Privacy policy for applications 

We are pleased that you would like to apply to ArtNight/BakeNight. In the following we explain how we process your personal data in the context of an application and provide further relevant information. 

1 Who is responsible for the processing of your personal data? 

ArtNight GmbH as well as BakeNight GmbH here referred to as "we", is responsible in the sense of the EU data protection basic regulation ("DSGVO"). 


2. Data protection officer 

You can always consult our People & Culture Team via hr@artnight.com or our Data Protection Officer, Aimie-Sarah Carstensen on all questions relating to the processing of your personal data and the exercise of your rights under the DSGVO. 


3. For what purposes and on what legal basis do we process personal data? 

We process personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary for the decision to establish an employment relationship with us. The legal basis for this is § 26 para. 1 in conjunction with para. 8 p. 2 BDSG. Furthermore, we may process personal data about you, as far as this is necessary to defend against legal claims asserted against us in the application process. The legal basis is Art. 6 para. 1, letter f DSGVO, the legitimate interest is for example a duty of proof in proceedings under the General Equal Treatment Act (AGG). 

In the event of an employment relationship between you and us, we may, pursuant to Art. 26 para. 1 BDSG, further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of employee representation arising from a law or a collective bargaining agreement, a works or service agreement (collective agreement). 


4. What categories of personal data do we process? 

We process data that are related to your application. This can be general data about you (such as name, address and contact details), information about your professional qualifications and schooling or information about professional training or other information that you provide us with in connection with your application. In addition, we may process publicly available, job-related information you provide, such as a profile on professional social media networks. 


5. From which sources does personal data originate if we do not collect it directly from you? 

As far as we do not collect the data directly from you and you have an active application platform profile, or you disclose an inactive or only partially active profile during the application process, we may also collect personal data about you. 


6. What categories of recipients are there of data? 

We may transfer your personal data to companies affiliated with us to the extent permitted by the purposes and legal basis set out in section 3. Otherwise, personal data is processed on our behalf on the basis of contracts pursuant to Art. 28 DSGVO, in particular by host providers or providers of applicant management systems. 


7. Is the transfer to a third country intended? 

A transfer to a third country is not intended. 


8. How long is your data stored? 

We store your personal data as long as it is necessary to decide on your application, but at least six months. If an employment relationship between you and us does not materialize, we may also continue to store data to the extent necessary to defend against possible legal claims. In this case, the application documents will be deleted two months after the rejection decision is announced, unless longer storage is necessary due to legal disputes.

 

9. What rights do you have? 

As an applicant with us, you have the following data protection rights, depending on the situation in each individual case. 

To exercise these rights, you can contact us or our data protection officer at any time using the data mentioned in points 1 and 2: 

a. Information 

You have the right to obtain information about your personal data processed by us and to request access to and/or copies of your personal data. This includes information on the purpose of use, the category of data used, the recipients and persons entitled to access the data and, if possible, the planned duration of data storage or, if this is not possible, the criteria for determining this duration.

b. Rectification, erasure or limitation of processing 

You have the right to demand that we correct any personal data that concerns you or is incorrect. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, also by means of a supplementary declaration. 

c. Right to object 

If the processing of personal data concerning you is carried out on the basis of art. 6, paragraph 1, letter f of the DPA, you have the right to object to the processing of such data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can prove compelling reasons for processing worthy of protection that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. 

d. Right of withdrawal 

If the processing is based on consent, you have the right to revoke the consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, you can contact us or our Human Resources Manager or Data Protection Officer at any time using the above-mentioned data. 

e. Right to deletion

You have the right to demand that we delete any personal data concerning you immediately and we are obliged to delete personal data immediately if one of the following reasons applies: 

● the personal data is no longer necessary for the purposes for which it was collected or otherwise processed 

● You object to the processing in accordance with paragraph 8.c above and there are no legitimate reasons for the processing 

● The personal data were processed unlawfully 

● The deletion of personal data is necessary to comply with a legal obligation under Union law or the law of the 

Member States to which we are subject. This does not apply if the processing is necessary: 

o to comply with a legal obligation requiring processing under Union law or the law of the Member States 

to which we are subject. 

o to assert, exercise or defend legal claims. 

f. Right to limit processing 

You have the right to request us to restrict processing if one of the following conditions is met: 

● the accuracy of your personal data is disputed by you, for a period of time that allows us to verify the accuracy of the personal data 

● the processing is unlawful and you object to the deletion of the personal data and instead demand the restriction of the use of the personal data 

● we no longer need the personal data for the purposes of the processing, but you need it for the purpose of asserting, exercising or defending legal claims, or you have lodged an objection to the processing in accordance with point 8.c above, as long as it is not yet clear whether our legitimate reasons outweigh yours. If processing has been restricted in accordance with point (e), such personal data may be processed, with the exception of storage, only with your consent or for the purpose of pursuing, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State. If you have obtained a restriction on processing, we will inform you before the restriction is lifted. 

g. Right of appeal 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the alleged 

infringement, if you consider that the processing of personal data relating to you is in breach of the DPA 


10. Necessity of providing personal data 

The provision of personal data is not required by law or contract, nor are you obliged to provide the personal data. 

However, the provision of personal data is required for the conclusion of a contract of employment with us. This means that if you do not provide us with personal data in an application, we will not enter an employment relationship with you. 


11. No automated decision making 

There is no automated decision in individual cases in the sense of Art. 22 DSGVO, i.e. the decision on your entries is not made automatically.