
May 2019