2.7 Data processing upon application 

When you apply to us, we process the information that we receive from you as part of the application process, e.g. by means of a letter of application, CV, certificates, correspondence, telephone or verbal information. In addition to your contact details, information about your education, work experience and skills is particularly relevant to us; without this information, we cannot determine your suitability and cannot consider your application. We will only assess you according to your suitability for the respective position. You do not have to send us a photo. Information about your family situation, etc. is also not required. Since most of our jobs are security-related and for many positions, especially in the technical area, application documents alone are not sufficient, but we would also like to look at source codes created by you, for example, in order to assess your suitability, we usually conduct research on applicants on the Internet. However, we limit ourselves to public information in professional networks, code repositories, technical platforms for discussing problems, for example. We are happy if you point us to representative works by indicating your username. The information researched in this way will not be stored. 

Your data will initially be processed exclusively for the purpose of carrying out the application procedure. If your application is successful, it will become part of your personnel file and will be used for the implementation and termination of the employment relationship and deleted in accordance with the regulations applicable to personnel files. If we are currently unable to offer you employment, we will continue to process your data for up to six months after sending the rejection letter in order to clarify any legal claims that may be necessary. If you have received reimbursements or other tax-relevant transactions (e.g. invitation to a meal), the corresponding accounting documents are regularly stored until March 31 of the eleventh calendar year after the payment at the latest in order to fulfill the retention obligations under commercial and tax law; in the case of commercial and business letters and other tax-relevant documents, they are stored for the seventh calendar year after their creation. The legal basis for data processing in the application process and as part of the personnel file is Section 26 (1) sentence 1 Federal Data Protection Act of Germany (Bundesdatenschutzgesetz, BDSG) and Article 6 (1) subparagraph 1 letter b GDPR and, if you have given your consent, Article 6 (1) subparagraph 1 letter a GDPR. Research in the context of job applications is the legal basis § 26 para. 1 p. 1 BDSG and Art. 6 para. 1 UAbs. 1 letters b and f and, if applicable, Art. 9 para. 2 lit. e GDPR, whereby legitimate interests are the guarantee of security in the company and the selection of suitable applicants. The legal basis for data processing after a rejection is Art. 6 para. 1 UAbs. 1 letter f GDPR. Legitimate interest in this respect is the defense against legal claims. The legal basis for storage under commercial and tax law is Art. 6 para. 1 UAbs. 1 lit. c GDPR in conjunction with. §§ 147 AO, 257 HGB. 

As a rule, we do not require any special categories of personal data within the meaning of Art. 9 GDPR for the application process, such as information on your health, religion, ethnic origin, sexual orientation. We ask you not to provide us with such information in the first place. If such information is exceptionally relevant for the application process, we will process it together with your other applicant data. This may, for example, concern information about a severe disability that you can provide to us voluntarily and which we then need to process in order to fulfill our special obligations with regard to severely disabled persons. In these cases, the processing serves the exercise of rights or the fulfillment of legal obligations arising from labor law, social security law and social protection. The legal basis for the data processing is then Art. 9 (2) lit. b GDPR, §§ 26 (3) BDSG, 164 Social Code of Germany (Sozialgesetzbuch, SGB) IX.