According to Section 13 of EU General Data Protection Regulation and UK General Data Protection Regulation (hereinafter, “GDPR”), concerning the protection of individuals with regard to the processing of personal data, Digraph GmbH (hereinafter, “Digraph”), hereby provides you with this Privacy notice regarding the processing of your personal data.
Digraph together with one or more Digraph Group Companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR. You may require details on Digraph Group Companies by contacting Digraph as specified hereinafter.
We may obtain your personal data either directly from you or from third parties for recruitment purposes. Such third parties may include recruitment agencies, job boards and publicly available websites such as LinkedIn, as well as specialist companies that facilitate the entrance of recent graduates into working life. The data we collect may include your contact details, employment and education history, skills and professional qualifications, as well as records of any interactions with us, including interviews and tests.
1. Purpose and Processing Activity. Legal Basis
Your data are stored and processed solely for the following purposes:
a) Carry out the necessary evaluations in order to possibly establish a job or contract relationship with one of the Companies in the Digraph Group. Legal basis for the processing: execution of pre-contractual activities.
b) Following a successful evaluation, arrange any documentation needed to establish the job or contract relationship, such as passport, work permit, driving license, etc. Legal basis for the processing: execution of pre-contractual activities.
c) Comply with specific obligations required by law or other binding regulations (e.g. fiscal legislation, social security and social protection law, health and safety at work, protection of health, public order and public security law). Legal basis for the processing: legal obligations.
To achieve the abovementioned purposes, it may be necessary to collect and process data defined as “particular” by GDPR art. 9 comma 2.b. In particular, this may include information about health status and disability, subject to any relevant employment legislation.
2. Provision of Data
If you are unwilling to provide sufficient data to support the recruitment and evaluation process, we shall be unable to consider you for setting up the job or contract relationship.
3. Method of Processing Activity. Data Retention Period
Your data are stored electronically and will be subject to strict information security measures to protect your privacy. Your data will only be accessed by those directly involved in the evaluation and recruitment process.
If you subsequently join Digraph, as an employee or as a freelance, you will be given a separate Privacy Notice to cover our storage and use of your personal data during your employment.
Otherwise, your data will be held for up to three years from the most recent update unless you specifically request deletion.
4. Data Recipients
The personal data collected to achieve the purposes indicated in the above section 1 could be used by any of the Digraph Companies as Joint Controller of the processing activity according to art. 26 GDPR.
Within the organization of each Joint Controller, personal data will be processed by subjects specifically appointed and interested in the applicant’s profile and that intend to conduct an evaluation of the applicant, or by all subjects to whom the communication is due based on specific law obligations.
In some cases, we may share a pseudonymized profile with a potential Digraph client as part of your evaluation.
The Joint Controllers may use external companies to provide services for the achievement of the purposes in point 1. Any such company will be designated as a Data Processor according to art. 28 of GDPR.
If you are being considered for a position with a Digraph Group Company outside the EU/UK, please be aware that these companies may be subject to different data protection legislation, and this may require additional protections and consents. We will inform you of these if necessary.
Whenever personal data are transferred from an EU/UK member state to a third country, this transfer will be carried out in line with applicable legal requirements.
5. Dissemination of Data
Apart from the third parties identified above, your data will not be subject to any wider dissemination.
6. Data Subjects’ Rights
You have the right to require each Joint Controller to access your personal data and, where the conditions are met, to require the amendment or erasure of the same or restriction of the processing that refers to You, or to oppose the processing.
Where the conditions are met, You have the right to data portability.
For the abovementioned communications, you may use the contact details reported in section 8 below.
You have the right to lodge a complaint with the competent Data Protection Authority.
7. Data Controller. Data Protection Officer and Privacy Lead
Digraph GmbH (with registered office at Musterstraße 1, Berlin, Germany) together with one or more Digraph Group Companies are the Joint Controllers of this processing activity, according to Art.26 of GDPR.
The contact details of the Digraph Data Protection Officers are:
DPO Germany: dpo.de@digraph.de
DPO UK: dpo.uk@digraph.com
8. Other Contact Details for Data Subjects’ Rights
Data Subjects can also contact the Joint Controllers by emailing to hr.privacy@digraph.com or to DSB@digraph.de for Digraph GmbH.
