Data protection

Data Privacy Note for Job Applicants within the GPG Group in accordance with Articles 13, 14 and 21 GDPR

Date: July 2020

 

The following Data Privacy Note describes how and for what purpose CONTROLLER: GAZPROM Germania GmbH, (hereinafter also referred to as “GPG” or “we”) processes personal data of job applicants.

1. Responsibility for data processing and contact data

The controller responsible for processing your personal data is:

 

 

Where we process your data in joint controllership, please refer to Section 6.2. below.

 

You can contact our Data Protection Officer at:

 

2. Type of data processed

The type of data we process depends on the channel you choose to apply for a position with us. For the purpose of processing, please see section 4 below.

 

Group-wide we may provide several channels for your application. We process personal data that you provide us as part of your application. These personal data may include the following data or categories of data:

 

• Master data (e.g. title, last name, first name, e-mail address, telephone number, postal code and city)

• Application data (e.g. information about previous activities in the group, notice period, desired salary)

• Any special categories of data (Article 9 GDPR) you voluntarily provide with your application

• Data on your education

• Data on your non-professional interests

• Other data that you voluntarily provide us in the application process, such as those included in your letter of application, curriculum vitae or in job references

• Communication data: contents of personal, e-mail or telephone discussions and other data that may arise when we communicate with you (e.g. follow-up questions, when you use the contact form, etc.)

• Data on how you became aware of us or, where applicable, the name and data of the job fair where you contacted us

• Data on who referred you, in the case of the internal referral program, where employees can suggest other employees

• Data that may arise where IT-based tools support your application (e.g. language setting, settings, technical cookies)

• Data privacy statements:

  • Consent to processing of personal data

  • Statements of revocation of any consent you have given

  • Statements of objection to the processing of personal data

  • Statements asserting your rights to access, rectification, erasure, restriction of processing, and data portability, including the information that you provide to us when asserting your rights

In addition, we process personal data that we have generated ourselves:

 

• Applicant number

• Job subscription number (if applicable)

Furthermore, depending on national legislation, we may also process further data:

 

• E.g. police clearance certificate

• Data from the point of view of occupational health and safety 

Usually, we do not process personal data that we have received from third parties.  However, where we work with headhunters and recruiting agencies, your application data will be provided to us by such third parties. Please also see Section 5 on the sources of data.   

3. Length of data storage

We process and store your personal data to the extent necessary for the duration of the application process. If you start a job with us, your personal data will be added to your personnel file. Your personal data or application documents as such will be erased 12 months after your application status has been updated. You will not be notified separately about the erasure of the data. If you have sent us your application as a letter via mail, your documents will be returned to you.

 

This does not apply if your data are processed and stored in order to assert or exercise legal claims, or to defend against legal claims (duration of litigation) or we obtain a separate consent from you to keep your application documents longer, e.g. the talent pool.

4. Purposes of data processing and legal foundation

4.1 Purpose of data processing

What data we process depends on the channel through which your application reaches us. Usually you will have one of the following options, where we use them:

• Register and Login to our Portal

• Upload your application via our company-website

• Third-party job portals with an own website (e.g. Indeed.com, Stepstone.com, Headhunter.ru)

• Our internal job market on the intranet or the internal referral program  Participation in a job fair

• Via regular mail, e.g. by regular letter

• Via regular e-mail. Please observe, that in this case your data is not encrypted

• Headhunter or recruitment agency

Where our vacancies are announced on LinkedIn or Xing, these job vacancies are often automatically uploaded from our company-websites to our company pages. The same is the case for other professional network pages and where we promote a vacant position on Twitter. If you apply via these channels, your application will be forwarded to our central HR e-mail (e.g. jobs@, vacancy@, etc.)

4.2 Legal basis

We process your personal data in compliance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR) and national data protection laws, for various purposes. In principle, the purposes for which we process your data are:

Processing

• of data relating to employment relationship, thus to perform contractual obligations or steps prior to entering into a contract (Article 6 paragraph 1 point (b) GDPR),
• to safeguard legitimate interests (Article 6 paragraph 1 point (f) GDPR),
• for processing subject to your prior consent (Article 6 paragraph 1 point (a) GDPR) and/or
• to comply with legal obligations (Article 6 paragraph 1 point (c) GDPR).  

If you provide us with special categories of personal data pursuant to Article 9 GDPR, processing shall be based on Art. 9 para. 2 point (b) GDPR.

 

Specifically, we process your personal data for the following purposes and subject to the stated legal basis:

 

Purpose/Legitimate Interests	Processed data or categories of data	Legal Basis
Recruitment process and contract initiation including communication with you	Master data; application data; data on how you became aware of us; data on your education; data on your non-professional interests; other data that you voluntarily provide us in the application process; communication data	Article 6 paragraph 1 point (b) GDPR paragraph 26 German Federal Data Protection Act (BDSG)
When entering into a labour agreement with us: Transfer to the personnel file of the data subject. This serves as a review for abuse and as a basis for the subsequent professional development of the data subject	Master data; application data; data on how you became aware of us; data on your education; data on your non-professional interests; other data that you voluntarily provide us in the application process; communication data	Article 6 paragraph 1 point  (b) and (f) GDPR
Assert legal claims and defend against legal disputes	Master data; all personal data that are the subject of the legal claim or the legal dispute	Article 6 paragraph 1 point (f) GDPR
Administration of declarations of consent and revocation related to data privacy	Master data, declarations on data privacy	Article 6 paragraph 1 point (a) and (c) GDPR
Objection management (administration of notices of objection related to data privacy matters)	Master data, declarations on data privacy	Article 6 paragraph 1 point (c) GDPR
Management of the rights of the data subjects (processing of data subjects’ requests for information, rectification, erasure, restriction of processing and data portability in order to fulfil the data privacy rights of the data subjects)	All data or categories of data that are the subject of the respective request.	Article 6 paragraph 1 point (c) GDPR
Access administration to our recruitment portal	Logging data for security measures and ensure appropriate measures for safety of your data	Article 6 paragraph 1 point (f) GDPR
Sharing personal data within the Group for internal administrative purposes	IT and HR data, where these are Shared Services	Article 6 paragraph 1 point (f) GDPR, Recital 48
Data you share voluntarily to give us a fuller picture of your profile	Any sensitive data you share with us voluntarily	Article 6 paragraph 1 point (a) GDPR, where applicable Article 9 GDPR
Further data processing under national legislation	Data which must or may be processed under national legislation: e.g. police clearance certificate, residence permit.	Article 6 paragraph 1 point (c) and (f) GDPR
Include your application in our talent pool	Your application data	Article 6 paragraph 1 point (a) GDPR

 

Where our websites use cookies, please refer to the Data Protection Declaration of our websites. Our recruitment platform may use cookies that are strictly necessary or that are necessary to support a functionality. We do not use cookies for tracking.

 

Where third party platforms use cookies and tracking tools, please refer to the privacy language provided by the respective controller. 

5. Sources of data

Usually, we only gather data from you. However, in some cases we also receive data from third parties, as described above. Therefore, your data may be provided to us by headhunters or other recruitment agencies, colleagues, references or service providers who work for us.

 

If you have expressly included parties who we may contact about you, we may contact your references (e.g. former employers or former team members). Before you provide data relating to third parties to us, please ensure that you are permitted to do so and that you make them aware of the information contained in this Note.

 

Further, we may research you in professional networks such as LinkedIn. We will not gather data about you in private channels, such as Facebook. 

6. Recipients and categories of recipient

Personal data can be passed on to the following recipients and categories of recipient:

 

Within our company, access to your data is granted solely on a need-to-know basis. During the application process, this may include the respective HR business partners of the human resources and recruiting department, interviewers and managers in the business area with a vacancy and, where applicable the responsible committee (works council, if appropriate also the severely handicapped employee representative). The IT staff will also process your data if and to the degree necessary for the performance of their roles (e.g. IT support in technical matters).

6.1 Processors

We use service providers who process personal data on our behalf (termed “processors”; cf. Article 4 no. 8 and Article 28 GDPR). They include IT service providers and may also include the following:

• Providers of professional services

• Providers of IT services

• Providers of HR-related tools 

6.2 Passing on to third parties

If we are authorized pursuant to contractual or statutory provisions or your declaration of consent, we may also pass on your data to other GPG Group companies, which process the data as joint controllers in the meaning of Article 26 GDPR.

 

Such joint controllership takes place in the following constellations 

• Recruitment and HR

• IT services

For these cases, we have concluded Joint Controllership agreements.

 

The main content of these agreements on joint responsibility is the regulation of the scope of responsibility in the processing of your personal data. For example, each party against whom you make a claim is responsible for the fulfillment of this claim. Each party is also responsible for the own legality of data processing regarding the establishment and performance of an employment relationship. If candidates are selected for interview, the parties shall act as joint data controllers.

 

In addition, the agreement regulates the responsibility between the controllers for the cases when the data subjects exercise their rights. This refers to the right to rectify, delete or block personal data. Other important points of the agreement include the purpose of the data processing as well as the duration and termination of the agreement.    

7. Transfer of personal data to a third country or international organization

In some cases, we transfer your personal data to the following third countries (countries outside the European Economic Area (EEA)):

• GAZPROM Germania GmbH, St. Petersburg branch (Russian Federation)

• Gazprom Marketing & Trading Limited, St. Petersburg branch (Russian Federation)

Your data is transferred only if an adequate level of protection for the data is guaranteed in the third country in question (Article 45 GDPR), there are appropriate safeguards (cf. Article 46 GDPR) or transfer is otherwise permitted by law (cf. Article 49 GDPR). 

8. Obligation to provide data

As part of your application, you must only provide personal data that is required to initiate and conduct this process. You are not obliged to provide this data, however be aware that in this case, depending on the data, we may usually have to refuse your participation in the application process.

 

9. Automated decision-making and profiling

We do not use your personal data for automated decision-making, including profiling.

10. Rights of data subjects

10.1 Access to and information on, rectification and deletion of data, restriction of processing, and data portability

Every data subject has the right to access personal data and obtain information on it (Article

15 GDPR), the right to rectification of data (Article 16 GDPR), the right to deletion of data (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), and the right to data portability (Article 20 GDPR). You can get in touch with us using the contact data specified in Section 1 “Responsibility for data processing and contact data” to exercise the above rights.

 

10.2 Right to object to processing in accordance with Article 21 of the General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 paragraph 1 point (f) GDPR (data processing based on a weighing of legitimate interests), including any profiling based on those provisions within the meaning of Article 4 No. 4 GDPR. If you object, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. If we process your personal data for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes. Your objection can be submitted without using a special form and should be sent to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”. You will not incur any costs other than the basic costs of transmission for that.

10.3 Revocation of consent

If you have given us your consent to process your personal data, you can revoke such consent at any time. As a consequence we shall not process your data on basis of the aforementioned consent. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before you withdrew it or the data processing based on another legal basis.

 

Please send your revocation to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”.

11. Right to lodge complaints with the supervisory authority 

Under Article 77 paragraph 1 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the law, in particular the General Data Protection Regulation (GDPR). In this case you have the right to turn to the supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Irrespective of your aforementioned rights please feel free to contact us directly regarding your concerns (for contact details see Section 1 “Responsibility for data processing and contact data”).