INFORMATION SHEET ON THE PROCESSING OF YOUR PERSONAL DATA IN THE APPLICATION PROCESS

Data protection and the protection of your personal data is very important to us. We comply with the data protection regulations and inform you below about the processing of your personal data in the application process with us.

1. Contact details of the data controller and data protection officer

Responsible for the collection of your personal data in the application process is rebuy recommerce GmbH, Erkelenzdamm 11-13, 10999 Berlin.

For questions related to data protection at rebuy recommerce GmbH you can contact our data protection officer at any time:

● by e-mail: datenschutz@rebuy.com

● by mail: Attn: Data Protection Officer



2. Purpose and legal basis of data processing in the application procedure

As part of the application process with us, we collect data about you that you send to us. The purpose of collecting your personal data is your application process and to check whether we offer you the position for which you have applied and hire you as an employee with us. We will therefore only use your applicant data (usually in particular your name, date of birth, address, telephone number, e-mail address, data on your qualifications, professional experience and training, salary expectations, hobbies and leisure activities if applicable, photograph if applicable, internal records from interviews with you if applicable) for the purpose of processing your application.

The legal basis for this data processing results from Art. 6 para. 1 lit. b GDPR, Art. 88 GDPR, § 26 para. 1 Federal Data Protection Act (BDSG). Insofar as the data contains so-called special categories of personal data, such as data about your health that you yourself provide to us (for example, information about a disability status), the processing is carried out on the legal basis of Art. 6 para. 1 sentence 1 lit. b, Art. 9 para. 2 lit. b, Art. 88 GDPR, § 26 para. 3 sentence 1 BDSG. The provision of your data is necessary for a possible conclusion of a contract with us. You are not legally or contractually obliged to provide us with your data. However, as we require information about you in our application process, the possible consequence of not providing it is that we cannot sufficiently considerate you as an applicant with us.

3. Duration of data storageWe store your personal data upon receipt of your application.

If we hire you as an employee, we store your application for the duration of the employment relationship, as this is generally necessary for the implementation of the employment relationship. The legal basis for this storage is Art. 6 Para. 1 lit. b GDPR, Art. 88 GDPR, § 26 BDSG.

If we reject your application, we will store your applicant data for a further 6 months after the rejection of your application (Art. 6 para. 1 lit. f GDPR; based on our legitimate interest in defending against any legal claims by rejected applicants), unless you give us your consent (Art. 6 para. 1 p. 1 lit. a, Art. 88 GDPR, § 26 para. 1 p. 1 BDSG) for longer storage (e.g. for inclusion in our talent pool/applicant pool) or storage is required for legal reasons or legal obligations.

4. Recipients of your personal data

As part of the processing, your personal data will generally not be transferred to other recipients apart from us. In certain cases, we may need to share some of your data that we process as part of the application process with bodies and persons outside our company.

Classified by category, we share data with the following groups of recipients:⋅

Service providers who process personal data (so-called processors)

• Recruitee B.V. (applicant management software)

• HiBob GmbH (Personnel Management Software) ⋅

If applicable, lawyers acting on our behalfIf we are legally obliged to pass on your data or if your data is required for the work of lawyers, personnel consultants and recruiters working for us, we will pass on your data to them to the extent necessary. Service providers who work on our behalf sometimes process data for us. If this is the case, we conclude a so-called data processing agreement with the service provider, by which we oblige the service provider to process the data carefully and in accordance with our instructions.

This means that the service providers process the data according to our specifications and on our behalf. Apart from that, only those employees of our company who need to see your data within the scope of the application process have access to your personal data, i.e. in particular the personnel department and the decision-makers in the respective department, who also have to make a decision about your employment and therefore need to see your data.

5. Transfer to a third country

Personal data may also be transferred by us to third countries. Third countries in the sense of data protection law are countries outside the European Economic Area.

In some third countries, such as the USA, there is a particular risk that your data may be processed by authorities for control and monitoring purposes, possibly also without any legal remedy. A data transfer to third countries only takes place if an adequate level of data protection within the meaning of Art. 44 - 46 GDPR can be ensured through additional measures.

This can be achieved through the existence of an adequacy decision by the EU Commission or through the conclusion of EU standard contractual clauses and, if applicable, the agreement of further technical and organisational measures. You can request a copy of the guarantees applied in each case using the contact details provided.

6. Your rights in relation to data processing

In principle, you are entitled to the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR) or deletion (Art. 17 GDPR) of your personal data as well as the right to data portability (Art. 20 GDPR). Furthermore, you may request the restriction of data processing (Art. 18 GDPR) and object to the processing (Art. 21 GDPR) of your personal data as well as the right not to be subject to a decision based solely on automated processing (Art. 22 GDPR).

7. Revocation of consent

If the collection or processing of your personal data is based on consent, you can revoke your consent at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected in the event of revocation.

8. Right of appeal to the supervisory authority

Finally, you have the right to lodge a complaint to a data protection supervisory authority. You can assert this right, for example, with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement.

In Berlin, where we are based, the competent supervisory authority is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin.

9. Necessity of the provision of personal data

The provision of personal data within the scope of application processes is neither legally nor contractually required. You are therefore not obliged to provide us with your personal data. However, please note that this is necessary for the decision on an application or the conclusion of a contract in relation to an employment relationship with us. If you do not provide us with personal data, we will not be able to make a decision regarding the establishment of an employment relationship. We recommend that you only provide personal data in your application that is required to complete the application.

10. Automated decision making

We do not process personal data collected in the application process as part of automated decision-making (including profiling).

11. Amendment of the data protection notice

In the context of the further development of data protection law and technological or organisational changes, we sometimes change our data protection information.

Versions status: 01 November 2022