1. Responsible

2. Data Protection Officer

You can reach our Data Protection Officer at:
DEUDAT GmbH
Zehntenhofstraße 5b
65201 Wiesbaden
Germany
Phone: +49 611 950008-40
Email: kontakt@deudat.de

3. Purposes and Legal Bases of Processing

We process your personal data for the purpose of conducting the application process and deciding on the establishment of an employment relationship.
The processing is carried out on the basis of:

• Section 26 BDSG (Initiation of an employment relationship)
• Art. 6 (1) (b) GDPR (Contract or pre-contractual measures)
• Art. 6 (1) (f) GDPR (Legitimate interest), in particular for the efficient and structured conduct of the application process,
• internal coordination between the departments involved in the selection process,
• documentation and traceability of selection decisions,
• assertion, exercise, or defense against potential legal claims.

If you grant us your consent (e.g., for inclusion in an applicant pool), the processing is additionally based on Art. 6 (1) (a) GDPR.

4. Categories of Processed Data

In particular, we process the following categories of personal data:

• Master data (name, address, contact details)
• Application documents (CV, certificates, qualifications)
• Information regarding the application (salary expectations, start date, etc.)
• Communication data (email correspondence, interview notes)
• Evaluation and assessment data from the application process
• Organizational data (application status, appointments/interviews)
• If applicable, expense data (e.g., travel expenses)

If you voluntarily provide us with special categories of personal data (e.g., health data, severe disability status), the processing is carried out exclusively on the basis of Section 26 (3) BDSG or Art. 9 (2) GDPR.

5. Data Sources

In principle, we exclusively process personal data that you provide to us as part of your application.
To the extent necessary for conducting the application process, we may additionally collect personal data from publicly available sources. This includes, in particular, professional information from social networks (e.g., LinkedIn, XING).
In doing so, we only process data that you yourself have made publicly available there and that relates to your professional qualification and suitability.
The processing is carried out solely for the purpose of deciding on the establishment of an employment relationship. No further data collection takes place.

6. Recipients of the Dataaten

Your data will be disclosed within the evoila Group exclusively to those companies and organizational units involved in the application process, in particular HR departments, specialist departments, managers, and co-determination bodies (works councils).
An overview of the affiliated companies can be accessed under Locations – evoila Holding GmbH. No further transfer to third parties will take place unless a legal obligation exists.

7. Use of Workday

To conduct the application process, we use the applicant management system Workday. The provider is Workday Inc., based at 6110 Stoneridge Mall Road, Pleasanton, CA 94588, USA. Workday processes personal data on our behalf in accordance with Art. 28 GDPR exclusively based on our instructions. In principle, the data is stored in data centers within the European Union. However, in the context of support and maintenance services, access from third countries (in particular the USA) cannot be ruled out.

8. Third-Country Transfer

If personal data is transferred to a third country, this is done in compliance with the legal requirements pursuant to Art. 44 et seq. GDPR. In particular, the transfer is based on:

• Standard Contractual Clauses of the European Commission pursuant to Art. 46 (2) (c) GDPR,
• an adequacy decision of the European Commission (e.g., EU-US Data Privacy Framework), insofar as one exists,
• as well as supplementary technical and organizational measures.

A copy of the corresponding guarantees can be made available upon request.

9. Storage Period

Your personal data will generally be stored for the duration of the application process. If no employment relationship is established, your data will be deleted no later than 6 months after completion of the application process. The completion of the process is regularly the time when the position is permanently filled. A longer storage period will only take place:

• if statutory retention obligations exist, or
• if you have expressly consented to a longer storage period (e.g., applicant pool).

In the case of consent, storage will continue until it is revoked, but for a maximum period of 12 months.

10. Provision of Dataten

The provision of your personal data is neither legally nor contractually required.
However, it is necessary to conduct the application process. Without this data, we cannot consider your application.

11. Your Rights

You have the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (“right to be forgotten”) (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

Insofar as the processing is based on your consent, you have the right to withdraw it at any time with future effect. The lawfulness of the processing carried out up to the time of withdrawal remains unaffected.

12. Right to Lodge a Complaint

13. Automated Decision-Making

An exclusively automated decision-making process within the meaning of Art. 22 GDPR does not take place. The evaluation of applications is conducted with the involvement of human decision-makers. The selection decision is based on objective, professional, and position-specific criteria. Depending on the respective position, these may include, in particular: professional qualifications, relevant work experience, required language skills, legal prerequisites for employment (e.g., a valid work permit), as well as organizational framework conditions (e.g., location of deployment or availability). We comply with the provisions of the General Act on Equal Treatment (AGG). A selection decision is not made based on legally protected characteristics. Insofar as circumstances related to place of residence, residence status, or employment are considered, this occurs exclusively to the extent legally or organizationally required to fill the specific position. To the extent that IT systems are used to support the application process, they serve exclusively as organizational support and do not have a sole, decisive influence on the outcome of the selection procedure.

14. Right to Object

Insofar as we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time. In the event of an objection, however, we will no longer be able to consider your application.

As of 04/2026