Duty to Provide Information
pursuant to Article 13 of the GDPREmployees / Hiring Process
1. Data Controller
marcapo GmbH
Bahnhofstraße 4, 96106 Ebern
Phone: +49 9531 9220 0
Email: info@marcapo.com
2. Data Protection Officer
We have appointed a data protection officer.
THALES Attorneys at Law. Privacy Policy
Dr. Christian Szidzek & Partners
Kantstraße 38
97074 Würzburg
Tel.: 0931-46599018
Email: info@thales-datenschutz.de
3. Rights of Data Subjects
In accordance with the statutory requirements, you have the following rights in particular:
- Information about the personal data processed regarding you (Art. 15 GDPR),
- Rectification of inaccurate data (Art. 16 of the GDPR),
- Erasure of Personal Data (Art. 17 of the GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability, provided that the legal requirements are met (Art. 20 of the GDPR),
- Objection to processing, to the extent that Article 21 of the GDPR applies.
Withdrawal of Consent: If processing is based on your consent, you may withdraw your consent at any time, effective for the future. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.
4. Right to File a Complaint
Under Article 77 of the GDPR, you have the right to file a complaint with a data protection supervisory authority. For non-public entities in Bavaria, the following supervisory authority is specifically responsible:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
5. Application Process
The following information applies to the application and selection process, as well as to the voluntary opportunities listed on our careers page. The training quiz and the WhatsApp contact are offered exclusively in this context and are not used for employees.
Purposes and Legal Bases for Processing
The purpose of the processing is to conduct the application and selection process and to make a decision regarding the establishment of an employment relationship. This processing is carried out on the basis of Section 26(1), first sentence, of the BDSG. To the extent that specific processing activities serve to implement precontractual measures in response to your request, Article 6(1)(b) of the GDPR may also apply.
To the extent that special categories of personal data, as defined in Article 9(1) of the GDPR, are processed during the application process, such as health data you have provided or information regarding a severe disability or equivalent status, this will only occur if there is a legal basis for doing so—in particular, pursuant to Article 9(2) of the GDPR in conjunction with Section 26(3) of the BDSG—or if valid, explicit consent has been provided.
To the extent that you voluntarily provide us with additional information and the processing is based on consent, such processing is carried out pursuant to Article 6(1)(a) of the GDPR or, in the case of special categories of personal data, pursuant to Article 9(2)(a) of the GDPR in conjunction with Section 26(2) of the BDSG.
Categories of Processed Data
- Master and contact data,
- Application materials and information regarding professional experience, qualifications, and education,
- Communication and scheduling information from the application process,
- evaluations and decision-making data generated during the selection process,
- where applicable, special categories of personal data, to the extent that they are necessary for the application process or are provided by you, as well as, where applicable, salary expectations and profiles voluntarily provided on professional networking sites.
Recipients of Personal Data
Within marcapo GmbH, only those departments that require access to your data in order to carry out the application and selection process will have access to it. This may include, in particular, the Human Resources department, the relevant functional department, the responsible managers, and senior management. To the extent required by law or necessary in a specific process, employee representative bodies may also be involved.
To the extent that external service providers process personal data on our behalf, they do so in accordance with the data protection requirements applicable to data processors. Personal data will only be disclosed to other third parties if there is a legal basis for doing so or if you have given your consent.
Services Used and Further Processing
For the technical administration of the application process, we primarily use the recruiting platform Personio SE & Co. KG, Seidlstraße 3, 80335 Munich. Personio processes applicant data on our behalf based on a data processing agreement in accordance with Article 28 of the GDPR.
Optional Training Quiz for Career Guidance
We use Perspective Software GmbH for our voluntary apprenticeship quiz. The quiz is intended solely to help visitors to our careers page navigate the options and select an apprenticeship that suits them. Participation is not a prerequisite for applying and has no bearing—whether you participate or not—on any subsequent application or selection process at marcapo. The quiz does not perform any automated pre-selection or make any decisions regarding hiring or rejection. In connection with the technical provision of the quiz, the following data may be processed: IP address, browser and device information, time of access, and referrer information. This processing is carried out to ensure the secure and functional provision of the service based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the training quiz in a secure, stable, and user-friendly manner. If you subsequently voluntarily provide contact information, it will be transmitted to marcapo and processed exclusively for the purpose of sending you the information you requested regarding suitable training opportunities. To the extent that this processing is based on your consent, it is carried out pursuant to Article 6(1)(a) of the GDPR. Participation in the quiz alone does not result in your data being stored in our applicant management system; nor are the selections you make in the quiz used to evaluate a subsequent application.
Voluntary Contact via WhatsApp
On our Careers page, we provide a link to our WhatsApp account. A connection to WhatsApp is not established until you actively click on this link. The use of WhatsApp is voluntary and not a requirement for applying to marcapo. If you contact our HR team via WhatsApp, we will process the information you voluntarily provide in order to handle your inquiry regarding career and application matters. To the extent that the communication serves to initiate an employment relationship, the processing is based on Section 26(1), Sentence 1 of the German Federal Data Protection Act (BDSG). For general career inquiries, processing is based on our legitimate interest in handling inquiries voluntarily submitted to us in accordance with Article 6(1)(f) of the GDPR. We have no influence over further data processing by WhatsApp; WhatsApp’s privacy policy applies in addition.
According to its own statements, Perspective generally stores the data processed as part of the training quiz on servers located in Europe. However, Perspective uses subcontractors based in the United States of America, which means that access to personal data from the U.S. may be possible. To the extent that the respective recipients are certified under the EU-U.S. Data Privacy Framework, the transfer may take place on the basis of the corresponding adequacy decision by the European Commission. If this does not apply or if additional safeguards are required, the European Commission’s Standard Contractual Clauses are used in particular. For further information on the safeguards in place and how to obtain them, please contact our Data Protection Officer.
For more details about Personio, Perspective, and WhatsApp, as well as the data processed by each, please refer to the “Processing of Applicant Data” section of our Privacy Policy or to the privacy notices of the respective providers linked there.
Retention period
If an employment relationship is not established, we generally retain your application data for up to 90 days after the application process is completed. Data will only be retained beyond this period to the extent and for as long as necessary in a specific case to assert, exercise, or defend legal claims. Once this purpose no longer applies, the data will be deleted, provided that no statutory retention requirements preclude this. Further storage for the purpose of legal defense is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
If an employment relationship is established, the data required for that relationship will be transferred to Human Resources. You will be informed separately about further processing in accordance with Article 13 of the GDPR.
Talent Pool
Your application information will only be added to our talent pool if you have expressly consented to this. In this case, we use the data to contact you regarding suitable job openings. The legal basis is Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. The data stored in the talent pool will be deleted no later than 180 days after inclusion, unless you have revoked your consent or consented to further storage prior to that time.
Obligation to Provide
Providing the personal data required for the application and selection process is necessary so that we can review your application and decide whether to offer you employment. Without the required information, your application cannot be considered, or may not be considered in full. Voluntary information, as well as the use of the training quiz and contacting us via WhatsApp, are not affected by this; choosing not to provide or use these will not have any negative impact on your application.
Automated Decision-Making
The application process does not involve any decision-making based solely on automated processing, including profiling as defined in Article 22 of the GDPR. Furthermore, the voluntary training quiz does not result in either automated pre-selection or an automated decision regarding hiring or rejection.
6. Employment Relationship
The following information applies to the processing of personal data in connection with the establishment, performance, and termination of the employment relationship.
Purposes and Legal Bases for Processing
Personal data is processed to the extent necessary to establish, carry out, or terminate the employment relationship. The primary legal basis for this is Section 26(1) of the German Federal Data Protection Act (BDSG). To the extent that processing is necessary to fulfill legal obligations, it is additionally based on Article 6(1)(c) of the General Data Protection Regulation (GDPR) in conjunction with the relevant labor, tax, or social security laws. In individual cases, processing may be based on consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 26(2) of the BDSG. To the extent that processing is based on Article 6(1)(f) of the GDPR, the specific legitimate interests pursued will be identified in connection with the respective processing.
Special categories of personal data, in particular health data, are processed only to the extent that the requirements of Article 9 of the GDPR and Section 26(3) of the BDSG are met. Sick leave notifications and data on incapacity to work, insofar as health data is involved, are processed in particular on the basis of Article 9(2)(b) of the GDPR in conjunction with Section 26(3) of the BDSG, to the extent that this is necessary for the exercise of rights or the fulfillment of legal obligations under labor law as well as social security and social protection law. By contrast, genuine occupational health-related processing is based in particular on Article 9(2)(h) of the GDPR and the relevant occupational health and occupational safety regulations. The applicable legal basis is specified for each respective processing activity.
Key Processing Activities
| Processing / Purpose | Legal Basis | Retention/Deletion Criteria |
|---|---|---|
| Personnel Administration and HR Self-Service Management of employee master data, personnel records, vacation requests, and other types of absences, as well as other HR-related processes, particularly through Personio. | Section 26(1) of the Federal Data Protection Act (BDSG); supplemented by Article 6(1)(c) of the General Data Protection Regulation (GDPR), to the extent that legal obligations apply | For as long as necessary for the employment relationship; thereafter, in accordance with the applicable retention, record-keeping, and statute of limitations periods. |
| Sick Leave Notifications and Sick Leave Management Processing sick leave reports, periods of incapacity for work, and health-related absences, as well as fulfilling obligations—particularly those related to continued pay and social insurance—primarily through Personio. | Art. 9(2)(b) of the GDPR in conjunction with § 26(3) of the BDSG, to the extent that health data is processed for the purpose of exercising rights or fulfilling legal obligations under labor law as well as social security and social protection law; in addition, § 26(1) of the Federal Data Protection Act (BDSG) and Art. 6(1)(c) of the GDPR, to the extent applicable to the respective processing | For as long as this is necessary for absence management, continued pay, documentation for social security purposes, or to comply with legal obligations; the data will be deleted once these purposes and obligations no longer apply. |
| Payroll, Taxes, and Social Security Processing payroll and fulfilling reporting, contribution, and documentation obligations under tax and social security laws; in particular, DATEV and Microsoft Dynamics 365 Business Central can be used for this purpose. | Art. 6(1)(c) of the GDPR; § 26(1) of the BDSG; relevant tax and social security laws | In accordance with the applicable statutory retention and record-keeping periods. |
| Work Time and Other Absence Management Recording and managing working hours, vacation time, and other absences, as well as complying with legal requirements for documenting working hours. | Section 26(1) of the Federal Data Protection Act (BDSG); Article 6(1)(c) of the General Data Protection Regulation (GDPR), to the extent that legal obligations apply | For as long as required to meet documentation, accounting, and legal retention obligations. |
| IT, Communication, and Collaboration Systems Provisioning and administration of user accounts, email, communication, collaboration, documentation, and digital tools, particularly through Microsoft 365, Jira, and Confluence. | § 26(1) BDSG; supplemented by Art. 6(1)(f) GDPR, to the extent necessary for secure and proper IT operations | Usage and content data in accordance with the respective work and documentation purposes; accounts and permissions until they are no longer necessary; statutory retention periods remain unaffected. |
| IT Security, Authorization and Log Data Ensuring the proper and secure operation of IT systems, detecting and defending against security incidents, preventing unauthorized access, and ensuring the traceability of security-related events. Legitimate interest: Protecting employees, IT systems, company assets, and company and employee data from unauthorized access, tampering, loss, and misuse. | § 26(1) BDSG; if applicable, Art. 6(1)(f) GDPR | Log and security data shall be retained only for the period necessary for security monitoring, error analysis, investigation of misuse, and record-keeping; access permissions shall remain in effect until they are no longer necessary. |
| Access and Physical Authorization Management Controlling and securing access to business premises. Legitimate interest, to the extent that Article 6(1)(f) of the GDPR applies: Protection of employees, business premises, company assets, and personal data from unauthorized access and misuse. | § 26(1) BDSG; if applicable, Art. 6(1)(f) GDPR | Until the access authorization or the purpose no longer applies; any log data is retained only for as long as necessary. |
| Travel Expenses and Business Expenses Settlement and reimbursement of business-related expenses, as well as compliance with tax and commercial law documentation requirements. | Section 26(1) of the Federal Data Protection Act (BDSG); Article 6(1)(c) of the General Data Protection Regulation (GDPR); tax laws | In accordance with the applicable retention periods under tax and commercial law. |
| Human Resources Development, Training, and Continuing Education Planning, implementation, and documentation of qualification, training, and continuing education programs, as well as the required proof of qualifications. | Section 26(1) of the Federal Data Protection Act (BDSG); supplemented by Article 6(1)(c) of the General Data Protection Regulation (GDPR), to the extent that statutory obligations to provide evidence apply | For as long as necessary for qualification, documentation, and the performance of the employment relationship; statutory documentation requirements remain unaffected. |
| Occupational Safety and Health and Legal Duties of Care Compliance with statutory occupational safety, welfare, and protection obligations, to the extent that marcapo processes personal data for this purpose. | Art. 6(1)(c) of the GDPR; where health data is processed, additionally Art. 9(2)(b) of the GDPR in conjunction with § 26(3) of the BDSG and relevant occupational safety regulations | In accordance with the applicable legal requirements and only for as long as the data is necessary for the respective protection or verification purpose. |
| Occupational Health Screenings and Evaluations Conducting occupational health screenings or other medical evaluations, to the extent required by law. As a general rule, the employer receives only the information necessary to fulfill its obligations and no additional medical diagnoses or findings. | Art. 9(2)(h) of the GDPR in conjunction with the relevant occupational health and safety regulations; if the employer itself processes health data, § 26(3) of the BDSG also applies | In accordance with the legal requirements applicable to occupational health matters; the employer will retain the information only for as long as it is necessary to fulfill legal obligations. |
| Employer-Sponsored Retirement Plans Implementation and administration of company pension plans and related entitlements and documentation. | Section 26(1) of the Federal Data Protection Act (BDSG); in addition, Article 6(1)(c) of the General Data Protection Regulation (GDPR) and relevant statutory provisions | As long as claims, obligations to provide evidence, or statutory retention requirements remain in effect. |
| Voluntary publications, such as photos of employees Publication or use of images or similar data voluntarily provided for the specific purpose described in each case. | Art. 6(1)(a) of the GDPR in conjunction with § 26(2) of the BDSG, to the extent that consent is required | Until consent is withdrawn or the purpose ceases to exist, unless another legal basis permits continued storage. |
Recipients or categories of recipients
Within marcapo GmbH, only those departments that require personal data to perform their respective duties are granted access to it. These may include, in particular, the Human Resources department, relevant managers and specialized departments, senior management, and—to the extent required by law—the works council and the representative body for employees with severe disabilities.
Outside the company, personal data may be disclosed in particular to recipients specified by law, such as social security agencies, tax authorities, government agencies, and courts, as well as—depending on the specific purpose of processing—to educational institutions, vocational schools, professional associations, the Employment Agency, occupational health services, or healthcare providers. In addition, we use external service providers, particularly for personnel administration and HR self-service, payroll, ERP, IT and hosting, communication and collaboration, documentation, and support. This includes, in particular, Personio for personnel master data, personnel records, vacation and absence processes, as well as sick leave notifications and periods of incapacity for work. Other systems used include, in particular, Microsoft 365, Jira, Confluence, DATEV, and Microsoft Dynamics 365 Business Central. To the extent that service providers act as data processors, processing is carried out in accordance with the data protection requirements of Article 28 of the GDPR.
Transfers to Third Countries
In connection with specific IT, communications, collaboration, human resources management, and support services, personal data may also be transferred to countries outside the European Union or the European Economic Area, or processed from those countries. Such transfers are made only in compliance with the requirements of Articles 44 et seq. of the GDPR. If an adequacy decision by the European Commission exists for the respective recipient—in particular for U.S. companies certified under the EU-U.S. Data Privacy Framework—the transfer may be based on that decision. Otherwise, appropriate safeguards, in particular the European Commission’s standard contractual clauses, are implemented, provided that the legal requirements are met. Information regarding the safeguards used for a specific transfer and the option to obtain a copy thereof may be requested from the Data Protection Officer.
Retention period
Personal data relating to employees is stored only for as long as is necessary for the respective processing purposes. Upon termination of the employment relationship, data will be deleted as soon as there are no longer any legal retention, proof, or documentation requirements and the data is no longer necessary for the assertion, exercise, or defense of legal claims. The specific duration depends on the respective data and processing category and the applicable legal or purpose-based criteria.
Data regarding the company pension plan or continuing entitlements may be retained beyond the end of the employment relationship to the extent necessary for the administration, verification, or fulfillment of legal obligations.
Obligation to Provide
The provision of certain personal data is required by contract or by law for the establishment and performance of the employment relationship. Without this data, obligations under the employment contract or required by law—such as payroll processing, tax and social security reporting, or obligations regarding working hours and occupational safety—cannot be properly fulfilled. Where the provision of information is voluntary, this will be clearly indicated.
Automated Decision-Making
Decision-making based solely on automated processing, including profiling as defined in Article 22 of the GDPR, does not occur in the employment relationship.
Changes in Purpose
If personal data is to be further processed in the future for a purpose other than the original purpose of collection, the affected employees will be informed of the new purpose and the additional information required under Article 13(2) of the GDPR prior to such further processing.
For data processing carried out as part of the THALES Whistleblower System, the separate privacy notice for the Whistleblower System applies in addition.
