Privacy policy for applications

We are delighted to receive your application. In this document we explain how we process your personal data as part of the application process and how we retain other relevant information.

1. Who is responsible for processing your personal data?

ATH Altonaer-Technologie-Holding GmbH, Schützenstraße 105, 22761 Hamburg (hereinafter referred to as "We", is the controller within the meaning of the EU General Data Protection Regulation (GDPR).

2. Data protection officer

If you have any queries regarding the processing of your personal data and the assertion of your rights pursuant to the GDPR, please contact our data protection officer Markus Riester on +49 (0)40 85393 02 / datenschutz@kroenert.de for advice.

3. For which purposes and on which legal basis do we process your personal data?

We process your personal data for the purpose of your application for employment, insofar as this is required to decide on the justification for employment with us. The legal basis for this is Section 26(1) in conjunction with (8)(2) BDSG (Federal Data Protection Act).

Insofar as your application documents contain photographs, we consider this to be implied consent to the processing of the photograph (in particular viewing and saving the photograph in the case of saving the application documents). In accordance with Art. 7 (3) sentence 1 DSGVO, you are entitled to revoke this consent at any time.

Furthermore, we can process your personal data insofar as this is required to defend against legal claims made against us in conjunction with the employment. The legal basis for this is Article 6(1)(f) GDPR. If an employment contract is concluded between us and you, we can continue to process the personal data already received from you for the purpose of employment pursuant to Section 26(1) BDSG, insofar as this is required to perform or terminate the employment or to exercise or fulfil the rights and obligations of the employee's representation.

4. Which categories of personal data do we process?

We process data that relates to your application. This can be general data about you (such as your name, address and contact details), information about your professional qualifications and reduction, information about your professional further training, or other details that you send to us as part of your application. In addition, we can process professional information that you make publicly accessible, such as a profile on professional social media.

5. From which sources is personal data obtained if we do not collect it from you?

Insofar as we do not collect the data directly from you and you have an active profile on StepStone, or inform us of an inactive or partially active profile as part of the application process, we can also collect personal data from there.

6. Which categories of recipient data exist?

We can send your personal data to our associated companies, insofar as this is permitted within the purpose and legal bases set out under point 3. In addition, personal data is processed on our behalf on the basis of contracts pursuant to Article 28 GDPR, particularly by host providers or providers of applicant management systems.

7. Do we intend to send data to a third country?

There is no intention to send data to a third country.

8. How long will your data be stored for?

We store your personal data for as long as it is required to decide on your application. If no employment contract is concluded between you and us, we can continue to store your data, insofar as this is required to defend against possible legal claims. Application documents will be stored for two months after disclosure of the rejection decision, unless a longer storage period is required due to legal disputes.

9. What rights do you have?

By applying to us you have the following data protection rights, depending on the individual situation. You can contact us or our data protection officer at any time using the details set out in paragraphs 1 and 2 if you have any queries on the exercising of these rights:

a. Access

You have the right to obtain information on the personal data we process and to request access to your personal data and/or copies of this data. This includes information on the purpose of use, the category of data used, the recipient and person authorised for access and, if possible, the planned duration of data storage or, if this is not possible, the criteria for specifying this duration.

b. Rectification, erasure or restriction of processing

You have the right to request us to immediately rectify any incorrect personal data. Depending on the purpose of processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

c. Right to object

If your personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing of this data at any time on grounds arising from your specific situation. We will then no longer process this personal data, unless we can prove there are compelling and legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defence legal claims.

d. Right of withdrawal

If the processing is based on consent, you have the right to withdraw your consent at any time without this affecting the legitimacy of the processing carried out up until the point that consent is withdrawn. To do this, contact us or our data protection officer at any time using the details above.

e. Right to erasure

You have the right to request that we erase your personal data with immediate effect and we are bound to immediately erase this personal data, insofar as any of the following grounds exist:

  • The personal data is no longer required for the purpose for which it was collected or processed.
  • You object to the processing in accordance with point 9.c above and there are no overriding legitimate grounds for processing.
  • The personal data was processed unlawfully.
  • Erasure of the personal data is required to fulfil a legal obligation under EU law or the law of the Member State by which we are governed.

This does not apply if processing is required:

  • To fulfil a legal obligation that requires processing under EU law or the law of the Member State by which we are governed.
  • To assert, exercise or defend legal claims.

f. Right to restriction of processing

You have the right to request us to restrict processing if any of the following requirements is met:

  • You dispute the accuracy of the personal data and for a period that allows us to check the accuracy of the personal data;
  • Processing is unlawful and you reject the erasure of the personal data and instead request the restriction of use of the personal data;
  • We no longer require the personal data for the purpose of processing, but you require it to assert, exercise or defend legal claims; or
  • You have objected to the processing in accordance with point 8.c above, if it is not clear whether or not our legitimate grounds outweigh yours.

If processing has been restricted in accordance with this point f, this personal data may, apart from storage, only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or on grounds of an important public interest of the EU or a Member State.

If you have instructed a restriction on processing, we will inform you before the restriction is lifted.

g. Right of appeal

Notwithstanding any other administrative or judicial legal redress, you have the right of appeal to a supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the suspected violation, if you are of the opinion that the processing of your personal data violates the GDPR.

10. Need for the supply of personal data

The supply of personal data is prescribed neither by law nor contract, nor are you bound to supply personal data. However, the supply of personal data is required to conclude an employment contract with us. This means that if you fail to supply any personal data with an application, we will not enter into employment with you.