Privacy policy for the application process via the online recruiting system d.vinci

This privacy policy covers the online recruiting system https://suedzucker-gruppe.dvinci-easy.com/ (hereinafter referred to as the "recruiting system"), which is provided by Südzucker AG, Maximilianstraße 10, 68165 Mannheim, Germany, to the individual companies of Südzucker Group.

The following companies use the recruiting system and are part of Südzucker Group (hereinafter also referred to as "we", "us"):

Südzucker AG, Maximilianstraße 10, 68165 Mannheim, Germany
CropEnergies AG, Maximilianstraße 10, 68165 Mannheim, Germany
CropEnergies Bioethanol GmbH, Albrechtstraße 54, 06712 Zeitz, Germany
BENEO GmbH, Maximilianstraße 10, 68165 Mannheim, Germany
BENEO-Palatinit GmbH, Maximilianstraße 10, 68165 Mannheim, Germany
Freiberger Lebensmittel GmbH, Zerpenschleuser Ring 1, 13439 Berlin, Germany
Freiberger Osterweddingen GmbH, Freibergerstraße 1, 39171 Sülzetal (Osterweddingen), Germany
HASA GmbH, Lindenallee 20, 39288 Burg, Germany
PrimAs Tiefkühlprodukte GmbH, Mösl 1, 6406 Oberhofen, Austria
Raffinerie Tirlemontoise s.a., Aandorenstraat 1, 330 Tirlemont, Belgium
Saint Louis Sucre S.A.S, 74 avenue du Général de Gaulle, 80700 Roye, France

Südzucker AG provides the recruiting system as a service provider to the above-mentioned Südzucker Group companies and acts as a shared service provider within Südzucker Group. The application process was designed uniformly for all Südzucker Group companies in order to ensure a group-wide process flow that complies with data protection laws. Südzucker AG attaches great importance to protecting your privacy and that of your personal data as well as the necessary data security for processing your data and has set up the necessary data protection measures for this purpose. Personal data is only collected, processed and used via the recruiting system in accordance with the principles described below as well as the requirements of the EU General Data Protection Regulation (hereinafter "GDPR") and the respective nationally applicable data protection laws. For the sake of standardization, only the GDPR is referred to in the legal bases mentioned here.

When you use the recruiting system, various personal data are collected. "Personal data" is any information relating to an identified or identifiable natural person (hereinafter "data subject"). With this privacy policy, we inform you about the nature, scope and purpose of the collection, processing and use of your personal data.

1. General information on data processing

We collect, process and use your personal data only for the purpose of carrying out the application process. Your personal data provided will not be processed for any other purposes.

The processing of the provided personal data of an applicant is only carried out for the implementation of the application process. To carry out the application process, only data that the applicant has voluntarily provided will be processed.

This recruiting system is not intended for persons under the age of 16. We ask that individuals under the age of 16 not provide us with any personal information. If we learn that we have collected personal information from anyone under the age of 16, we will take steps to delete the information as soon as possible. If you learn that a user of our website is under the age of 16, please contact the appropriate recruiter listed in the job posting or contact us at [email protected].

If you have any questions about data protection in our application process, please contact us using the contact details provided at the end of the privacy policy.

2. Data processing in detail

a) Application process
Application data provided to us via the recruiting system (form of address, title, first name, last name, date of birth, address and contact data, salary expectations, information on a possible severe disability, curriculum vitae, cover letter, additional attachments such as references, certificates of attendance at training courses or certificates of additional qualifications, previous employment relationships, training(s), language skills, application photo) will be stored for the purpose of carrying out the application process, evaluated, assigned to the advertised position and forwarded internally to the employee responsible for the advertisement and used to contact you. Optional input fields are indicated by a note. Please ensure that the data you provide to us via the recruiting system is true, correct, unambiguous and up-to-date.

The responsible authority is the Südzucker Group company that is responsible for processing your application and thus for carrying out the application process. In addition to the HR managers of the responsible authority, only the employees of Südzucker AG and/or the respective Südzucker Group company have access to the applicant data you have provided, who have to be involved in filling the position, i.e. in the application process. The access of the required employees per application is secured via set-up authorizations. The authorization concept in the recruiting system ensures role-dependent and local access rights. In principle, only those persons who are sensitized to the concerns of data protection and security and who are subject to a contractually imposed duty of confidentiality are granted access to your data. Your application data will not be passed on to third parties outside the Südzucker Group.

In our application process, we will not ask you to provide us with so-called sensitive personal data. However, if you voluntarily provide us with such information, we will understand this as your consent to the processing for the purpose of carrying out the application process and that you allow us to store this information as part of the application process and to use it for the purposes of the application process.

Please understand that we can only accept online applications for data protection reasons and will return applications sent to us by mail or e-mail to the sender.

We store your personal data as long as this is necessary for carrying out an application procedure (Art. 6 para. lit. b GDPR in conjunction with 88 GDPR in conjunction with § 26 para. 1 p. 1 German Federal Data Protection Act [BDSG]). Subsequently, your data will be completely deleted by us, unless you have consented to further storage in accordance with Art. 6 para. 1 p. 1 lit. a) GDPR in the event that the purpose of storage no longer applies. Your application data for an individual position will therefore be stored for a maximum of six months in the event of a rejection and then completely anonymized by us.

If, based on your application, you receive a request from us to be included in our applicant pool, you have the following options:
- You agree to be included in the pool: Your application, including your personal data, will be stored in our recruiting system for a further 12 months and then completely deleted.
- You decline the admission: Your application will be treated as a normal rejection, i.e. your personal data will be completely deleted 6 months after the end of the application process.
- You do not respond to our request within 7 days: this case is considered a rejection and your application will be treated as a normal rejection, i.e. your personal data will be completely deleted 6 months after the end of the application process.
- If you are offered employment with our company following the application process, we will transfer your data to our regular personnel administration process.

In addition, we would like to point out that you can also independently change or request deletion of your specified application data within your application at any time via the contact data under section 5. We will then delete the application data immediately.

b) Provision of the recruiting system and creation of log files
By using the recruiting system, only the personal data that your browser transmits to the server and that is technically necessary for the provision of the system is processed.

We use the recruiting system of d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, Germany (hereinafter "d.vinci") to store, manage and process your data. d.vinci hosts the recruiting system on behalf of Südzucker AG and provides maintenance and support on a case-by-case basis. On our behalf, all personal data is stored or processed on a certified server of our service provider exclusively within Germany. The required data protection order processing agreement has been concluded with d.vinci. Further information on data processing by d.vinci can be found at https://www.dvinci.de/datenschutz/.

Each access to the recruiting system is stored in a log file. The following data is stored in this file for as long as is technically necessary:
- information about the browser type and version used,
- the user's operating system,
- the IP address,
- the domain name of the Internet service provider,
- date and time of access.

The data is stored centrally on servers of d.vinci within Germany. The data will not be used independently by d.vinci and will not be passed on to third parties. This data will not be stored together with other personal data of the applicant.

The legal basis for the temporary storage of the data is Art. 6 para. 1 lit. f) GDPR. The temporary storage of the IP address by the system is necessary to enable delivery of the recruiting system to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The other information is needed to make the recruiting system secure, to protect it from attacks and to ensure that it functions properly. These purposes constitute the legitimate interest in the data processing according to Art. 6 para. 1 lit. f) GDPR.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the recruiting system, this is the case after the end of your respective session. Storage beyond this (max. six months) is possible in individual cases, if required by law. In this case, anonymization takes place in the form of deleting or alienating the user's IP address. An assignment of the calling user is no longer possible. The collection of the data for provision and the storage of the data in log files is mandatory for the operation of the recruiting system. Consequently, there is no possibility of objection on the part of the applicant.

c) Cookies
Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's device. Cookies cannot execute programs or transfer viruses to your computer. When a user calls up a website, a cookie may be stored on the user's terminal device. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called "session cookies"). Other cookies remain on your device and allow us to recognize your browser the next time you visit.

Our recruiting system uses the following cookies to make the application process more user-friendly:
- JSESSIONID (validity period: session),
- Captcha (validity period: 1 day).

Some elements of the recruiting system require that the calling browser can be identified even after a page change (JSESSIONID). In addition, the cookie Captcha serves to check and prevent interactions on our recruiting system by automated accesses, for example by so-called bots. These purposes also constitute the legitimate interest in the processing of personal data according to Art. 6 para. 1 p. 1 lit. f) GDPR.

The following data is stored and transmitted in the cookies in the process:
- language settings,
- assignment to the applying position and company,
- session information.

Cookies are stored on the user's terminal device and transmitted from it to the recruiting system. Therefore, you as the user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for the recruiting system, it may no longer be possible to use all functions of the website to their full extent.

d) Conducting video interviews
To conduct video interviews, we use functions of the provider Cammio GmbH, Postbahnhof 17, 10243 Berlin, Germany (hereinafter referred to as "Cammio") within our application process to conduct time-shifted question-related video interviews or application videos (hereinafter referred to as "video interviews"). Cammio processes the provided data in compliance with the necessary data security measures as a contractor in the sense of Art. 28 GDPR on our behalf. The contractual relationship has been agreed.

Cammio processes the following data for purposes of providing the IT infrastructure for recording video interviews as part of our recruitment and hiring process:
- Title, first name and last name
- E-mail address
- IP address
- Browser User Agent
- Video file(s)
- Feedback from the applicant, if available (if they use this feature).

The data will be used by Cammio exclusively for the purposes stated. Further information about Cammio can be found on the website: https://cammio.com/de/.

The applicant will receive an invitation to a video interview by e-mail. The video file is backed up on our behalf and stored on Cammio servers. The duration of the storage of your data is linked to the duration of the storage of your other applicant data (max. six months).

Participation is voluntary and with your consent, which is given by participating or sending the videos. The legal basis for the consent is Art. 6 para. 1 p. 1 lit. a) GDPR. The processing is carried out for the purpose of efficient and clear handling of the application process as well as the provision of a digital interview opportunity.

You have the option to revoke your consent to the processing of personal data in the context of conducting video interviews at any time. The revocation is possible at any time by providing us with your data (e-mail address and first and last name) via a message by e-mail ([email protected]). Once we have received your revocation, we will delete the video file as quickly as possible and send you a confirmation by e-mail. If you are not interested in conducting a video interview, this will not result in any disadvantages for you in the application process.

e) Profile transfer using XING or LinkedIn / Upload curriculum vitae via Dropbox
For the application, you have the option to transfer profile information from your XING or LinkedIn profile or to upload your curriculum vitae directly from Dropbox. If you make use of this option by clicking on the respective button in the application process, we will forward you to the respective pro-vider and you will then be requested by the provider to register with the platform XING, a service of Xing SE, Dammtorstr. 30, 20354 Hamburg, Germany (hereinafter "XING"), the platform LinkedIn, an offer of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter "LinkedIn") or Dropbox, an offer of Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland (hereinafter "Dropbox").
Subsequently, the respective provider asks you to allow Südzucker Group to access your information from your XING / LinkedIn profile or to allow the upload of your curriculum vitae stored at Dropbox. In the event of active consent given to the respective provider as defined in Art. 6 (1) a) GDPR, the following data, among others, will be transferred from your respective selected profile to the recruiting system:
- Name
- Address
- Date of birth
- Phone data
- Verified email address
- Profile picture
- Skills
- Curriculum vitae
- URL to XING profile / LinkedIn profile

XING, LinkedIn and Dropbox are responsible for this process, and only the privacy policies of XING: https://privacy.xing.com/de/datenschutzerklaerung, LinkedIn: https://de.linkedin.com/legal/privacy-policy and Dropbox: https://www.dropbox.com/privacy apply.

We have no influence on the data collected and data processing operations carried out by XING, LinkedIn or Dropbox, nor are the full extent of the data collection, the purposes of the processing, the storage periods and the storage location known. There is also no information available on the deletion of the collected data by XING, LinkedIn or Dropbox.

The integration of the interfaces to the platforms serves to simplify the application process. This purpose is the legitimate interest in data processing according to Art. 6 (1) f) GDPR as the legal basis for the profile transfer from XING or LinkedIn or the processing of curricula vitae uploaded from Dropbox. The forwarding to the respective platforms takes place only after your click on the respective button. The use of the offers is voluntary.

3. Data subject rights

We would like to point out that you have full control over the personal data you provide to Südzucker AG / a company of the Südzucker Group as part of your application. You can change, correct or delete all the data you have provided as well as your application at any time.

Right to information and right to change
Using the contact details below, you can request information at any time about the data stored about you in our recruiting system and provided to us. We will not change the data at any time unless you request this in writing, preferably by e-mail to the e-mail address given below.

Data deletion
Data in connection with a specific application for a vacant position will be deleted after a period of 6 months at the latest, unless an employment contract is concluded. For further information on the dura-tion of storage, please refer to section 2. You can request us to delete your data at any time in writing, preferably by e-mail.

For more information on your other data subject rights based on the GDPR, please refer to Südzucker AG's general privacy policy at https://www.suedzuckergroup.com/en/privacy-policy.

In individual cases, an automated decision for participation in an application procedure can be set up. This procedure is only set up by the system if it is absolutely necessary in an individual case, i.e. if the advertised position has corresponding requirements for the applicant. If the applicant does not meet the requirements that are subject to automated decision-making, the application procedure will not be continued.

4. Availability and changes

You can save or print this privacy policy by using the corresponding functions of your browser. In case of discrepancies between the foreign language translation and the German translation, the original German text shall prevail.

We reserve the right to change this privacy policy from time to time and to adapt it to new legal requirements or developments in case law and recommend that you inform yourself about the current privacy policy each time you visit our recruiting system.

5. Contact details of the responsible authority and the data protection officer

As the responsible authority, we will be happy to answer any further questions you may have on the subject of data protection and the processing of your data as part of the application process. If you have any questions, please contact the responsible HR manager/recruiter named in the respective job posting. Alternatively, you can direct your inquiry to:

Südzucker AG
Corporate HR
Maximilianstraße 10
68165 Mannheim
E-mail: [email protected]

The data protection officer of the responsible authority can be reached as follows:

Südzucker AG
Datenschutzbeauftragter
Maximilianstraße 10
68165 Mannheim
E-mail: [email protected]

As of: July 2023