Legal notice and data protection information for applicants

When applying via our online job market:

If you visit the websites of Trusted Shops as part of the application process, the data protection declaration at https://www.trustedshops.com/de/legal/datenschutz also applies.

Trustes Shops SE
Colonius Carré
Subbelrather Straße 15c
50823 Köln

Trusted Shops SE
Colonius Carré
Subbelrather Straße 15c,
50823 Köln

Registered at: Amtsgericht Cologne, HRB 120336, VAT ID No.: DE812947877

Executive Board with power of representation:
Jean-Marc Noël (Chairman), Michael Burdack

Chairman of the Supervisory Board:
Ulrich Hafenbradl

If another Trusted Shops company is specified as the employer in the job advertisement, Trusted Shops SE is a joint controller together with the employer in accordance with Art. 26 GDPR. To exercise your data protection rights, please contact Trusted Shops SE or the specified employer:

• Trusted Shops France SARL, WERÉSO 104 Rue Nationale, 59000 Lille, France
• Trusted Shops Poland sp. z o.o., ul. Skierniewicka 10A, 01-230 Warszawa, Poland
• Trusted Shops Iberia SL, Avinguda Portal de l’Àngel, 24, Planta 3 Puerta 1, 08002 Barcelona, Spain
• Trusted Shops Italia S.R.L., Viale della Stazione 5, 39100 Bolzano, Italy

You can contact the Trusted Shops Privacy Team at privacy@trustedshops.com.

You can contact the Data Protection Officer of Trusted Shops SE at dpo@trustedshops.com.

Application for a job at Trusted Shops via the contact form

Your personal data is collected directly from you as part of the application process. We only collect and process data that is related to your application. These are in particular:

• general personal data (master data such as first name, last name, name affixes)
• Contact data (such as private address, (mobile) phone number, e-mail address)
• Information on your professional qualifications (in particular school education, vocational training, previous activities, information on further vocational training, certificates, other qualifications)
• Other data from the entire application process (e.g. cover letter, questionnaires, interviews)
• profile information from job-related social media (e.g. LinkedIn, Xing)
• Notes about applicants
• Work results in the context of the internship day and, where applicable, the online assessment.
• Other information that you provide to us in connection with your application

If you have also voluntarily provided special categories of personal data (such as health data, religious affiliation, degree of disability) in the letter of application or in the course of the application process, processing that goes beyond storage will only take place if you have consented to this or if a legal permissible circumstance justifies this.

Application for a job via Indeed or LinkedIn

In addition to the contact form on our application portal, you can also apply for a job via Indeed or LinkedIn. If you click on one of the social buttons, a new window opens in your browser and calls up the page of the respective service provider, where you can first log in to your profile.

If you decide to apply via LinkedIn and click the corresponding button, you will first be redirected to the LinkedIn page in a separate window. There you can agree to the linking of your profile data on LinkedIn with Recruitee. As a result, Recruitee and subsequently us are provided with your personal data stored on LinkedIn for the purpose of processing the application process in accordance with Art. 6 (1) s. 1 lit. b GDPR. You can find out more about the linking of your LinkedIn profile with other third-party services and the data transfer that takes placehere.

If you decide to apply via Indeed and click the corresponding button, a pop-up window will first open. There you can create a new Indeed resume by entering your name, email address, and phone number. Alternatively, you can log in to your existing Indeed profile and send us the application documents you have already submitted via Indeed. The files you upload as well as other personal data such as your name, your e-mail address and your telephone number will be stored by Indeed and forwarded to us for the purpose of processing the application process in accordance with Art. 6 (1) s. 1 lit. b GDPR the personal data stored there.

You can find out more about the data collection and transfer between applicants, Indeed and employers as part of the Indeed CV program hier.

For the purpose and scope of the data collection and the further processing and use of the data by the providers on their sites, as well as a contact option and your rights and settings options in this regard to protect your privacy, please refer to the privacy notices of the providers.

To fulfill contractual obligations

We collect and process your data in accordance with the statutory provisions, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the following purposes:

• To carry out and process the application procedure and to assess the extent to which you are suitable for the employment relationship in question or other vacant positions (Art. 6 (1) lit. b GDPR).
• insofar as an employment relationship between you and us is established: for the further processing of the data already received from you for the purposes of the recruitment process and for the implementation / termination of the employment relationship (Art. 6 (1) lit. b GDPR)

Due to legal requirements

• To fulfill legal obligations or official requirements. The processing also takes place in order to fulfill our legal obligations as an employer, in particular in the area of tax and social security law, as well as in order to be able to fulfill monitoring and reporting obligations (Art. 6 para. 1 lit. c and lit. e GDPR in conjunction with Section 26 BDSG).
• If you indicate a degree of disability, we are obliged under SGB IX to forward this data internally to the representative body for severely disabled persons. In this case, the legal basis is Section 26 (3) sentence 1 of the BDSG in conjunction with the corresponding standards from SGB IX.

Where necessary, we process your data to protect our legitimate interests or those of third parties (Art. 6 (1) lit. f GDPR), in particular:

• Anonymized processing for our own statistical purposes (e.g. studies on applicant behavior).

Based on consent (Art. 6 (1) lit. a GDPR)

• If it is clear from your letter of application or CV that you wish to process disclosed personal data, including data of special categories (such as information about voluntary activities in a political party or a religious organization), for which there is no legal authorization, we will assume that you have given your consent to the processing. In this case, the legal basis is Art. 6 (1) s. 1 lit. a GDPR, if applicable in conjunction with. Art. 9 (2) lit. a GDPR. You can revoke your consent at any time, even during the current application process.
• If you enter personal data in your letter of application or CV that we are not permitted to collect ourselves, we will assume that you have given your consent on the basis of Art. 6 (1) s. 1 a GDPR for the storage of this data and will not use it for any other purposes. You can revoke your consent at any time, even during the current application process.

• If interviews are automatically transcribed and, where applicable, automatically summarized, this is done on the basis of your consent pursuant to Art. 6 (1) s. 1 lit. a GDPR. You may withdraw your consent at any time, including during the ongoing application process.

Contact by e-mail or telephone Telephone interview / video interview

As part of the application process, we will contact you regarding your application, if we have any queries or to arrange interviews and, if necessary, to arrange an internship day. For this purpose, we will use the contact data provided by you and contact you by e-mail or telephone. For the purpose of coordinating job interviews or the practice day, our appointment booking tool Microsoft Bookings may also be used. The job interviews and the practice day, if applicable, take place on a regular basis via Microsoft Teams; alternatively, assessment interviews can also be conducted by telephone.

Interviews conducted via Microsoft Teams may be transcribed and summarized using the Metaview service. In connection with the practical day, an online assessment may also be conducted through Canditech.

Information on the handling of your data when using Microsoft Bookings, Microsoft Teams, Metaview and Canditech can be found in the following sections:

Microsoft Bookings

In some cases, we offer the possibility to book an appointment for the interview or the possibly scheduled practice day with us via a link sent to you using the Microsoft Booking tool.

When booking the appointment, various data will be collected. The scope of the mandatory data is noted in the booking tool. Always required is your name and email address. If you want us to contact you by phone, you also have to provide your phone number, otherwise the appointment will take place via Microsoft Teams (see below). Additional information may be required for certain appointments or may be provided on a voluntary basis. In addition, technical data such as your IP address and browser information will be collected.

We use the data you provide to confirm the appointment and to hold the appointment. The purpose of the processing is the planning and perception of the appointment with you. The legal basis is the implementation of pre-contractual measures, Article 6 (1) (b) GDPR.

We use service providers to process your inquiries within the scope of processing personal data on your behalf. These service providers are based in the USA. Please note the information in the section on third country transfers below regarding the associated risks.

Microsoft Teams

We use Microsoft Teams (as phone/video conferences) to conduct interviews and the practice day with you. Microsoft is responsible for processing the data via Microsoft Teams (app or browser).

The scope of the processed data depends on the one hand on the information you provide before and when participating in an online meeting yourself, and on the other hand on how you participate in the meeting.

The following data is used when you participate in an online meeting: Specified user name, your e-mail address, if set by you, your profile picture, language selection. In addition, so-called metadata is collected, such as date, time, meeting ID, location. In addition, you can participate in the meeting with or without video and with or without sound and also use the chat function and send text or files. If you use these functions, image and sound files as well as the data sent via the chat function will be processed. In principle, the meetings are not recorded. If this should be the case, you will be informed in advance and asked for your consent.

The purpose of the data processing is to carry out the interviews, the practice day and, if applicable, the exchange of data via the chat function. The legal basis is the implementation of pre-contractual measures, Article 6 (1) (b) GDPR.

Personal data processed in connection with participation in an online meeting will not be disclosed to third parties unless this has been transmitted for the purpose of disclosure. We use service providers to conduct the online meetings as part of a processing of personal data on behalf. These service providers are based in the USA. Please note the information in the section on third country transfers below regarding the associated risks.

Metaview

We use Metaview in connection with video interviews conducted via Microsoft Teams to transcribe and summarize these conversations.

This involves an automated transcription of the interview followed by an automated summary of the conversation. In addition to the spoken content, the following data is used during the transcription process: your provided username and your email address.

The purpose of this processing is to conduct the interviews and subsequently evaluate the discussions. The legal basis for the processing is the implementation of pre-contractual measures pursuant to Article 6(1)(b) GDPR.

Personal data processed in connection with participation in an automatically transcribed online meeting will not be disclosed to third parties unless this has been transmitted for the purpose of disclosure. We engage service providers to conduct online meetings as part of the processing of personal data on our behalf. This service provider is located in the United Kingdom, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection.

Canditech

As part of the practical day, an online assessment may also be conducted. For this purpose, we use Canditech's online assessment platform.

In addition to the results of the individual tasks, your name, email address, IP address, and, where applicable, video and audio recordings may also be processed.

The purpose of the data processing is to conduct the online assessment and subsequently evaluate the results. The legal basis for the processing is the implementation of pre-contractual measures pursuant to Article 6(1)(b) GDPR.

Personal data processed in connection with participation in an online assessment will not be disclosed to third parties unless this has been transmitted for the purpose of disclosure. We engage service providers to conduct the online assessment as part of the processing of personal data on our behalf. This service provider is located in Israel, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection.

Inclusion in the applicant pool

In some cases, we may not be able to consider applicants for the advertised position. In some cases, we offer the possibility of inclusion in our applicant pool.

Such inclusion in the applicant pool only occurs, of course, if you have voluntarily given us your consent to inclusion in the applicant pool. You will be informed of the duration of storage when you give your consent.

The given consent can be revoked at any time for the future.

Within our company, the persons who receive access to your data are those who need it to fulfill the above-mentioned purposes, in particular for the hiring decision and to fulfill our pre-contractual/contractual and legal obligations, e.g. responsible managers, employees recruiting.

As an employer, we already have legal obligations to disclose data in certain cases during the application process. In addition, we use selected service providers (order processors) and vicarious agents of the categories mentioned below, who may have access to your data to the extent necessary in each case and use it for the fulfillment of the orders placed by us.

Under these conditions, recipients of your data may be

• public bodies and institutions in the event of a legal or official obligation,
• Third parties who process your data for their own purposes
  • Payment service providers / banks
  • Postal service providers
  • Auditing companies / legal service providers
• Service providers (processors) / vicarious agents in the areas of:
  • Recruiting software
  • Personnel management software
  • Office applications
  • Video telephony software
  • Online assessment tools

Trusted Shops engages various service providers as data processors for the recruitment purposes described above. Some of these service providers are located outside the European Union (EU) or the European Economic Area (EEA), or in turn use sub-processors located in such countries, for example for hosting purposes.

The third countries in which personal data is processed include both countries considered to provide an adequate level of data protection and countries that do not. For those countries that the European Commission has recognized as providing an adequate level of data protection, an adequacy decision has been adopted. Trusted Shops processes personal data in the following countries recognized as providing an adequate level of data protection: the United Kingdom, Switzerland, Israel, and the United States. For transfers to the United States, the adequacy decision applies provided that the company importing the personal data is certified under the EU-U.S. Data Privacy Framework. Where no such certification exists, as well as for transfers to other third countries, the following applies:

As a general rule, Trusted Shops enters into the Standard Contractual Clauses adopted by the European Commission with service providers that process personal data in third countries that are not considered to provide an adequate level of data protection. Where possible, we also implement additional safeguards (such as pseudonymization) intended to ensure an adequate level of data protection in those third countries.

For some service providers, approved Binding Corporate Rules (BCRs) are also in place, ensuring that European data protection standards are observed throughout the organization.

We process and store your data as long as it is necessary for the fulfillment of the above-mentioned purposes, in particular for the decision on your application and its suitability for vacant positions. If an employment relationship between you and us does not materialize, we will delete your data at the latest 6 months after the conclusion of the application process, unless legal provisions prevent deletion or longer storage is required due to legal disputes or you have consented to longer storage.

As a data subject, you have the following rights:

• according to Art. 15 GDPR the right to request information about your personal data processed by us to the extent specified therein;
• in accordance with Art. 16 GDPR, the right to demand the correction of inaccurate or incomplete personal data stored by us without undue delay;
• in accordance with Art. 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is necessary for the exercise of the right to freedom of expression and information; for compliance with a legal obligation; for reasons of public interest; or for the establishment, exercise or defense of legal claims;
• pursuant to Art. 18 GDPR the right to request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you; the processing is unlawful, but you object to its erasure; we no longer need the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller;
• in accordance with Art. 77 GDPR, the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose. The following supervisory authorities are responsible for the Trusted Shops companies:
  • Trusted Shops SE: North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (LDI NRW)
  • Trusted Shops France SARL: CNIL – Commission Nationale de l’Informatique et des Libertés
  • Trusted Shops Poland sp. z o.o., ul.: Biuro Generalnego Inspektora Ochrony Danych Osobowych
  • Trusted Shops Iberia SL: Agencia Espanola de Protección de Datos (AEPD)
  • Trusted Shops Italia S.r.l.: Garante per la Protezione dei Data Personali (GDPD)

If you have any questions about the collection, processing or use of your personal data, about information, correction, restriction of processing or deletion of data, as well as revocation of any consent given or objection to a particular use of data, please contact our privacy team.

As part of your application, you must provide the data that is required for the application process and the suitability assessment or that we are required to collect by law. Without this data, we will not be able to carry out the application process and make a decision about establishing an employment relationship with you.

To what extent is there automated decision-making or profiling?

As a matter of principle, we do not use fully automated decision-making or profiling as part of the application process in accordance with Art. 22 GDPR.

Insofar as we process personal data as explained above in order to protect our legitimate interests that prevail in the context of a balancing of interests, you can object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you only have the right to object if there are grounds arising from your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

This does not apply if the processing is for direct marketing purposes. Then we will not further process your personal data for this purpose.