Personal Data in the context of the application prozess

Information notice about the processing of personal data in the context of the application process

With this notice we are informing you about the processing of your personal data by Hengeler Mueller Partnerschaft von Rechtsanwälten mbB (referred to below as "we", "Hengeler Mueller" or "the law firm") in the context of the application process. This notice is for all applicants, irrespective of whether they apply by using our online Workday application portal, by submitting their application by post or e-mail or by employing a third party, for instance a recruitment agency.

We take the confidentiality and protection of your personal data very seriously. Therefore, we process your personal data only to the extent permissible under statutory provisions, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

If you have any questions about this information notice or our policies regarding the handling of your personal data, please feel free to contact us at your convenience using the details below.

I. Those responsible and their contact details

The data controller, i.e. the person responsible for the processing of your personal data, is

Hengeler Mueller
Partnerschaft von Rechtsanwälten mbB

Behrenstraße 42
10117 Berlin
Germany

A list of our offices can be found at https://www.hengeler.com/en/service/offices.

If you are applying with our lawyers based in Frankfurt in their capacity as notaries, the data controller is the relevant notary.

A list of our lawyers who are registered as notaries can be found at https://www.hengeler.com/de/expertise/practice-areas/notarial-services.

You can reach our data protection officer, who has been appointed in respect of the professional activities both of our lawyers and our notaries, at the following e-mail address: datenschutzbeauftragter@hengeler.com.

II. Processing of your personal data

We will process your personal data that either you or a third party that you use (e.g. a recruitment consultant) transmits to us as part of your application. These data may include in particular your name, address and other contact details, your date of birth, career information, certificates, application data and salary expectations. If such data are made available to us by you or a third party (e.g. a recruiting consultant), the collected data may also contain special categories of personal data within the meaning of Article 9 GDPR (in particular data concerning health).

Your personal data will be processed for purposes of reviewing your application, planning and conducting the application procedure and, as applicable, establishing an employment relationship with us (Article 6 (1) sentence 1 point b GDPR, Article 88 GDPR in conjunction with Section 26 (1) sentence 1 BDSG). To the extent that we process special categories of personal data (e.g. data concerning health), the processing is performed on the legal basis of Article 9 (2) point b GDPR, Article 88 GDPR in conjunction with Section 26 (3) sentence 1 BDSG.

You are under no obligation to make your personal data available to us online. We will gladly handle your application if you submit it to us by other means.

If you send us your application by post or e-mail, we will add you to our Workday application portal and will enter the personal data contained in your application into the system. In that context, however, we will not be creating an account for you. If you submit your application directly via our online Workday application portal, you will be able to decide yourself whether you would like to use a personal account of your own in Workday.

If you have participated in an interview with us, we may store a brief assessment of your suitability for the relevant position.

Furthermore, in the course of the application process, we may also carry out background checks in compliance with the applicable provisions under employment and data protection laws and may collect data (in particular information on qualifications, career history, etc. with occupational relevance) from publicly accessible sources or, with your consent, from third parties (e.g. former employers) in order to verify the information provided in the application process and to review whether the requirements of the advertised position are met. The legal basis for the data processing is Article 6 (1) sentence 1 points a and b GDPR, Article 88 GDPR in conjunction with Section 26 (1) sentence 1 BDSG. It may also be necessary for us to carry out a sanctions list screening in order to comply with statutory requirements. The legal basis for such data processing is Article 6 (1) point c GDPR. Your data that is collected for these purposes will not be processed for any other purposes and will be erased after completion of the screening.

There will be no decision in the application process based solely on an automated processing of your data.

III. Disclosure of your personal data

For the purposes set forth in part II above, your personal data may be disclosed to processors within and outside the European Economic Area (EEA) who are engaged by us to assist with the application process or who are employed for the maintenance of our general infrastructure and our office organisation.

Furthermore, we may – to the extent legally permissible – disclose your personal data to public authorities (e.g. social security institutions, tax authorities or law enforcement agencies) and courts in Germany and elsewhere in order to comply with statutory obligations (Article 6 (1) sentence 1 point c GDPR) or because it is in the interests of the law firm (Article 6 (1) sentence 1 point f GDPR).

In countries outside the EEA, data protection laws and regulations may apply that are not comparable to the ones applicable in the European Union. To the extent that there is no level of protection in such countries comparable to that under European data protection law, we will take measures to ensure that your personal data – if transferred to such countries as aforesaid – will be adequately protected in those countries. To that end, we will in particular use the standard contractual clauses published by the European Commission. You may contact our data protection officer for further information.

IV. Erasure of your personal data

If your application is successful, we will retain the documents included in your application as part of our personnel files and in our personnel management system.

If we are unable to offer you any position, we will erase your personal data as well as your application data, such as your curriculum vitae, certificates or letters of reference, either twelve months or, provided that you have consented to their retention for a longer period of time (see below), two years after the completion of the application process. The legal basis for this storage is Article 6 (1) sentence 1 point f GDPR, as we have a legitimate interest in being able to identify repeat applications, or, where you have given your consent, Article 6 (1) sentence 1 point a GDPR.

V. Consenting to the storage of your application data for a longer period of time

It may be the case that we are unable to hire you in the form or as of the date you desire, but that we believe that your application might be of interest to us for other areas/offices or at a later point in time. If you have granted us your consent to do so, we will store your application data for two years in order to be able to contact you again at a later point in time. The legal basis for this data processing is, provided that you have given your consent, Article 6 (1) sentence 1 point a GDPR. This is why you will be asked as part of the application process to consent to the storage of your application data for future vacancies. You are not obliged to grant such consent. If you do not consent, we cannot consider your application that is already in our system for future vacancies. You may withdraw your consent at any time with effect for the future.

VI. Your rights

Subject to the statutory requirements, the fulfilment of which must be assessed on a case-by-case basis, you have the right to access your personal data, to require rectification or erasure of your personal data or the restriction of the processing and to receive your personal data in a structured, commonly used and machine-readable format (data portability).

Subject to the statutory requirements, the fulfilment of which must be assessed on a case-by-case basis, you also have the right to object to the processing of your personal data.

You are further entitled to lodge a complaint with a supervisory authority regarding the processing of your personal data.

To the extent that data is processed on the basis of your consent, you are entitled to withdraw your consent at any time with effect for the future. To withdraw your consent, please send us an e-mail at personal@hengeler.com. Please be advised that the withdrawal of your consent does not affect the processing of your personal data before the withdrawal.

Should you wish to change, amend or erase your application data, please send us an e-mail at personal@hengeler.com.

VII. Confidentiality/security

We employ technical and organisational security measures to protect your personal data that we process. In particular, each of our employees as well as all staff members of third-party service providers who have access to personal data are obliged to treat such data confidentially.

For conducting the application process, we will be using Workday software, a cloud-based service provided by Workday, Inc. (Workday Limited, The Kings Building, May Lane, Dublin 7, Ireland). Your data will be stored and processed in a secure data centre operated by Workday. In this context, Workday is acting as a data processor on our behalf in accordance with Article 28 GDPR. The data will be processed on servers within the European Union and the processing is subject to the data protection regulations under Union law.

Your application data will be protected in our systems against any unauthorised access. Only the competent contact persons within our HR team and our partners and counsel responsible for examining applications will have access to your application data.