Data protection information

DATA PROTECTION
 
We are delighted by your interest in Hamburger Hafen und Logistik AG (HHLA). We take the protection of the personal data provided by you for the purpose of your application very seriously, and we would like to assure you that we comply with data protection regulations when processing your personal data. This includes that we inform you about the handling of your data in the application process at HHLA as follows:

Controller
Hamburger Hafen und Logistik Aktiengesellschaft
Bei St. Annen 1
20457 Hamburg, Germany
Tel.: +49 40 3088-0
karriere@hhla.de

The electronic applicant management system is used by HHLA as a central recruitment tool for handling the vacancy-filling and application process, including on behalf of individual companies belonging to the HHLA Group and the intermediate holding company. As a rule, the controller responsible for the respective job advertisements and for the processing of personal data in the application process is the HHLA Group company named in the relevant job advertisement.

If you have any questions regarding this notice, you may contact our Data Protection Officer at the address given above or by email at datenschutz@hhla.de.

Your information

The categories of personal data processed include your contact details (such as first name, surname, telephone number, email address) as well as further data relating to your career history (e.g. CV, qualifications and degrees, professional experience) and relating to your person (e.g. cover letter). These may also include special categories of personal data (e.g. information on severe disability). When you submit your application documents, you transmit them to us, in addition to your personal details, documents such as your cover letter, CV, references and other supporting records. All documents submitted are processed by us automatically upon submission of your application documents and stored in an applicant database. Your attachments are processed using optical character recognition (OCR) software, and the recognized content is stored in your data record. Your original files are converted into PDF documents and likewise stored in your data record. Your original files are then deleted. If documents are missing, we reserve the right to request them subsequently and to add them to the applicant management system in accordance with the process described here.

Please ensure that you do not send us any harmful file attachments (e.g. viruses). Please do not provide us with any information that is not necessary for your application, in particular no information concerning your ethnic origin, your political, religious or philosophical beliefs, your trade union membership or your sexual orientation. You may, however, provide information regarding severe disability or equal status on a voluntary basis. We process such information exclusively to fulfil our obligations under Book IX of the German Social Code (SGB IX) and to involve the representative body for severely disabled employees (Schwerbehindertenvertretung).

The information you provide to us must be truthful and must not infringe the rights of third parties, provisions of public law or accepted principles of morality.

We process exclusively the personal data that you provide in the HHLA application form and that is collected in the further course of the application process.

The provision of your personal data is neither required by law nor by contract. However, we require the information marked as mandatory in the application form to review your application and, where applicable, to enter an employment relationship with you. Without this information we cannot consider your application. All other information is provided voluntarily; you will suffer no disadvantage if you choose not to provide it.

Purposes and legal bases of processing

We process your personal data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other relevant legal provisions. The processing serves the purpose of establishing an employment relationship. The primary legal basis for this is Art. 6(1)(b), Art. 88(1) GDPR in conjunction with Section 26(1) sentence 1 BDSG. In individual cases we process your data to safeguard the legitimate interests of the controller or of third parties (e.g. subsidiaries of the HHLA Group). Such a legitimate interest exists where the processing of your data is necessary for an intra-group exchange of data for administrative purposes (legal basis: Art. 6(1)(f) GDPR). Where special categories of personal data within the meaning of Art. 9(1) GDPR are processed, this serves, within the framework of the application procedure, the exercise of rights or the performance of legal obligations arising from employment law, social security law and social protection law (e.g. the employer's duty of involvement vis-à-vis the representative body for severely disabled employees pursuant to Section 164(1) SGB IX and that body's rights to be heard and informed pursuant to Section 178(2) SGB IX). This takes place based on Art. 9(2)(b) GDPR in conjunction with Section 26(3) sentence 1 BDSG.

The necessity and scope of the data collection are assessed, among other things, based on the position to be filled. Where the position to be filled involves particularly confidential duties, increased responsibility for staff and/or finances, or is subject to certain physical and health-related requirements, further risk-based data collection may be necessary. Such specific data collection or procedures (e.g. medical fitness examination, criminal record certificate, pre-employment screening) generally take place only immediately prior to your appointment and are accompanied by separate information.

In certain cases, we also process your data to safeguard a legitimate interest of ours or of third parties. This may occur, among other things, to defend against legal claims under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz – AGG). In this context we have a legitimate interest in processing your data for evidentiary purposes.

Your data may be disclosed to other HHLA Group companies insofar as this is necessary for the conduct of the application procedure. The legal basis for this is Art. 6(1)(f) GDPR. The legitimate interest lies in assessing your suitability for further vacancies within the Group, in the central management of recruitment and in avoiding parallel application procedures.

In addition, we are legally obliged under European and national provisions to carry out certain processing operations, in particular a name check / data comparison against official sanctions and anti-terrorism lists (e.g. pursuant to EU Regulations No. 2580/2001 and 881/2002). The background to this check is that no funds may be made available to people and organizations listed on sanctions and anti-terrorism lists. This check is carried out immediately prior to your appointment on the legal basis of Art. 6(1)(c) GDPR.

As a rule, we process only such data as you provide to us yourself. In certain cases, we also receive data from other sources. These include, in the case of a medical fitness examination, the examination result from the examining physician, in the case of a criminal record certificate, the certificate issued by the German Federal Office of Justice (Bundesamt für Justiz), in the case of the comparison against sanctions and anti-terrorism lists, the lists published by the competent authorities; and, where you name referees, the information provided by those persons.

Recipient of the data and data transfers

The application portal is used by HHLA centrally, including on behalf of individual companies belonging to the HHLA Group and the intermediate holding company. In addition to the company to which you have applied, HHLA's central Human Resources department also has access to the application data you have submitted. As a matter of principle, only those persons who have access to your data require such access for the proper conduct of the application procedure or for the fulfilment of statutory obligations.

We use a specialized software provider for the application process. This provider acts as a service provider on our behalf and may, in connection with the maintenance and servicing of the systems, also gain knowledge of your personal data. We have concluded a data processing agreement with this provider which ensures that the processing is carried out in a lawful manner.

The application portal is operated on behalf of HHLA by concludis GmbH, Frankfurter Straße 561, 51145 Cologne, Germany. The website is hosted on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Your CV is processed automatically by the parsing tool of Textkernel BV. The parsing takes place on a server located in Germany, and your data is deleted at Textkernel BV once the operation is complete. concludis GmbH has concluded data processing agreements pursuant to Art. 28 GDPR with these providers.

Application data is processed exclusively in data centres located in the Federal Republic of Germany. Beyond the recipients and processors, we do not disclose your data to any other party.

Retention period

As a matter of principle, we anonymize or delete your personal data as soon as it is no longer necessary for the purposes set out above. This regularly takes place three months after the conclusion of an application procedure. If you have consented to further storage of your personal data (legal basis: Art. 6(1)(a) GDPR), we will delete your data upon expiry of the agreed period. As a rule, this period is two years. You also have the right to withdraw your consent at any time without this affecting the lawfulness of the processing carried out based on the consent up to the point of withdrawal.

Questionnaire evaluating the application process

Following the conclusion of an application procedure, you may voluntarily evaluate our application process by means of a questionnaire. You access the questionnaire via a link sent to you by email. The processing of your email address for the purpose of sending you the link to the questionnaire takes place based on your consent (Art. 6(1)(a) GDPR, having regard to Section 26(2) sentence 1 BDSG), which you may give us during the procedure. Participation in the questionnaire has no consequences for your application procedure. The survey serves exclusively to analyze our application process and to identify opportunities to improve our procedures through feedback.

For the online questionnaire we use a specialized provider with whom we have concluded a data processing agreement pursuant to Art. 28 GDPR. When the questionnaire is transmitted, only metadata (e.g. IP address) as well as the questions and your answers are transmitted. This processing likewise takes place based on your consent (Art. 6(1)(a) GDPR, having regard to Section 26(2) sentence 1 BDSG). The survey data is transmitted via a secure TLS connection. The results of the questionnaire are evaluated by our Human Resources department and are at no point linked to you personally or to any data you submitted during the application procedure. Your answers are anonymized or deleted as soon as we have completed the evaluation. This generally takes place three months after submission of your questionnaire. The documentation and any internal publication of the evaluation results take place exclusively in anonymized form, without naming you and without any information permitting conclusions to be drawn about your identity.

Automated decision-making

We use optical character recognition and CV parsing software to structure your documents. This software processes your information on a purely technical basis. We do not take any decision on your application based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Decisions on the progress of your application are always taken by members of our staff.

Your data protection rights

You have the following rights under the applicable data protection legislation:

• The right to obtain information about the processing of your own personal data pursuant to Art. 15 GDPR (right of access).
• The right to rectification and to erasure, including the "right to be forgotten", pursuant to Art. 16 and Art. 17 GDPR.
• The right to request restriction of processing pursuant to Art. 18 GDPR.
• The right to data portability pursuant to Art. 20 GDPR.
• The right not to be subject to automated decision-making which produces legal effects or causes an adverse effect, pursuant to Art. 22 GDPR.

Where we process your data to safeguard legitimate interests, you have the right to object at any time, on grounds relating to your individual situation, to such processing (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defense of legal claims. Please address your objection to the contact details given above.

Where we process your data based on consent, you may withdraw that consent at any time, without giving reasons, with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

You also have the right to lodge a complaint with the competent supervisory authority. This right may be exercised with supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The competent supervisory authority in Hamburg is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany

Email: mailbox@datenschutz.hamburg.de

All data subject rights, except for the right to lodge a complaint with the supervisory authority, may be asserted against the controller. Please use the contact details given above for this purpose.

Contact details of the Data Protection Officer:

You additionally have the right to contact our Data Protection Officer at any time (datenschutz@hhla.de).