Information about data processing
V2 (022024)
G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH.
Shared responsibility
With regard to interaction within the company account of G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH, G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
Data processing by New Work SE
onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
Job applications with onlyfy one
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
Pausing your online application
You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to G DATA CyberDefense AG, G DATA Advanced Analytics, G DATA Service GmbH only.
Visibility of your data
The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.
Notes on the special functions of onlyfy one
Calendar function
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/
WhatsApp application
If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.
The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.
Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.
Applicability of the Swiss Federal Data Protection Act (FADP)
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
Data protection information for applicants in accordance with Art. 13 of the General Data Protection Regulation (GDPR)
Thank you for your interest in our company. As part of the application process, we provide information in accordance with the GDPR on how we and our external service provider, New Work SE, process the personal data transmitted or collected.
The provision of personal data is voluntary, but necessary for the examination of an application and a possible conclusion of a contract. Unfortunately, we cannot consider your application without this data. Therefore, please only provide data that is necessary for the process.
To ensure that you are fully informed, you will find below all relevant information on the processing of personal data as part of the application process.
1. Responsibility
The company of the G DATA Group that advertises the respective position is responsible for the processing of your personal data:
G DATA CyberDefense AG (hereinafter referred to as G DATA)
Königsallee 178 a
D-44799 Bochum
E-mail:
info@gdata.deG DATA Advanced Analytics GmbH
Königsallee 178 a
D-44799 Bochum
E-mail:
info@gdata.deG DATA Service GmbH
Königsallee 178 a
D-44799 Bochum
E-mail:
info@gdata.de(hereinafter jointly referred to as ‘we’)
2. Our data protection officer
We are supported by our data protection officer in the fulfilment of our data protection obligations. The contact details of our data protection officer are
Ali Tschakari
Bitkom Servicegesellschaft mbH
Albrechtstraße 10
10117 Berlin
E-mail:
datenschutz@bitkom-consult.de As an external data protection officer, Bitkom Servicegesellschaft mbH is legally obliged to treat the enquiries of data subjects confidentially.
3. Data that we process
We process the personal data that you provide to us as part of an application via the contact form, by e-mail, by post or during an interview. This includes:
Personal data:
• First name, surname
• e-mail address, telephone number
• Date of birth, title, citizenship
• Address/location
Application-related information:
• CV with details of professional experience and training
• Letter of motivation
• Qualifications, awards, language skills
• Skills (e.g. Photoshop, MS Office)
• Application photo
• Uploaded files and documents
Additional information depending on the advert:
• Driving licence or other required proof
• Answers to specific additional questions
Communication data and system information:
• Written electronic communication with the company
• Comments and evaluations in the application process
• Surfing behaviour on the website (e.g. click behaviour, ‘log-in’ times, technical optimisation)
Due to the fact that no exclusively automated processing takes place when deciding on the application, there is also no automated decision-making in individual cases in accordance with Art. 22 GDPR.
4. Purpose and legal basis of data processing
We use the data to carry out the application process and then check whether we would like to offer you a position and hire you. The processing of your data is based on Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 sentence 1 BDSG.
If you provide us with special categories of personal data such as health data, the processing is carried out in accordance with Art. 9 para. 2 lit. b GDPR in conjunction with § 26 para. 3 BDSG.
If you successfully complete the application process and accept our offer, we will store your data for the purpose of establishing and implementing the employment relationship. The processing is carried out in accordance with Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 sentence 1 BDSG.
5. Recipient of your data
Your data is mainly processed by our HR department. In some cases, however, other internal and external bodies are also involved in processing the data. Categories of internal recipients are e.g. HR department, line managers, management.
6. External recipients of your data - onlyfy one
We use onlyfy one, a service provided by New Work SE, Strandkai 1, 20457 Hamburg, Germany, as an external service provider.
Onlyfy one, as part of the comprehensive XING offering, is an online platform that connects talents and companies. Companies can use onlyfy one to publish job adverts, identify interesting talents - including from the XING network if necessary - receive and manage applications and communicate directly with talents and applicants.
6.1 Joint responsibility
G DATA and New Work SE have a so-called joint responsibility within the framework of the company account in accordance with Art. 26 GDPR. Both parties jointly determine the purposes and means of data processing, as defined in Art. 4 No. 7 GDPR.
The current version of the agreement on joint responsibility pursuant to Art. 26 GDPR, which New Work SE concludes with the companies that use onlyfy one, can be viewed in the appendix to the GTC under the following link: https://www.xing.com/terms/onlyfy-one. There you will find all essential information about the agreement.
Further information on data processing, which is carried out either solely by New Work SE or as part of joint responsibility with G DATA, can be found in XING's privacy policy. The contact details of New Work SE and the data protection officer of New Work SE are also listed there.
7. Other service providers
In some cases, we involve external partners who support us in determining suitability and in the selection process. If this is provided for in an application procedure, we will inform you of this separately. The transmission of application data to the respective partner is based on our legitimate interest in a professionally sound and non-discriminatory selection process in accordance with Art. 6 para. 1 lit f GDPR.
8. How long will your data be stored in our onlyfy one company account?
We store your personal data for as long as is necessary to make a decision about your application.
Your data will be deleted within six months of the last interaction in the applicant management system. Your data will only be stored for longer if you have expressly consented to being included in our applicant pool. In this case, we will store your data for up to twelve months or until you withdraw your consent.
If your application is successful, we will transfer your data to our personnel administration systems. There it will be further processed for the purpose of implementing the employment relationship.
9. Third country transfer
Your personal data will not be transferred to a third country outside the EU/EEA. Should this be necessary in individual cases, the transfer will only take place in compliance with the legal requirements of Art. 44 et seq. GDPR.
10. Your rights as a data subject
With regard to the data processing listed here, you are entitled to various data subject rights that are regulated in the GDPR.
Right to information (Art. 15 GDPR) - You have the right to request information from us about your stored personal data. On request, we will provide you with a copy of the data that is the subject of the processing.
Right to rectification (Art. 16 GDPR) - You have the right to obtain from us the rectification of inaccurate personal data.
Right to erasure (Art. 17 GDPR) - You have the right to obtain from us the erasure of your personal data. Among other things, we are obliged to erase your personal data if it is no longer necessary for the purposes for which it was collected or otherwise processed, if you have withdrawn your consent or if the data has been processed unlawfully.
Right to restriction (Art. 18 GDPR) - Under certain conditions, you have the right to demand that we restrict processing. This includes if you dispute the accuracy of your personal data and we have to verify your objection. In this case, your data may not be processed by us, with the exception of storage, until the question of accuracy has been clarified.
Right to data portability (Art. 20 GDPR) - You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
Right to withdraw consent at any time (Art. 7 GDPR) - If the data processing by us is based on your consent, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected by the revocation.
Right to object at any time (Art. 21 GDPR) - If the processing of your data by us is based on the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6 para. 1 sentence 1 lit. e GDPR) or if the data processing is based on legitimate interests on our part, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests in stopping the processing.
You can object to the processing of your personal data for direct marketing purposes at any time without restriction.
To exercise your rights, please contact us directly at:
dsgvo@gdata.deRight to lodge a complaint (Art. 77 GDPR) - You also have the right to lodge a complaint with a data protection supervisory authority. You can contact the data protection supervisory authority of your usual place of residence or our company headquarters. The address of the supervisory authority responsible for us is
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestrasse 2 - 4
40213 Düsseldorf
Telephone: 0211/38424-0
E-mail:
poststelle@ldi.nrw.de
