We are delighted that you wish to apply for a job with us. In the following, we would like to explain how we deal with your personal data in the context of a job application:

      1. Who is responsible for the processing of your personal data?

idealo internet GmbH, Ritterstraße 11, 10969 Berlin, Germany (hereinafter referred to as “we” or “us”), is the data controller in accordance with the General Data Protection Regulation (GDPR).

Our data protection officer can be contacted at:

idealo internet GmbH
Data Protection Officer
Ritterstraße 11
D-10969 Berlin

or by email at: privacy@idalo.de.

  1. What are the reasons for processing your personal data and what is the legal basis for this?

We process your personal data for the purpose of your application for an employment relationship with idealo, insofar as this is necessary for making a decision on the establishment of an employment relationship. The legal basis for this is Art. 26 para. 1 GDPR.

Furthermore, we can process your personal data as far as this is necessary to counter any alleged legal claims originating from the application process. The legal basis for this is Art. 6 para. 1 point f GDPR, whereby the legitimate interest is, for example, a duty to provide evidence of adherence to the General Act on Equal Treatment (Ger: Allgemeinen Gleichbehandlungsgesetz) within the scope of the process.

If an employment relationship begins between you and us, we may process the personal data that you have provided to us for the purposes of the employment relationship itself or the administration or fulfilment of the rights and obligations that we have towards an employee deriving from legal provisions, collective agreements (Ger: Tarifverträge) or works agreements, insofar as far as this is necessary, in accordance with Art. 26 para. 1 GDPR.

  1. Which categories of personal data do we process?

We process data associated with your application. This could include general information about you (such as name, address and contact details), information about your professional qualifications, education and further education or other information that you have sent to us within the scope of your application. In addition, we may also process career-related information made publicly available, such as a profile on professional social media networks.

  1. From which sources does personal data originate in cases where data is not collected directly from you?

Furthermore, in exceptional circumstances, we may collect publicly accessible applicant data via so-called career networks, particularly Xing, LinkedIn, talent.io, honeypot.io and stackoverflow.

  1. Who are possible recipients of the data?

We may send your personal data to companies that are affiliated with us, provided that this is permissible in accordance with the purposes and legal bases set out in section 3. Otherwise, personal data is processed on our behalf, in accordance with contracts that are compliant with Art. 28 of the GDPR, in particular by the operator of our data centre and the provider of our applicant tracking system Prescreen (Prescreen International GmbH).

  1. Is there any intention to send the data to a third country?

There is no intention to send your applicant data to a third country.

  1. For how long will your data be stored?

We store your data for as long as necessary in relation to making a decision about your application. If an application does not result in an employment relationship between you and idealo, your applicant data will be deleted at most six months after we have provided notice of rejection, unless you have consented to a longer storage period or we are entitled or obliged to store your data for longer for other reasons.

  1. What are your rights?

As an applicant with us, you have a series of data protection rights, depending on the individual situation, which can be exercised by contacting us or our data protection officer at any time in accordance with the data set out in sections 1 and 2. These data protection rights are as follows:

  1. Information

You have the right to obtain information regarding and access to your personal data that has been processed by us. This includes information on the purposes of use, the category and the recipients of the processed data (or any other authorised persons with access to the data), as well as the planned storage duration of the data if this is possible and, if this is not possible, the criteria for determining the storage duration.

  1. Rectification, erasure or restriction of processing

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete data completed, including by means of providing a supplementary statement.

  1. Right to object

Insofar as personal data relating to you is processed on the basis of Art. 6 para. 1 point f (GDPR), you have the right to object to this data processing at any time on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of any legal claims.

  1. Right to withdraw consent

If the processing of personal data is based on your express consent, you have the right to withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw this consent, you can contact our data protection officer at any time using the contact information included above.

  1. Right to erasure

You have the right to obtain from us the erasure of personal data concerning you without undue delay and we have the obligation to erase the personal data without undue delay where one of the following grounds applies:

  • the personal data is no longer required in relation to the purposes for which it was collected or otherwise processed;
  • you have objected to the processing in accordance with section 8.c and there are no overriding legitimate grounds to continue with the processing;
  • the personal data has been unlawfully processed;
  • the personal data has to be erased for compliance with a legal obligation in the EU or Member State law to which we are subject.

This does not apply insofar as the processing is necessary:

  • for compliance with a legal obligation in the EU or Member State law which requires processing, to which we are subject
  • for the establishment, exercise or defence of legal claims

  1. Right to restriction of processing

You have the right to obtain from us the restriction of processing where one of the following applies:

  • the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
  • the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead;
  • we no longer require the personal data for the purposes of the processing but do require the data for the establishment, exercise or defence of legal claims;
  • you have objected to the processing in accordance with point 8.c pending the verification of whether our legitimate grounds outweigh yours.

Where processing has been restricted under letter f. such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

If you have obtained a restriction of processing, you will be informed by us before the restriction of processing is lifted.

  1. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your personal data infringes the regulations of the GDPR.

  1. No automated decision-making

Automated decision-making is not used for individual cases in the sense of Art. 22 GDPR. Therefore, a decision about your application shall not be exclusively based on automated processing.