Privacy policy for the AutoDo job platform

The protection and confidentiality of your personal data is of particular importance to us. To ensure the protection of your personal data, we have taken technical and organisational measures to comply with data protection regulations. This privacy policy informs you how we collect personal data as part of your application process and for what purpose the data is processed. Your data will be processed in accordance with this privacy policy and the applicable data protection provisions.

This privacy policy applies to the applicant management system of AutoDo GmbH.

1. Name and contact details of the controller

The controller pursuant to Art. 4 No. 7 of the General Data Protection Regulation (hereinafter: "GDPR") is:

AutoDo GmbH
Otto-Hahn-Straße 3
31303 Burgdorf
Germany
Phone: +49 5136 9755-0

2. Data protection officer

You can contact our external data protection officer at datenschutz[at]autodo.de. Any data subject can contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

3. Order processing

For the efficient implementation of application procedures, we use an applicant management system from Artrevolver GmbH, Roßmarkt 21, 60311 Frankfurt am Main, which operates the applicant management system as a processor within the meaning of Art. 4 No. 8 GDPR. A contract for order processing in accordance with Art. 28 GDPR has been concluded with the service provider, which ensures compliance with data protection regulations.

We remain your first point of contact for exercising your rights as a data subject and for handling the application process. You can contact us directly using the details of the controller provided above or, if specified, contact the data protection officer in confidence.

4. Subject matter of data protection

The subject of data protection is the processing of personal data, in this case in the context of applicant management. According to Art. 4 No. 1 GDPR, this includes all information relating to an identified or identifiable natural person (hereinafter "data subject") that is necessary for the execution of the application procedure and the initiation of an employment relationship, Art. 6 I b) GDPR.

In addition, data associated with the use of the applicant management system is also collected, so- called usage data. Usage data is data that is required to operate our websites, such as information about the start, end and scope of use of our website. This processing complies with the provisions of data protection and telemedia law.

As part of the application process and/or the use of the system, processing activities may also take place that are carried out either on the basis of legitimate interest pursuant to Art. 6 (1) (f) GDPR or on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. Processing activities for which there is a legal obligation to process or a public interest under Art. 6 (1) (c) and (e) GDPR, such as in the context of criminal prosecution or investigations by state authorities are also possible. You can determine and control the scope of processing yourself through individual settings in your web browser, the configuration of the corresponding cookie settings and your user behaviour.

5. Collection and use of your data

5.1. Visiting our website

For operational and maintenance purposes and in accordance with the provisions of the German German Telemedia Act (TMG), interactions are recorded ("system logs") that are required for the operation of the website or processed for system security purposes, for example to analyse attack patterns or illegal usage behaviour ("evidence function").

Your Internet browser automatically transmits the following data when you access the job platform:

  • Date and time of access,
  • Browser type and version,
  • Operating system used,
  • Amount of data sent,
  • IP address of the access

This data is not used for direct allocation in the context of applicant management and is promptly erased in accordance with the legitimate retention periods, unless longer retention is required for legal or factual reasons, such as for evidence purposes. In individual cases, retention for the aforementioned purposes may be considered. The legal basis is Art. 6 (1) (f) GDPR and the German Telemedia Act.

Heyrecruit is the recipient of your personal data and acts as a processor for AutoDo. This corresponds to the legitimate interest within the meaning of Art. 6 (1) sentence 1 (f) GDPR.

Your personal data will be stored by Heyrecruit for as long as is necessary for the purposes described, usually a maximum of 6 months.

You can find more information about Heyrecruit at Heyrecruit Datenschutz

5.2. Session Cookies

We store so-called "cookies" in order to offer you a comprehensive range of functions and to make the use of our websites more convenient. "Cookies" are small files that are stored on your computer with the help of your Internet browser. If you object to the use of cookies, you can prevent the storage of cookies on your computer by making the appropriate settings in your Internet browser. Please note that this may restrict the functionality and range of functions of our website.

We place a technically necessary session cookie (SESSION ID) on the job page. This cookie stores a so-called session ID, with which various requests from your browser can be assigned to the shared session. This allows your computer to be recognised when you return to our website. This session cookie is deleted when you log out or close the browser.

5.3. Data entered by the user

5.3.1. Application process

For an efficient and promising application, you can provide us with the following information as part of your application:

  • Name and contact details (e-mail address, address, telephone number)
  • Curriculum vitae data e.g.
    • School education
    • Vocational training
    • Work experience
    • Language skills
  • Further information you provide us with as part of your application (e.g. salary expectations, availability)
  • Profiles in social networks (e.g. XING, LinkedIn, Facebook)
  • Documents in connection with applications (application photos, cover letter, certificates, references, work samples, etc.)

The legal basis for processing in order to carry out the application process and to initiate an employment relationship is Art. 6 I b) GDPR. In addition, the use of the applicant management system by the controller is based on a legitimate interest pursuant to Art. 6 (1) (f) GDPR. If consent within the meaning of Art. 6(1)(a) is required for a specific processing activity, this will be obtained separately and transparently from you by the controller, unless it results from conclusive and voluntary behaviour on your part in accordance with the transparency requirement, such as voluntary participation in a video interview

5.3.2. Disclosure of data

Your data will not be passed on to unauthorised third parties in the context of applicant management and will be processed for the purposes stated in this privacy policy. For example, it is in the legitimate interest of internal departments and specialist managers of the controller to view the data, insofar as knowledge of the information from the application process is necessary and permitted for the selection of applicants or internal administrative purposes of the company. For this purpose, your data may be forwarded to third parties in the company by e-mail or within the management system. The legal basis may be Art. 6 (1) (f) and (a) GDPR.

The transfer to third parties also takes place in the context of order processing in accordance with Art. 28 GDPR, i.e. in the context of processing activities in which the controller has a legitimate interest in outsourcing processing activities that it is otherwise authorised to carry out itself. For this purpose, the controller shall take measures to ensure compliance with data protection regulations.

Disclosure to external third parties may take place for the defence of legal claims based on legitimate interest or in the context of the investigation of or disclosure to government agencies, insofar as this is required by law or there is an obligation to disclose. The information obligations towards data subjects within the meaning of Art. 13, 14 GDPR are guaranteed in advance of the relevant disclosure, insofar as these are to be fulfilled separately.

5.3.3. Social share buttons

It is possible to share the job adverts on various social networks. Different buttons are provided for each network. After clicking on one of these buttons, you will be directed to the respective networks and will be taken to their login pages. These buttons are not plug-ins and do not transfer any personal data directly to the operators of the social networks.

The job adverts can currently be shared on the following social networks:

The legal basis is Art. 6 (1) (f) GDPR for the statistical analysis and reach measurement of job advertisements.

You can also use the links provided to find out how the social networks mentioned process your personal data. We have no control over the processing of your personal data by the social networks.

5.3.4. Matomo

Our website uses Matomo, an open-source web analytics platform, in order to understand the behaviour of our visitors and to continuously improve our content and services. Matomo is a privacy- friendly web analytics tool that allows us to collect anonymised information about the use of our website. This information helps us to understand how visitors interact with our website, which content is particularly relevant and how we can improve the user experience.

Matomo collects the following information:

  • Your IP address (anonymised, i.e. only the first two bytes are saved, e.g. 192.168.xxx.xxx)
  • Pages visited and time spent on these pages
  • Time and duration of the visit
  • Browser used, operating system and device type
  • Country of origin and region (based on your anonymised IP address)
  • Referring pages (i.e. from which page you came to us)

The data collected is stored and processed exclusively on our own server. We do not pass this information on to third parties. The data is only used for internal analyses and helps us to improve the user-friendliness of our website.

Matomo is configured in such a way that your IP address is automatically anonymised so that it cannot be directly linked to you personally.

6. Erasure and use of the data

Your data will be stored for the duration of the application process and in accordance with the legitimate retention periods after completion of the application process. In the event of a rejection, the data will be kept for 6 months. Following a successful recruitment, the data will be retained for a further 12 months. After the retention period has expired, the data will be completely erased.

7. Your rights as a data subject

7.1 Rights of data subjects

Data subjects are entitled to know at any time whether their personal data has been stored and can assert a right of access to stored data (right of access), verify its accuracy (right to rectification), request its completion and updating, request its erasure (right to be forgotten), request the restriction of processing (right to restriction) and have the data made portable in a commonly used, machine- readable format (data portability). These rights apply provided there are no compelling and/or legitimate grounds on the part of the controller to the contrary. To exercise these rights, please contact: datenschutz[at]autodo.de or send a letter to the address given above.

In cases in which we process data on the basis of your consent (Art. 6 (1) (a) GDPR), you have the right to revoke your consent at any time without giving reasons and with effect for the future. The corresponding data processing will then no longer take place in the future but will not affect the legality of the processing carried out up to the time of revocation. In addition, you have the right to object to processing, for example if the data is or was processed incorrectly, or if other reasons in the interests of the data subject prevent (further) processing. Data subjects also have the right to lodge a complaint with the supervisory authority responsible for data processing.

Please note that in the event of an objection and/or revocation, certain services/processing activities cannot be provided or utilised insofar as the processing is necessary for these purposes.

8. Changes to this privacy policy

We reserve the right to amend or supplement this privacy policy at any time with regard to the constantly changing legal, technical and organisational requirements for the processing of personal data. This also applies to any translation errors and differences with regard to national legal data protection requirements.

Version 1.0.0 | September 2024