Information obligation according to Art. 13, 14 GDPR when collecting personal data.
For the sake of readability, the male form has been used in the above designations, but the information applies to members of all genders. With regard to subcontractors, it is assumed that personal data of, for example, a managing director is actually processed concerning the applicability of these data protection guidelines.

1. Name and contact details of the joint controllers

Comites – perfect placements and cardea Life Science, acting as joint controllers according to Art. 26 GDPR, represented by the managing directors Stephanie Schorp and Dr. Andreas Föller.
Address: Münchner Straße 113, 85774 München-Unterföhring.

Purposes of data processing, data categories, data sources, and legal bases for processing

2.1. Purposes of data processing:

We, along with authorized third parties, process personal data to:

• establish contact with you as an interesting candidate (again) or based on your initiative and initiate a potential application process (recruiting, acquisition measures)
• establish contact with you as an interesting business partner or based on your initiative and initiate a business relationship or concrete contractual arrangement (contracting)
• conduct an application process, which includes sending your candidate profile to our clients and possibly client-side MSP providers (= Managed Service Providers) and coordinating customer interviews together with you (recruiting)
• present you as an individual or your company to our customers in the area of contracting (including freelance placement)
• conduct application and, if necessary, briefing interviews via video call (Microsoft Teams)
• effectively negotiate and conclude a contract, including conducting contract negotiations, creating contract drafts using various software tools, etc. (recruiting, HR, sales)
• implement a concluded contract (HR, accounting)
• conduct surveys to ensure the legally accurate execution of our contracts and continuously improve ourselves as a service provider (execution of contractual relationship)

2.2. The following data categories are relevant:

• Title
• First and last name
• Regarding subcontractors: Company name
• Residential address
• Regarding subcontractors: Business address
• Phone/mobile number
• Date of birth
• Email address
• Salary expectation (hourly rate)
• Professional education
• School education
• Professional experience
• If applicable, nationality
• If applicable, availability and flexibility
• If applicable, photo/facial image during a video call
• If applicable, additional information in the CV, work certificates, and certificates

2.3. Data sources

• Yourself, if you proactively provided us with your personal data for the purpose of contact (e.g., business cards)
• Yourself, if and to the extent you have voluntarily provided us with your personal data during the contact process (acquisition) or application process
• Yourself, if and to the extent you are already a customer, and we have received your personal data from you in the context of the customer contractual relationship for the purpose of initiating candidate-contractual relationships
• If applicable, any personally known contact persons within your company
• If applicable, other third parties such as credit agencies or address service providers from whom we receive personal data legally permissible
• Publicly accessible (job) portals where you have publicly disclosed your personal data yourself
• Publicly accessible other sources such as debtor directories, land registries, commercial and association registers, press, or other third parties (credit agencies or address service providers) from whom we lawfully receive or are authorized to receive personal data

2.4. Categories of data recipients

• Authorities for fulfilling legal reporting obligations
• IT service providers for maintaining our IT infrastructure
• Debt collection service providers and lawyers to collect receivables and enforce claims in court
• If applicable, service providers who provide and maintain our applicant pool
• Reciprocal customers / applicants / subcontractors and MSPs (Managed Service Providers)

2.5. Legal bases

2.5.1. Data processing based on our legitimate interest (Art. 6 (1) (f) GDPR)

We process your personal data as part of the aforementioned acquisition measures based on our primary legitimate interest in contacting and maintaining you as a potential candidate and business partner for our respective customer projects. The same applies to the temporary transfer and storage of your personal data in our applicant pool for the duration of a specific acquisition measure, including the associated recruiting process, during which we may assume your concurrent interest in being contacted for potential positions.

Data processing for the contract performance of the contract concluded or to be concluded between you and us (Art. 6 (1) (b) GDPR)

We process your personal data, also for the purpose of contract initiation, based on Art. 6 (1) (b) GDPR if, in individual cases, a review / verification of your information in the CV is required, or in the case of providing a reference, if requested by you – assuming the data processing is legally permissible for the persons concerned – by contacting my former schools, universities, and former employers.
In the case of concluding a service or work contract with you as a freelancer, we process your data for the execution of the service or work contract. The legal basis for this is Art. 6 (1) (b) Var. 1 GDPR.

2.5.3. Data processing based on your consent (Art. 6 (1) (a) GDPR)

If and to the extent you agree that we may continue to contact you after a specific acquisition measure, i.e., addressing you by phone and sending postal or email messages, the legal basis for this is your consent given to us, namely Art. 6 (1) (a) GDPR.
Additionally, based on your consent, during the storage of your data, we may contact you to conduct internal surveys and direct marketing activities, as described in your consent declaration. The legal basis for this is also Art. 6 (1) (a) GDPR.

3. Obligation to provide personal data

The provision of personal data is necessary for the execution of the contract or contract conclusion (employee leasing agreement, service or work contract) with comites – perfect placements / cardea Life Science. Failure to provide the data would result in the application process not being carried out or a contract not being concluded.

4. Automated decision-making, including profiling

No profiling measures are carried out by the joint controllers.

5. Data transfer to a third country

Data transfers to countries outside the EU and the European Economic Area (“third countries”) occur in the context of the administration, development, and operation of IT systems.
The transfer only takes place in the following cases:

• the transfer is generally permissible because a legal basis for the data transfer is fulfilled, or you have given consent to the data transfer, and
• the special conditions for a transfer to a third country are met.

6. Storage period

Personal data is stored until the respective purpose pursued at the time of collection is achieved. Personal data is also stored for the execution of tasks in the public interest or in the exercise of official authority, if applicable. Additionally, personal data may be stored for the duration of the exercise or defense of legal claims.
Documents of rejected applicants are retained based on the General Equal Treatment Act (AGG) and the Code of Civil Procedure (ZPO) for up to six months.

If consent for storing the application in an applicant pool is given, storage will continue for the duration of the consent declaration.

In the case of concluding an employment contract, personal data will be stored for the duration of the employment relationship. The same applies to service or work contracts with freelancers.

Personal data is also stored for the execution of tasks in the public interest or in the exercise of official authority, if applicable. Additionally, personal data may be stored for the duration of the exercise or defense of legal claims.

The personnel file is generally kept until the statutory limitation period has expired, up to three years after the claim is due. Individual documents of the personnel file (e.g., payroll records, exemption certificates) are kept for up to six years (according to the Income Tax Act and the Fiscal Code) or up to ten years (according to the Commercial Code).

7. Data Subject Rights

For the processing of your data, comites – perfect placements and cardea Life Science, Münchner Straße 113, 85574 München-Unterföhring, are jointly responsible, unless otherwise stated. You can request information from us at any time about the data stored about you and request correction in case of errors. Furthermore, you have the right to restrict processing, the portability of the data you provided to us in a machine-readable format, or the deletion of your data – to the extent they are no longer required.
Additionally, you have the right to object to the use of your data based on public or legitimate interests. If we process your data based on your consent, you can revoke this consent at any time with effect for the future. After receiving your revocation, we will no longer process your data for the purposes stated in the consent. Please direct your revocation or objection to:
Comites – perfect placements
Münchner Straße 113
85574 München-Unterföhring
info@comites.com

8. Right to Lodge a Complaint with a Supervisory Authority

You also have the right to lodge a complaint with a supervisory authority at any time. For us, the Bavarian State Office for Data Protection Supervision, Postfach 606, 91511 Ansbach, is generally responsible. Alternatively, you can contact the supervisory authority that is locally responsible for you.
Are you a prospect or customer? Find our privacy policy here.

For more details on data processing on our websites, please refer to our general privacy policy here.