Information about data processing

V2 (022024)

Aenova Holding GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by Aenova Holding GmbH.

Shared responsibility

With regard to interaction within the company account of Aenova Holding GmbH, Aenova Holding GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with Aenova Holding GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy one

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Pausing your online application

You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of Aenova Holding GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to Aenova Holding GmbH only.

Visibility of your data

The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.

Notes on the special functions of onlyfy one

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/

WhatsApp application

If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.

The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.

Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

YOUR PERSONAL DATA DURING THE APPLICATION PROCESS

Information on Data Protection

We are glad that you intend to apply for a vacant position in our company. Transparency and trustworthy handling of your personal data are an important basis for good cooperation. Therefore, we inform you about how we process your data and how you can exercise your rights that you are entitled to under the General Data Protection Regulation (GDPR). The following information provides you with an overview of the collection and processing of your personal data in connection with the implementation of the application process. Please read this Data Protection Declaration carefully before sending your application to us.

1. General

a) Who is responsible for the processing of data?

Controller within the meaning of Art. 4 No. 7 GDPR is:  Aenova Holding GmbH, Berger Straße 8 – 10, 82319 Starnberg

b) How to get in contact with the data protection officer?

For questions regarding data protection, please send an e-mail to: Datenschutz@aenova-group.com.

2. What is personal data?

According to Art. 4 No. 1 GDPR, personal data is all information relating to an identified or identifiable natural person.

3. What kind of data is used?

The following data or categories of data are processed in order to carry out the application process:

• Applicant master data (first name, last name, title, e-mail address, telephone number, address, date of birth, nationality)
• Qualification data (cover letter, letter of motivation, CV, previous activities, professional qualifications and skills)
• Voluntary information, such as an application photo, details regarding any severely disabled status or other information that you voluntarily provide to us in your application or upload voluntarily
• Additional questions depending on the respective tender (e.g., driver's license)
• The communication between you and us, as well as any comments and assessments written about you in the course of your application process
• Other data / data categories, e.g., publicly accessible, job-related data, e.g., a profile on professional social media networks such as XING or LinkedIn
• Special categories of personal data: Any information provided by you in your application documents that contains special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g., information that allows conclusions to be drawn about your sexual orientation; information about your health; information that allows conclusions to be drawn about your ethnic origin or your religion) shall also only be processed to the extent permitted by law.

4. For what purposes do we process your data and on what legal basis?

a) Data processing for purposes of the employment relationship - Art. 6 I sentence 1 lit. a) and b) EU-GDPR (fulfillment of a contract or of pre-contractual obligations)

Your personal data will be processed for the purposes of personnel selection to fill vacancies, i.e., to initiate an employment contract. The necessity and scope of the data collection are assessed, among other things, according to the position to be filled. If your intended position involves the performance of particularly confidential duties, increased personnel and/or financial responsibility, or is contingent upon certain physical and health conditions, more extensive data collection may be required. The legal basis in Germany is Art. 6 I sentence 1 lit. a) and b) EU-GDPR as well as Art. 88 I EU-GDPR in conjunction with. Section 26 I of the German Privacy Law (BDSG) (new). If the Aenova company to which you are applying is located in another European country, the legal basis for processing your data is Art. 6 I sentence 1 lit. a) and b) EU-GDPR.

b) Consent - 6 I sentence 1 lit. a and b and Art. 9 (2) lit. a EU-GDPR, Section 26 (2) of the German Data Protection Act (BDSG)

If you have given us your voluntary consent to the processing of certain personal data, then this consent forms the legal basis for the processing of this data.

In the following cases, we shall process your personal data on the basis of the consent given by you:

• Registration in the applicant pool, i.e., we keep the application documents stored beyond the current application process so that we may consider your application in subsequent application processes and get into contact with the candidate pro-actively
• Forwarding of the documents to other Group companies / to the Group-wide applicant pool, e.g., sending feedback questionnaire. In this context, we will only process the data that you have provided in the application process.

Where processing is based on consent, you have the right to withdraw your consent at any time with effect for the future. If possible, please send the withdrawal by e-mail to datenschutz@aenova-group.com. The lawfulness of the processing of your data until the time of withdrawal remains unaffected.

c) Data processing based on the legitimate interest - 6 sentence 1 lit. f) EU-GDPR

In certain cases, we will process your data to protect a legitimate interest of ours or of third parties. A legitimate interest exists, for example, if your data is required to assert, exercise or defense any legal claims in the context of the application process (e.g., claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidentiary purposes.

5. With whom will your data be shared?

Your data will mainly be processed by our HR department. In some cases, however, other internal and external bodies are also involved in the processing of your data.

Internal bodies can be departments, divisions or the works council of our company.

We use Prescreen International GmbH as an external service provider. Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna (hereinafter "Prescreen") operates the e-recruiting system under the domain *.jobbase.io (hereinafter "jobbase.io"), on which companies can post job advertisements and receive and manage applications.

Within the scope of these activities, Prescreen processes personal data only on behalf of and for the purposes of Aenova Holding GmbH and is therefore a so-called processor within the meaning of Art. 4 No. 8 EU-GDPR.

Jobbase.io is the central platform for our applicant management. When you use our online form, your personal data is recorded directly in jobbase.io. Even you send us your application by postal mail or e-mail, your data can be transferred to the e-recruiting system. 

6. How long will your data be stored?

(1) We store your personal data as long as necessary to make a decision about your application. If no employment relationship between you and us materializes, your data will be deleted regularly within six months after the end of the application process. If there is a specific reason, we may also store data for a longer period of time, insofar as this is necessary for the defense against possible legal claims.

(2) If no employment relationship is established, but you have given us your consent for the further storage of your data ("applicant pool"), we will store your data until your consent is withdrawn, however no longer than for three further years. If there is a specific reason, we may also store your data for a longer period of time for the purpose of defending against possible legal claims.

(3) If you withdraw your application before the end of the application process, i.e., delete your data and your account, the stored data will be blocked for the period of the application process that is still ongoing and finally deleted after six months after the end of the application process.

(4) If you do not use your candidate profile any longer and have not consented to continued storage of your data in the applicant pool, the data will be deleted within six months after the end of the application process.

(5) You yourself can erase your candidate profile and your application documents at any time or submit a request for erasure or for restricted processing.

7. What rights do you have in connection with the processing of your data?

(1) You can request information about whether we have stored any personal data about you. If you wish, we will inform you which data we have stored, for what purposes the data is processed, to whom the data is disclosed, how long the data is stored and what other rights you have in relation to this data.

(2) In addition, you have the right to have your data rectified or erased. You may also request that we provide any personal data you have submitted to us in a structured, commonly used and machine-readable format either to you or to a person or company of your choice.

(3) Moreover, you have the right not to be subject to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning you. As part of the application process, we do not use exclusively automated processing for decision-making.

(4) And you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you carried out on the basis of Art. 6(1) lit. f) EU-GDPR (data processing to protect a legitimate interest), including profiling based on those provisions. If you object, we shall no longer process your personal data unless we can demonstrate compelling grounds, worthy of protection, for the processing which override your interests, rights and freedoms or the processing serves for the establishment, exercise or defense of legal claims.

(5) In addition, you have the right to appeal to the competent data protection supervisory authority.

(6) To exercise your rights, you can contact us by e-mail at datenschutz@aenova-group.com . We will process your requests promptly and in accordance with the legal requirements and inform you of the measures we have taken or will take.

8. Are you obliged to provide your personal data?

The provision of personal data is neither legally nor contractually required, nor are you obliged to provide the personal data. However, the provision of personal data is necessary to carry out the application process. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process.

9. What happens if you interrupt your online application?

You can interrupt the creation of your online application at any time and continue it at a later time. For this purpose, technically necessary cookies are used on the platform. During the application process, data is transferred to jobbase.io. I.e., the data provided by you for creating the user account as well as uploaded documents are recorded in jobbase.io. The data remains recorded even if you interrupt and/or do not complete an application. In this case, your application will be marked as incomplete and our company can access your data in a restricted manner.

You can view, edit or update the data you provided as part of the online application in your candidate profile at any time.

Provided you do not make any further changes in your candidate profile, for example, complete a current application, start a new application or change the data of an existing application, your data will be deleted within six months of the end of the last active application process.

You yourself can request erasure of your candidate profile and application documents at any time.  After the erasure request has been submitted, you will be informed of the exact erasure date and your data will be automatically erased according to the established terms of this Data Protection Declaration.

10. Reminder to continue your application

If you have not completed your application within 2 days, you will automatically receive a reminder e-mail to complete your application.

Controller of the data processing described below is Prescreen, not Aenova Holding GmbH.

Prescreen International GmbH

Mariahilfer Straße 17

A-1060 Vienna

For any questions under data protection law, kindly write to datenschutz@prescreen.io.

a) Automatically collected usage data

When accessing the domain jobbase.io, your internet browser will automatically transmit certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is collected by Prescreen:

• Date and time and duration of access;
• browser type/version;
• operating system used;
• URL of the previously visited web page;
• transferred amount of data;
• a GeoIP lookup is made based on the IP address (Internet Protocol address);
• name of the accessed files;
• http status code (e.g., "request successful");
• URL of the accessed web page; and
• access type (GET,POST).

This data is technically necessary to offer the functions of the e-recruiting system and to ensure its stability and security. It is stored by Prescreen for a period of 12 months. Data required to be stored further on for evidentiary purposes shall only be erased when the respective incident has been finally clarified.

The legal basis for the processing of the data is Art. 6 (1) lit. f) EU-GDPR.

b) Cookies

Prescreen uses cookies. They serve to make the online application more user-friendly and effective. The cookies are technically necessary to provide you with this website. Without the use of cookies, the website could not be operated. Therefore, there is no possibility to object to the use of cookies.

The legal basis for the processing of the data is Art. 6 (1) lit. f) EU-GDPR.

The following cookies are used by Prescreen:

Provider	Cookies	Purpose	Duration of storage
Prescreen	PHPSESSID	This cookie is used to identify the user while using Prescreen. The cookie is mandatory for correct functionality. The cookie loses its validity when the browser is closed.	Until the browser window is closed (session cookie).
Prescreen	REMEMBERME	This cookie is used to recover an expired session. The cookie is mandatory for correct functionality.	The cookie loses its validity after 2 weeks.