Data privacy statement for applicants
At this point we would like to inform you about how we handle your application data and what you and we need to be aware of in this context.
If you are a minor (applicant younger than 18), by submitting your application you declare that your parents/legal guardians consent to the application.
Your data are entered and transferred via the internet in encrypted form. Please note that even secure communication via the internet cannot entirely rule out the possibility of unauthorised parties obtaining and manipulating your data. Due to the nature of the internet, we cannot guarantee that, despite diligent technical and organisational measures, your application documents will reach us completely and correctly if an error occurs outside of our systems during their transfer.
Who is responsible for data processing (controller)?
The data controller as defined by data protection law is
Sunnic Lighthouse GmbH
Contact: Arved von Harpe, Managing Director
T +49 40 756 64 49 - 444
F +49 40 756 64 49 - 699
Further information about our company, authorised representatives and further contact details are available in our Legal Notice on our website: www.sunnic.de/impressum
What type of data do we process? And for what purpose?
We process the data you have sent us in connection with your application in order to assess your suitability for the position (or other open positions in our companies, if applicable) and to carry out the application process.
What is the legal basis for this?
The legal basis for the processing of your personal data in this application procedure is primarily Section 26 BDSG. Accordingly, the processing of data required in connection with the decision on the establishment of an employment relationship is permissible. Should the data be required for legal prosecution after completion of the application procedure, if applicable, data processing may be carried out on the basis of the requirements of Art. 6 DSGVO, in particular to safeguard legitimate interests pursuant to Art. 6 (1) lit. f) DSGVO. Our interest then consists in the assertion or defense of claims.
How long are data stored?
After completion of the application process, we will initially store the data you send us for six months in order to be able to answer any questions in connection with your application. Following this retention period, we will delete your data without further request. If your application is successful, we will use the data provided for personnel administrative tasks in the context of employment.
What recipients are the data transferred to?
Your application data are reviewed by the personnel department after we receive them. Suitable applications are then transferred internally to the department heads responsible for the open position. Then, the further process is coordinated. As a general rule in our company, only those persons have access to your data who need them for the proper processing of your application.
Where are the data processed?
As part of our recruiting processes, your personal data is processed by a central office within our corporate group. In principle, only those persons have access to your data who require this for the proper course of our application process. After receipt of your application, your applicant data will be viewed by the HR department of Enerparc AG. In addition, the company management responsible for the vacancy and the relevant department as decision-makers will have access to your documents. Then the further procedure will be coordinated.
Enerparc AG uses an online application portal for the application process. Your data is therefore stored and processed on the systems of the software partner, the company d.vinci HR-Systems GmbH ("d.vinci"), Nagelsweg 37-39, 20097 Hamburg. Enerparc AG has concluded an order processing agreement with d.vinci in accordance with Art. 28 DSGVO and has jointly undertaken the necessary organizational and technical measures to ensure the confidentiality of your application.
To simplify the application process, we also offer features where third-party vendors assist with data entry:
"Use XING profile": If you have set up a XING profile, XING will then transfer to us - if available - the data requested in the application form and specified by you on XING. The application form is then pre-populated with your data, but you can still make corrections and additions. XING also collects and processes data itself and may link it to the account you have set up if you use this option. The transfer of data to XING is based on Art. 6 (1) lit. f DSGVO. Our legitimate interest lies in an attractive and simple design of our application process. In order to address as many applicants as possible and to lower the hurdles for submitting an application, we integrate the XING portal, which has a high degree of penetration as a professional and business network. Xing is a service of New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. Information on data protection can be found at https://privacy.xing.com/de/datenschutzerklaerung.
"Use LinkedIn Profile": If you have set up a LinkedIn profile, LinkedIn will transmit the stored data to us at your instigation. LinkedIn collects and processes data itself and, if applicable, links it to your set-up profile if you use this option. The data transfer to LinkedIn is based on Art. 6 para. 1 lit. f DSGVO. Our legitimate interest lies in simplifying our application process by making ourselves more attractive to applicants through the integration of widely used services. LinkedIn [is an offer of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Information on data protection can be found at https://www.linkedin.com/legal/privacy-policy.
"Upload CV": CV parsing is a functionality that automatically captures application-relevant data from a resume you upload and inserts it into the input fields of the applicant questionnaire. d.vinci uses a product of Textkernel BV, Nieuwendammerkade 28/a17, 1022 AB, Amsterdam, The Netherlands for the applicant tool and specifically for the CV parsing function. Textkernel BV is a subcontracted processor of d.vinci. For privacy information, please visit https://www.textkernel.com/privacy-policy/.
Where is the data processed?
In principle, your data is processed in Germany as well as in other countries within the EU. If your personal data is processed in a country outside the EU or if recipients of your personal data are located outside the EU where the level of data protection may not be equivalent to that of the EU, the following applies: we ensure that these are only countries for which the EU Commission has decided that they have an adequate level of data protection. In cases where the recipient country's level of data protection is not comparable to that of the EU, we comply with the requirements developed by the EU and use so-called standard contractual clauses. These are available upon request via one of the contact options mentioned above.
You have the right to information about your personal data that we process. If you make your request for information in non-written form, please understand that we may require proof from you to document that you are the person you claim to be.
You also have the right to correction or deletion or the limitation of processing, provided you are entitled to this by law.
Furthermore, you have the right to object to the processing within the legal regulations. The same applies to your right to data portability.
Right of objection
Insofar as we process personal data as explained above in order to protect our legitimate interests which prevail in the context of a balancing of interests, you can object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time. If the processing is carried out for other purposes, you only have the right to object if there are grounds arising from your particular situation.
After you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the purpose of asserting, exercising or defending legal claims.
This does not apply if the processing is for direct marketing purposes. Then we will not further process your personal data for this purpose.
Right to complain
You have the right to file a complaint about our processing of your personal data with a supervisory authority for data protection. A list of data protection representatives and their contact details is available at the following link:
Our data protection representative
We have appointed an external data protection officer. This person can be reached at the above address of the data controller with the address addition "personal – confidential for the data protection officer" as well as at firstname.lastname@example.org.
Last updated: Hamburg, 01.11.2022