Privacy notice for applications

Controller

Nordwerk Maschinenbau is responsible for the processing. Questions about data protection and requests concerning the rights below go to the following contact.

The controller’s address and the data protection contact have not been entered yet. The operator of this portal adds them before launch through the setting PORTAL_IMPRINT_TEXT.

What data is processed

• Required: first name, last name and email address. Without them an application is not possible.
• The answers to the questions of the position are also required; without them the application cannot be processed. Optional are phone number, earliest start, preferred working hours, uploaded documents (CV, cover letter, certificates), the statement of a disability and the note on support needs in the interview.
• Optional and especially protected: the statement of a severe disability or equivalent status, on request with a note on support needs. Recruiting and the representation for employees with disabilities can see the statement. The works council is only informed that an application from a severely disabled or equivalent person has arrived (§ 164 para. 1 SGB IX). The hiring department and interviewers do not see the statement.
• During the process: messages, appointments and the status of the application.
• We do not ask for a photo, date of birth, gender, marital status, nationality or the current salary.
• Technical: we do not store your IP address permanently; it is processed briefly to prevent abuse (Art. 6(1)(f) GDPR). For this the number of requests per network address is limited. The servers of the hosting provider may keep the address in their own logs (see “Processors and hosting”).

Automatic reading of the CV

• From an uploaded CV, the name, email address and phone number are read automatically, by an AI language model operated on our behalf; it does not rate or decide anything.
• Purpose: pre-filling the form so nothing has to be typed. The person confirms every field (Art. 6(1)(b) GDPR).
• Recipient: the processor that operates the language model; it processes the CV only on instruction. Provider and location are listed under “Processors and hosting”.

Purpose and legal basis

• Carrying out the application process: Art. 6(1)(b) GDPR in conjunction with § 26 BDSG. No consent is needed for the process itself.
• Statement of a disability: optional; the processing serves to exercise rights and duties under disability law (Art. 9(2)(b) GDPR, § 26(3) BDSG, §§ 164 and 178 SGB IX).
• Talent pool: only with separate, time-limited consent that can be withdrawn at any time (Art. 6(1)(a), Art. 7 GDPR).
• Protection against abuse of the form: legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Who has access

• Recruiting: for all positions, until deletion. The hiring manager, the department and those involved in the interviews: only for the advertised position and only while the process is running.
• The works council as part of the consultation before a hire (§ 99 BetrVG): the application documents and the answers to the questions of the position. The documents may contain contact details; the contact fields entered in the form (email address, phone number) are not shown to it separately.
• The representation for employees with disabilities, if the statement about a disability was made. In that case the works council only learns that such an application has arrived (§ 164 para. 1 SGB IX).
• Service providers for operation and hosting process data only on instruction. Data is not passed on for advertising.

Processors and hosting

Provider and location of the hosting and of the AI language model that reads CVs, as well as the server logs of the hosting provider (which data, for how long), are to be added by the operator. The operator enters them before launch with the setting PORTAL_PROCESSORS_TEXT.

Retention

An application is deleted automatically with its documents 6 months after the process ends. Before that, a statistical record without personal reference is created. A hold can pause deletion, for example during a legal dispute (§ 15(4) AGG, § 61b ArbGG).

In the talent pool, documents stay only with consent and only for a limited time.

Rights

Applicants have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent (Art. 7(3)).

On the personal status page, data can be viewed and downloaded, the application can be withdrawn and all data can be deleted immediately.

There is also the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

No automated decision

People decide on applications. There is no profiling and no automated rating, ranking or rejection (Art. 22 GDPR).

Cookies and third parties

This portal sets no tracking cookies and loads no scripts, fonts or images from third parties. A cookie banner is therefore not needed.

Anyone who opens the link to the status page from the email receives a technically necessary session cookie (30 days, not readable by scripts) so that the sign-in lasts. No consent is needed for this (§ 25(2) no. 2 TDDDG).