Privacy policy application management

1. Who will be responsible for processing your data, and how can you reach the Data Protection Officer?

The party responsible for processing your data is:

CARIAD SE

Major-Hirst-Straße 7

38442 Wolfsburg

Germany

You can reach our Data Protection Officer by mail at the aforementioned address, adding “Data Protection Officer” or by e-mail to: privacy@cariad.technology

Please be informed that when using the e-mail-address, not only the data protection officer might gain knowledge of your inquiry. If you want to contact the data protection officer in confidentiality, please send another mail upfront.

2. What categories of data do we use, and where do we get it from?

Through your application process, we process your personal data. Personal data, as defined in the General Data Protection Regulation (GDPR) means all data, that is related to an identified or identifiable person, such as the name, contact information or all documents you submit to us during the application process. The types of personal data that we will process particularly include:

• Title
• Name (mandatory)
• E-Mail-Address (mandatory)
• ZIP-code (mandatory)
• Place of residence (mandatory)
• Telephone/mobile number
• Social-Media-Profile
• Desired location
• Salary expectations
• Desired start-date
• All documents uploaded during the application process, such as CV (mandatory) and letter of interest

You can share that information with us by using our job application platform. If you use our application platform, an account will be created for you. By using this account, you can see the status of your application at any time and also change or add further information for your application. The Login for the account is your e-mail-address in combination with a password of your choice. Due to security reasons, you will get a confirmation mail after the account creation.

3. For what purposes, and on what legal basis, will your data be processed?

We will process your data under the provisions of the General Data Protection Regulations (GDPR) and all other relevant laws. We will process your data for the purposes of our job application management, including communications and interviews, verification your identity and qualifications and conducting of tests and assessments or other suitability evaluations, fitted to the corresponding position.

The main legal basis for this is provided by: Art. 88 GDPR, Sec. 26 German Federal Data Protection Act, Art. 6 (1) b GDPR.

4. Talent-Pool

As part of the application process, you can give your consent to be part of our talent pool. If you decide to do that, we will store your information for up to 18 months and contact you if your profile is matching one of our job opportunities. You can withdraw the consent for the talent-pool at any time by using the „Withdraw“-Button in your account. The legal basis for the data processing in the consent pool is Art. 6 (1) a GDPR.

5. To whom will we disclose your data?

Within our company, only those persons and bodies receive your personal data that need it to fulfil our contractual and legal obligations. We only make your data available to other group-companies to the extent that this is necessary for group-wide communication, group-management and administration.

We also use service providers (data processors). Each service provider is checked by us and guarantees an adequate level of data protection. Part of the data processing is done by the service provider umantis Deutschland GmbH, Munzinger Str. 9, D-79111 Freiburg i. Breisgau (“Umantis”)  as provider of our job application platform.

6. How long will your data be stored?

Your personal data will be deleted six month after a possible rejection due to our legitimate interest in defending ourselves against possible legal claims (Art. 6 (1) f GDPR). If you wish your data to be stored in the talent pool, your data will be deleted after 18 months at latest. If you have not already chosen to be part of the talent pool during your application process, we will ask you per e-mail for your consent (Art. 6 (1) a GDPR).

At the end of the respective retention period, your data will be deleted automatically.

7. What privacy rights can you claim as a data subject?

You have the right to information about how we process your personal data at any time. When providing this information, we will explain the data processing to you and provide you with an overview of the data stored about you. If data stored by us is incorrect or no longer up to date, you have the right to have this data corrected. You may also demand that your data be erased. Should the erasure not be possible in exceptional cases due to other legal regulations, the data will be blocked so that it is only available for that legal purpose. You are also entitled to have the processing of your data restricted, e.g. if you believe that the data we have stored is incorrect. You also have the right to data portability, which means that on request we will send you a digital copy of the personal data you have provided.

In order to assert your rights described here, you can contact us at any time using the contact details provided. This also applies if you wish to receive copies of safeguards in order to prove an adequate level of data protection.

You have the right to withdraw the consent you gave us at any time. As a result of this, we will cease the data processing based on this consent with future effect. This withdrawal of your consent will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

Insofar as we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time for reasons arising from your particular situation. If your objection is to data processing for direct marketing purposes, you have a general right of objection, which we will implement without requiring you to give reasons.

If you would like to make use of your right of withdrawal or objection, it is sufficient to simply notify us using the contact details provided above.

You have the right to file a complaint with the competent data protection supervisory authority. You can assert this right by contacting a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement. In Wolfsburg, where CARIAD is headquatered, the competent supervisory authority is: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstrasse 5, 30159 Hannover, poststelle@lf.niedersachsen.de. 

8. What happens with my data when I undergo a Technical Assessment?

If you are applying for a job in Software and System Engineering or Data Science we may ask you to attend a Technical Assessment. The assessment consists of an online interview conducted by our partners INTERVIEWSTREET INC. DBA HACKERRANK, 700 East El Camino Real, Suite 300, Mountain View, California 94040, U.S. (“HackerRank”) and Futurepath GmbH, Lützowufer 6-9, 10785 Berlin (“Futurepath”). The following information will be transfered to HackerRank and Futurepath in case you are invited for a Technical Assessment:

• Contact information (name, address, phone number, e-mail address)
• CV

Your results will then be sent back to our online-application-portal and processed there. The required data will be deleted after a retention period of six months at HackerRank and Futurepath. More information about data protection at HackerRank and Futurepath can be found here: 

https://de.futurepath.io/policy

https://www.hackerrank.com/privacy

9. Jobsharing

If you are interested in the possibility of jobsharing, you can click on the link "PairToShare" at the specific job openingof the job-sharing platform “PairToShare” by PairToShare S.Y. GmbH, Hauptstr. 14, 10927 Berlin (“Pairtoshare”). PairToShare requires a registration on their platform. The usage of the job platform is subject to the terms and conditions of PairToShare.  

More information about pairtoshare and its privacy policy can be found here:  https://www.pairtoshare.com/de/privacy-and-cookies-policies.

10. Data transfer to third countries 

As explained in this privacy policy, we use services whose providers are partly located in so-called third-class countries (such as the USA), i.e., countries whose data protection level does not correspond to that of the European Union. Insofar as this is the case and the European Commission has not issued an adequacy decision (Art. 45 GDPR) for these countries, we have taken appropriate measures to ensure an adequate level of data protection for any data transfers. These include the standard contractual clauses of the European Union or binding internal data protection regulations.

Where this is not possible, we transfer personal data under Art. 49 GDPR, in particular with your explicit consent or the necessity of the transfer for the fulfilment of the contract.

If a transfer to a third country is intended and no adequacy decision or appropriate safeguards are in place, it is possible and there is a risk that authorities in the respective third country (e.g. intelligence agencies) may be able to gain access to the transferred data in order to record and analyze it, and that the enforceability of your data subject rights cannot be guaranteed. You will also be informed of this when you give your consent via the cookie banner. 

11. Changes to the Privacy Policy 

We will update this privacy policy occasionally, for example if we adapt our website or there is a change in the legal or regulatory requirements.

 

Last amended:

Oktober 2024