INFORMATION SHEET ON THE PROCESSING OF YOUR PERSONAL DATA IN THE APPLICATION PROCESS
Data protection and the protection of your personal data is very important to us. We comply with the data protection regulations and inform you below about the processing of your personal data in the application process with us.
1. Contact details of the data controller and data protection officer
Responsible for the collection of your personal data in the application process is rebuy recommerce GmbH, Erkelenzdamm 11-13, 10999 Berlin.
For questions related to data protection at rebuy recommerce GmbH you can contact our data protection officer at any time:
● by e-mail: datenschutz@rebuy.com
● by mail: Attn: Data Protection Officer
2. Purpose and legal basis of data processing in the application procedure
As part of the application process with us, we collect data about you that you submit to us. The purpose of collecting your personal data is to handle your application process and to check whether we can offer you the position for which you have applied and hire you as an employee. We will therefore only use your applicant data (generally, in particular: name, date of birth, address, telephone number, e-mail address, data regarding your qualifications, professional experience and education, salary expectations, hobbies and leisure activities where applicable, photograph where applicable, internal records and automated transcripts and summaries of interviews with you where applicable) for the purpose of processing your application.
The legal basis for this data processing arises from Art. 6 Para. 1 lit. b GDPR, Art. 88 GDPR, Section 26 Para. 1 BDSG (Federal Data Protection Act). Insofar as the data involves so-called special categories of personal data, such as data regarding your health that you provide to us yourself (for example, information about a severe disability status), the processing is carried out on the legal basis of Art. 6 Para. 1 Sentence 1 lit. b, Art. 9 Para. 2 lit. b, Art. 88 GDPR, Section 26 Para. 3 Sentence 1 BDSG. The legal basis for the creation of automated transcripts and summaries is Art. 6 Para. 1 lit. a GDPR.
The provision of your data is necessary for a potential conclusion of a contract with us. You are not legally or contractually obliged to transmit your data to us. However, as we require information about your person for our application process, the potential consequence of non-provision is that we may not be able to sufficiently consider you as an applicant.
3. Duration of data storage
We store your personal data upon receipt of your application. If we hire you as an employee, we store your application for the duration of the employment relationship, as this is generally necessary for the execution of the employment relationship. The legal basis for this retention is Art. 6 Para. 1 lit. b GDPR, Art. 88 GDPR, Section 26 BDSG.
If we reject your application, we store your applicant data for a further 6 months after the rejection of your application (Art. 6 Para. 1 lit. f GDPR; based on our legitimate interest in defending against any legal claims from rejected applicants), unless you grant us your consent (Art. 6 Para. 1 Sentence 1 lit. a, Art. 88 GDPR, Section 26 Para. 1 Sentence 1 BDSG) for longer storage (e.g., for inclusion in our talent pool/applicant pool) or the storage is necessary for legal reasons or statutory obligations.
4. Recipients of your personal data
As part of the processing, your personal data will generally not be transferred to other recipients apart from us. In certain cases, we may need to share some of your data that we process as part of the application process with bodies and persons outside our company.
In certain cases, we must pass on part of your data that we process within the scope of the application process to bodies and persons outside our company. Classified by categories, we pass data on to the following groups of recipients:
Service providers who process personal data (so-called processors)
Recruitee B.V. (applicant management software)
HiBob GmbH (Personnel Management Software)
Google Ireland Limited (Hosting, communication, and collaboration service provider)
Where applicable, attorneys acting on our behalf
If we are legally obliged to pass on your data or if your data is required for the work of the attorneys, personnel consultants, and recruitment agencies acting for us, we will pass on your data to them to the extent required. Service providers acting on our behalf partially process data for us. Where this is the case, we conclude a so-called data processing agreement with the service provider, through which we obligate the service provider to carry out the processing of the data carefully and according to our instructions. In this way, the service providers process the data according to our specifications and on our behalf.
Furthermore, only the employees of our company who need to view your data within the framework of the application process have access to your personal data; specifically the HR department and the decision-makers in the respective department who also participate in the decision regarding your employment and must therefore view your data.
5. Transfer to a third country
Personal data may also be transmitted by us to third countries. Countries outside the European Economic Area are considered third countries in the sense of data protection law. In some third countries, such as the USA, there is a particular risk that your data may be processed by authorities for control and monitoring purposes, possibly without legal remedy options. A data transfer to third countries only takes place if an adequate level of data protection within the meaning of Art. 44 – 46 GDPR can be ensured through additional measures. This can be achieved through the existence of an adequacy decision by the EU Commission or through the conclusion of EU Standard Contractual Clauses and, if necessary, the agreement of further technical-organizational measures with the recipients. You can request a copy of the respective guarantees applied via the contact details provided.
6. Your rights in relation to data processing
In principle, you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), or erasure (Art. 17 GDPR) of your personal data, as well as the right to data portability (Art. 20 GDPR). Furthermore, you can request the restriction of data processing (Art. 18 GDPR) and object to the processing (Art. 21 GDPR) of your personal data, as well as the right not to be subject to a decision based solely on automated processing (Art. 22 GDPR).
7. Revocation of consent
If the collection or processing of your personal data is based on consent, you can revoke your consent at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected in the event of revocation.
8. Right of appeal to the supervisory authority
Finally, you have the right to lodge a complaint to a data protection supervisory authority. You can assert this right, for example, with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement.
In Berlin, where we are based, the competent supervisory authority is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin.
9. Necessity of the provision of personal data
The provision of personal data within the framework of application processes is neither legally nor contractually required. You are therefore not obliged to provide us with your personal data. Please note, however, that these are necessary for the decision on an application or the conclusion of a contract in relation to an employment relationship with us. Insofar as you do not provide us with personal data, we cannot make a decision regarding the establishment of an employment relationship. We recommend that you only provide such personal data in your application that is necessary for the execution of the application.
10. Automated decision making
We do not process personal data collected during the application process as part of automated decision-making (including profiling). The final decision regarding employment is made exclusively by our employees.
11. Amendment of the data protection notice
IAs part of the further development of data protection law as well as technological or organizational changes, we occasionally amend our privacy policy.
Status: April 23, 2026
