We have talent.

Information on data protection for applicants

This data protection information applies to the data processing by:

 

GECO Deutschland GmbH

Schellerdamm 16, D-21079 Hamburg

T +49 40 764 007 0

F +49 40 764 007 20

info@geco-group.com

- in the following "GECO Deutschland" or "we" –

 

The data protection officer of GECO Deutschland is available at

a.s.k. Datenschutz e.K.,

T +49 9155 263 99 70,

extdsb@ask-datenschutz.de

 

Overview

  • Collection and storage of personally identifiable data and the nature and purpose of their use; Legal Bases
  • Registration on our website
  • Your application documents
  • Research in social networks
  • Matching
  • Personnel selection interviews
  • Defence in legal disputes
  • Establishment of an employment relationship with you
  • What categories of recipients of personally identifiable data are there?
  • How long will your data be stored?
  • What are your rights?
  • Your rights as a data subject
  • Revocation of consent given to us
  • Your right to object
  • Right to lodge a complaint with the supervisory authority
  • st he provision of personally identifiable data necessary?
  • Does automated decision making take place?

 

Collection and storage of personally identifiable data and the nature and purpose of their use; Legal Bases

We process personally identifiable data about you only to the extent necessary for the purpose of deciding on the establishment of a project-related cooperation or employment relationship with us or our customers, insofar as you agree to be included in our applicant database.

The legal bases for the processing are

  • Art. 6 Para. 1 lit. a, 9 Para. 2 lit. a GDPR, if the processing is based on your consent given to us;
  • Art. 6 Para. 1 lit. b DGDPR, insofar as the processing is necessary for the decision on the establishment of a project-related cooperation or an employment relationship with us or our customers;
  • Art. 6 Para. 1 lit. c, 9 Para. 2 lit. b GDPr, if there is a legal obligation for the processing;
  • Art. 6 Para. 1 lit. f GDPR, insofar as the processing is necessary for the protection of our or third parties' legitimate interests and does not conflict with overriding interests or your fundamental rights and freedoms.

 

Note: In its judgment of 30 March 2023 (Case C-34/21), the European Court of Justice ruled that Art. 88 GDPR only permits national legislation in the employment context if such legislation contains more specific provisions for the protection of employees. We are convinced that Section 26 (1) sentence 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) does not constitute a more specific provision in this sense, because Section 26 (1) sentence 1 BDSG merely repeats the requirements of Art. 6 Para. 1 lit. b GDPR for the establishment, performance and termination of employment relationships. Such provisions must remain unapplied according to the aforementioned ECJ ruling. We therefore no longer refer to Section 26 (1) sentence 1 BDSG as the legal basis in this information on data protection for applicants, but refer solely to Art. 6 Para. 1 lit. b GDPR. This has not resulted in any changes to the data processing procedures at GECO Deutschland, and your rights as a data subject remain unaffected.

 

Job applications and applicant database

About our website www.geco-group.com you can apply for specific project or job offers with no obligation (see „Application documents“). With your consent, we can permanently include your personal data in our database in ft heo be able to consider you in the context of our own activities for the purpose of deciding on the establishment of a project-related cooperation or an employment relationship with us or our customers (see „Matching“). Please also note the general data protection information for visiting our website at https://www.geco-group.com/privacy_policy. Data for the purpose of registration in our applicant databse will only be transmitted to us if you have declared by clicking the appropriate checkbox (opt-in) that you consent ft he collection, storage, processing, use and transmission of your data in accordance with Article 6 (1) (a) ft he GDPR. Only the information that is required for the purpose of deciding on the specific vacancy is processed by us on the basis of Art. 6 Para. 1 lit. b GDPR.

 

The following categories of personally identifiable data are collected during the application and/or registration process: Company, name, date of birth, nationality, native language, contact details, homepage / additional online profiles, details of the desired employment relationship or project preference, certifications, details of how you became aware of us, also, where appropriate, the IP address and time of your consent.

 

Please note that in particular CVs, certifications, cover letters or any other data you provide for the purpose of the presentation will regularly include information on "special categories of personally identifiable data" in the sense of Article 9 (1) of the GDPR (e.g. a photograph that shows your ethnic origin, information on the status of a severely disabled person, etc.). GECO would like to evaluate all candidates only according to their qualification and therefore requests that such information or "special categories of personally identifiable data" are not, as far as possible, included. If you nevertheless provide us with information of this type, you agree that we may process this information as described herein, and in the sense of Article 9 (2) (a) of the GDPR. It goes without saying that information with which you provide us voluntarily, in particular "special categories of personally identifiable data" in the sense of In the context of establishing a project-related cooperation or employment relationship with us or our customers, Article 9 (1) of the GDPR will of course not be taken into account in a discriminatory manner.

 

Your application documents

The legal basis for processing these is Article 6 Para. 1 of the GDPR, insofar as it concerns information which we request from you in the context of the application procedure for the establishment of an employment relationship with us or our customers or for the purpose of project-related placement with one of our customers (name, contact details, date of birth, details of your professional qualifications and school education or details of further professional training). If you voluntarily provide us with additional information in your application documents (such as an application photo, details of social or voluntary work), we will process this information on the basis of your consent (Article 6 (1) (a) of the GDPR).

Please note that in particular CVs, certifications, cover letters or any other data you provide for the purpose of the presentation will regularly include information on "special categories of personally identifiable data" in the sense of Article 9 (1) of the GDPR (e.g. a photograph that shows your ethnic origin, information on the status of a severely disabled person, etc.). GECO would like to evaluate all candidates only according to their qualification and therefore requests that such information or "special categories of personally identifiable data" are not, as far as possible, included. If you nevertheless provide us with information of this type, you agree that we may process this information as described herein, and in the sense of Article 9 (2) (a) of the GDPR. It goes without saying that information with which you provide us voluntarily, in particular "special categories of personally identifiable data" in the sense of In the context of establishing a project-related cooperation or employment relationship with us or our customers, Article 9 (1) of the GDPR will of course not be taken into account in a discriminatory manner.

 

Research in social networks

GECO is a specialised personnel service provider for the placement of highly qualified IT specialists. Either we place you as a freelancer in temporary project assignments (via GECO Deutschland GmbH) or as a candidate in a direct permanent position with our customers (via GECO Deutschland GmbH).

That is why we actively research information on interesting candidates and their professional careers, previous employers or further qualifications. We use external sources such as job portals (e.g. StepStone, monster.de) and professional social media networks (e.g. LinkedIn, Xing) if you have created a profile there. Under no circumstances will we view or evaluate other networks or profiles (e.g. on Facebook, Twitter, Instagram) in the context of our research.

The same applies in the case of recommendations. In many cases we receive contacts of qualified IT specialists from their colleagues, but also from our customers.

In the aforementioned cases, we initially store only a minimum record of your personally identifiable data, consisting of First and last name, e-mail address, city or postal code, main qualification (e.g. project manager), skills (e.g. SAP-HCM).

We perform this processing on the basis of Article 6 (1) (f) of the GDPR, based on our justified interest in offering the best possible career prospects to us and our customers, but also to you personally.

We will then inform you about the storage of this minimum data set and at the same time ask you for your consent to further process your personally identifiable data for the purposes stated herein, in particular for the purpose of placement in response to job offers from our customers (Article 6 (1) (a) of the GDPR). If you give us this consent, we will therefore process your data as described herein. Otherwise, we will immediately delete the minimum records collected.

 

Matching

On the basis of specific customer enquiries, we perform so-called "matching" in order to determine whether or not you fit a concrete project offer and/or a job offer from one of our customers. This means that we filter or derive skills (abilities) and experience from the data you send us (especially from the text of your CV, project history etc.) in order to then semi-automatically, automatically or manually assign you to the customer enquiry. These processing operations are carried out exclusively on the basis of the consent you have given us to be included in our applicant database, and in accordance with Art. 6 (1) (a) GDPR in conjunction with Art. 22 (2) (a) GDPR.

 

Personnel selection interviews

In the course of our personnel selection interviews, we invite those applicants who appear to be most suitable for the vacant position on the basis of their application documents. In these interviews we would like to get to know the applicants and their qualifications even better. The legal basis for the information thus communicated in addition to the application documents is Article 6 Para. 1 of the GDPR, insofar as the information consists of specific details and explanations regarding your professional career. Insofar as we request additional information from you (e.g. regarding soft skills, your expectations and your ideas with regard to possibly working for us), we collect this information on the basis of our justified interest in being able to assess our future colleagues as well as possible before the decision to establish an employment relationship is made, so that we can fill an advertised position in the best possible way, or offer our clients the best possible candidates to fill a position (Article 6 (1) (f) of the GDPR).

 

Defence in legal disputes

Furthermore, we can process personally identifiable data about you insofar as necessary for the defence of asserted legal claims resulting from the application procedure against us or against our customers. The legal basis for this is Article 6 (1) (f) of the GDPR; the legitimate interest is, for example, a burden of proof in proceedings under the German General Equal Treatment Act (AGG).

Establishment of an employment relationship with you

In the event that an employment relationship or other contractual relationship between you and us or one of our customers is concluded, we may, pursuant to Article 6 (1) (b) of the GDPR, use the personally identifiable data already received from you for the purposes of the employment relationship or other contractual relationship, insofar as necessary for the performance or termination of the employment relationship or other contractual relationship, or for the exercise or fulfilment of rights and obligations arising from a law or a collective agreement.

 

What categories of recipients of personally identifiable data are there?

Your personally identifiable data will not be transferred to third parties for purposes other than those listed below. We will only pass on your personally identifiable data, which we have collected during the application process, to third parties if:

  • you have given your express consent in accordance with Article 6 (1) (a) of the GDPR, possibly also Article 26 (2) of the GDPR, possibly also Article 9 (2) (a) of the GDPR,
  • the disclosure pursuant to Article 6 (1) (f) of the GDPR is necessary for the assertion, exercise or defence of legal claims, and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
  • a legal obligation for disclosure exists pursuant to Article 6 (1) (1) (c) of the GDPR, and possibly also Article 9 (2) (a) of the GDPR, and
  • this is legally permissible and required under Article 6 (1) (1) (b) of the GDPR for the establishment or processing of contractual relationships with you.

We will then, in particular, forward your personally identifiable data to our customers, inasmuch as your profile is of interest with regard to a project-related or permanent position that they are attempting to fill. In the course of this, we endeavour to initially show our customers only anonymised profiles, and only make personally identifiable data accessible at a later stage in the decision-making process. However, certain clients may wish to receive personalised candidate profiles right from the start. In these cases, we will ask for your consent prior to sending your data and will not send data to the customer in question until you have given us this consent.

We will also pass on your data to our customers if we have concluded an employment contract with you and deploy you to our customers.within the scope of a temporary employment contract.

Furthermore, your data will be passed on to technical service providers on the basis of Article 28 of the GDPR, who will use your data exclusively on our behalf and under no circumstances for their own business purposes. These are our IT service providers.

These IT service providers include in particular our group parent company, Yoh Services LLC ("Yoh Services"), based in Philadelphia, PA, USA. Yoh operates the technical platform for the entire group of companies, and thus also for GECO Deutschland GmbH, via which we display our job offers on our website, on which you register and via which we manage your data for individual job placement procedures or the applicant database. Your data will nevertheless remain solely under our control, and other companies in our group of companies will not have access to the data and will not contact you with job offers or in any other way. Your data will generally be processed on servers within the European Union. In order to ensure an appropriate level of data protection also in the context of technical support by Yoh Services and its sub-service providers, we have concluded a contract incorporating the EU standard contractual clauses (Art. 46 DS-GVO) and have taken further measures to protect your data..

How long will your data be stored?

We store your personally identifiable data for as long as is necessary for the decision on your application. If an employment relationship does not ensue, we can also continue to store data insofar as necessary for the defence against possible legal claims. The application documents will be deleted six months after notification of the rejection decision, unless longer storage is necessary due to legal disputes.

Apart from the cases mentioned above, we will only store your application if you have given us your express consent to do so. In these cases, we will store your application in our database so that it may be taken into account for future job postings (Article 6 (1) (a) of the GDPR). We will delete your data from our database two years after the last contact relevant for the purpose of deciding on the establishment of a project-related cooperation or employment relationship with us or our customers.

Data that you, as a registered user, have stored yourself in our applicant database will remain there until you delete this data yourself or until you delete your account from our candidate database.

Data researched by us from external sources will be deleted from our mail systems after one month, unless you have given us your consent to process them permanently.

 

What are your rights?

Your rights as a data subject

You have the right:

  • to request information about your personally identifiable data processed by us in accordance with Article 15 of the GDPR. In particular, you may request information as to the purposes of the processing, the category of personally identifiable data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right of rectification, erasure, restriction of processing or opposition, the existence of a right of appeal, the origin of your data, if not collected from us, and the existence of automated decision making including profiling and, where applicable, meaningful information on the details of the data;
  • pursuant to Article 16 of the GDPR, to demand the immediate correction of incorrect or incomplete personally identifiable data stored by us;
  • pursuant to Article 17 of the GDPR, to demand the deletion of your personally identifiable data stored with us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest, or to assert, exercise or defend legal claims;
  • pursuant to Article 18 of the GDPR, to demand the restriction of the processing of your personally identifiable data, if you dispute the accuracy of the data, if the processing is unlawful but you refuse to delete it, and if we no longer require the data, but you require it for the assertion, exercise or defence of legal claims, or if you have lodged an objection to the processing pursuant to Article 21 of the GDPR;
  • pursuant to Article 20 of the GDPR, to receive your personally identifiable data that you have provided us with in a structured, common and machine-readable format, or to request that it be transferred to another responsible party.

 

Revocation of consent given to us

Pursuant to Article 7 (3) of the GDPR, you have the right to revoke your consent to us at any time. As a result of this, we will in future no longer be allowed to continue the data processing that was based on this consent. The permissibility of the processing until your revocation remains unaffected by this. If you wish to exercise your right of revocation, simply send an e-mail to datenschutz@geco-group.com.

 

Your right to object

 

If your personally identifiable data are processed on the basis of legitimate interests in accordance with Article 6 (1) (f) of the GDPR, you have the right to object to the processing of your personally identifiable data in accordance with Article 21 of the GDPR, provided that there are reasons for doing so arising from your particular situation, or if the objection is directed against direct marketing. In the latter case, you have a general right of objection, which will be implemented by us without you having to provide specific reasons. If you wish to exercise your right to object, simply send an e-mail to datenschutz@geco-group.com.

 

Right to lodge a complaint with the supervisory authority

 

You also have a general right of appeal to the competent data protection supervisory authority. The authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information, https://datenschutz-hamburg.de .

 

Is the provision of personally identifiable data necessary?

The provision of personally identifiable data is not required by law or contract, nor are you obliged to provide us with your personally identifiable data. However, the provision of personally identifiable data is necessary for the conclusion of a contract of employment or any other contractual relationship with us or our customers. This means that if you do not provide us with the above-mentioned personally identifiable data, we or our customers cannot and will not enter into an employment or other contractual relationship with you. Such an application would be futile.

 

Does automated decision making take place?

There is generally no automated decision in individual cases in the sense of Article 22 of the GDPR, i.e. we generally evaluate your application personally, and the decision on your application is generally not based solely on automated processing.

In the context of matching, only profiles that do not match the customer's requirements from the outset are (partially) automatically filtered out. Therefore, if your qualifications do not meet a customer's particular requirements, we may not consider you in the further process based solely on automated decision-making.

Automated decision-making is in no way based on special categories of personally identifiable data provided to us (Article 22 (4) of the GDPR) and is performed by us exclusively on the basis of your consent given to us in this respect.

Status: July 2023

Stay up to date with our newsupdate

To the newsupdate registration