Data protection at ista: The protection of your personal data is very important to ista.

We use the analysis software Piwik PRO Analytics Suite (piwikpro.de) to analyse and optimise this website. The data collected with this software can be used to create user profiles under a pseudonym.  

Data processing purposes

This list contains the purposes for which data are collected and processed. Consent is valid only for the purposes specified. The data collected cannot be used or stored for purposes other than those listed below.  

• Analysis
• Optimisation

Technologies used

• Cookies

Data collected

This list contains all (personal) data that are collected during or through the use of the service.

• Anonymised shortened IP address
• Usage data
• User ID
• Date and time of the visit
• Referrer URL
• Websites visited
• Screen resolution
• Geographic location 
• User agent
• Visitor ID

Legal basis

The required legal basis for the processing of data is listed in the following:

• Art. 6, para. 1 s. 1 lit. a GDPR

Location of processing

• European Union

Retention period

The retention period is the period of time during which the data collected are stored for processing. The data must be deleted as soon as they are no longer needed for the stated processing purposes. The data are stored for up to 25 months.

Data recipient

• Piwik PRO Sp. z o.o.
• Piwik PRO GmbH

Data protection officer of the processing company 

Below you will find the email address of the data protection officer of the processing company.
gdpr@piwik.pro

Consent to the collection and storage of data can be withdrawn at any time with immediate future effect. 

Click here to read the privacy policy of the data processor https://piwik.pro/privacy-policy/

Click here to withdraw consent on all domains of the data processing company https://piwik.pro/opt-out/

Google Tag Manager is a solution with which website tags can be managed via an interface (and thus, for example, integrate Piwik Pro into our online offering). The Tag Manager itself (which implements the tags) does not process any personal data of the users.

Data processing purposes

This list contains the purposes for which data are collected and processed. Consent is valid only for the purposes specified. The data collected cannot be used or stored for purposes other than those listed below.  

• Functionality

Technologies used

• Java Script

Data collected

• None

Legal basis

The required legal basis for the processing of data is listed in the following:

• Art. 6, para. 1 s. 1 lit. f  GDPR

Location of processing

• Computer of the browser 

Retention period

The retention period is the period of time during which the data collected are stored for processing. 
The data are deleted as soon as they are no longer needed for the processing purposes.

Data recipient

• No data are disclosed to third parties 

Description of Service

This is a remarketing service. With Remarketing, the user can display ads to users of the website based on their interests on other websites within the Google Displaying Network (e.g. in Google Search or on YouTube). For this purpose, the users' interactions are analyzed, e.g. regarding the products and services a user is interested in. This enables the user to display targeted advertising to the user on other websites even after the visit to the website.

Processing Company

Google Ireland Limited
Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data Protection Officer of Processing Company

Below you can find the email address of the data protection officer of the processing company.

https://support.google.com/policies/contact/general_privacy_form

Data Purposes

This list represents the purposes of the data collection and processing.

• Remarketing

• Advertisement

• Tracking users' actions

Technologies Used

This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser.

• Cookies

• Tracking Pixel

Data Collected

This list represents all (personal) data that is collected by or through the use of this service.

• Duration of visit

• IP address

• Pages visited

• Content user is interested in

• Website use

• Referrer URL

• Advertising identifier

• Date and time of visit

• Device information

• Browser information

Legal Basis

In the following the required legal basis for the processing of data is listed.

• Art. 6 para. 1 s. 1 lit. a GDPR

Location of Processing

This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately.

• European Union

Retention Period

The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.

• The data will be deleted as soon as they are no longer needed for the processing purposes.

Transfer to Third Countries

This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the provider's privacy policy or contact the provider directly.

• Singapore

• Taiwan

• Chile

• United States of America

Data Recipients

In the following the recipients of the data collected are listed.

• Google Ireland Limited

• Google LLC

• Alphabet Inc.

Click here to read the privacy policy of the data processor

Business Data Responsibility

Click here to read the cookie policy of the data processor

How Google uses cookies – Privacy & Terms – Google

Storage Information

Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used.

• Maximum age of cookie storage: 1 year

• Non-cookie storage: no

Where not stated to the contrary below, ista SE is the controller. Therefore, ista SE is deemed the sole point of contact for data subjects within the meaning of GDPR.

2.1 What personal data do we process?

In the case of an application we process, in particular, the application data made available by you such as:

• Master data (in particular surname and date of birth),
• Contact data (in particular address and e-mail address),
• Training, qualifications and certificates,
• Additional data from the application form (in particular termination periods and desired salary),
• Banking connection to settle travelling expenses,
• Citizenship and work permit,
• Picture/sound recordings to conduct virtual discussions (no storage) and/or
• Former employers.

2.2 For what purposes and on which legal basis do we process your data?
 

a) We process your data to initiate an employment relationship.

We use and store your application data for:

• The assessment and selection of candidates,
• Preparing and conducting personal, telephone/virtual, application discussions,
• Evaluating and assessing the results of such discussions,
• Establishing contact for the purpose of verbal preparation of offers, issuing rejections or consulting about outstanding questions
• Taking your profile into consideration in the case of vacant positions for which you have not expressly applied and/or
• Other requirements in the personnel search procedure and,
• Where applicable, subsequently putting the employment relationship in place.

We conduct reviews on a case by case basis prior to the appointment. In this respect we may obtain information from your former employers or other relevant contact points within the framework of the relevant labour law requirements.

⇒The legal basis for the aforementioned processing is Section 26(1), Sentence 1, GDPR, (necessary for the decision on the establishment of an employment relationship or to honour the rights of works councils resulting from a law or a collective agreement or a company agreement).

b) We process your data to honour legal obligations.

We are subject to statutory obligations that specify the processing and in some cases also the disclosure of your data and which constitute an independent basis for the processing of your data. These are, in particular,

• Obligations to retain data, in particular from social security, commercial and tax law,
• Obligations to furnish information to our employee representatives,
• Reporting obligations.

⇒ The legal basis for processing your application data for these purposes is Article 6(1), Point c), GDPR, in conjunction with special statutory facts (e.g. social data protection, storage obligations in accordance with Sections 257 HGB (German Commercial Code), 147 AO (German Tax Code)).

c) We process your data to safeguard legitimate interests.

We also process your personal data in individual cases to safeguard the following legitimate interest:

• Defence against asserted legal claims (e.g. according to AGG).

⇒ The legal basis for this processing is Article 6(1), Point f) GDPR.

2.3 Where do your data originate and do you undertake to provide such data?

Generally, we receive all applicant data directly from you or via external personnel service providers. When we conduct pre-employment checks, we also receive data from third parties such as previous employers or other references.

If you do not provide us with the above personal data, this will not have any negative consequences for you. However, incomplete or inaccurately completed applications cannot be considered.

If information is not required for the above-mentioned purposes in individual cases, you will be informed of this separately when the data are collected.

2.4 Who is involved in the processing of my data?

Your application will, where necessary, be forwarded directly to the ista company at which you have applied for a job. Your personal data will be forwarded there to the relevant personnel department, the appropriate specialist departments and, where necessary, the works council or the representative body for severely disabled persons. Furthermore, in the case of applicants who have been suggested by personnel service providers, those personnel service providers will be involved in the application process. In other respects, your personal data will only be transferred to other recipients if we legally undertake to do so (e.g. to authorities).  

If you apply via the TalentLink application system, your applicant data will be processed by Lumesse GmbH, Flughafenstraße 103, D-40474 Düsseldorf, on our behalf. 

2.5 For how long will your data be stored?

Your applicant data will be stored for the duration of the review of your application. If this is unsuccessful or if you withdraw your application, your applicant data will be deleted in full 6 months following the rejection unless longer retention is permitted or required on the basis of another legal basis (e.g. to exercise our statutory rights or to comply with applicable law). 

In the event of recruitment, the data will be transferred to the HR administration system and processed there as employee data. For more information, please see our privacy policy for employees. 

3.1 Who is responsible for data processing?

Ista SE is solely responsible for the maintenance of the talent pool within the meaning of GDPR.

3.2 What personal data do we process?

Following conclusion of an unsuccessful application process, we will store your applicant data in our talent pool at your request for the purpose of contacting you again and, where necessary, further process such data. In this case, we may also contact you in the future for suitable job descriptions that match your profile and invite you to other events that may serve to initiate an employment relationship.

3.3    For what purposes and on which legal basis do we process your data?

We process your data on the basis of your consent. You may also withdraw your consent with effect for the future. To that end you can contact our data protection officer using the contact details below. Your data will then be deleted immediately.
⇒ The legal basis for this processing is Article 6(1), Point a), GDPR.

3.4    Where does your data originate and what are the consequences if you do not grant your consent? 

Your data originates from the application process (see Point 2). If you do not grant your consent to the inclusion of your applicant data in our talent pool, this will not result in any disadvantages for you in future application procedures.

3.5    Who is involved in the processing of my data?

In the event of inclusion in the talent pool, your applicant data will be processed via the TalentLink application system by Lumesse GmbH, Flughafenstraße 103, D-40474 Düsseldorf, on our behalf. 

3.6    Are data transferred to third countries or international organisations?

No, no such transfer takes place.

3.7    How long will your data be stored for?

In the event of withdrawal of your consent, your data will be deleted immediately. Otherwise, your data will be deleted after 23 months at the latest.

4.1    For what purposes and on what legal basis do we process your data?

As part of the selection process we use various test procedures to better assess your suitability for the position in question. In this context, in addition to the applicant data, we process, in particular, your answers to the questions of the test as well as the resulting conclusions about personality traits, skills, performance motivation and interests (“test data”). 

⇒ The legal basis for this processing is Section 26(1), Sentence 1, GDPR (necessity for the decision on the establishment of an employment relationship).

4.2    Are you under any obligation to provide your data or is this necessary to enter into a contract and what happens if you decide not to do so?

You do not undertake to provide your personal data. However, without processing your personal data, it will not be possible to consider your application, or only to a limited extent.

4.3    Who is involved in the processing of my data?

We process your data by way of incorporating our processors Profiles GmbH (Solmsstraße 83, D-06486 Frankfurt a. M.), ELIGO Psychologische Personalsoftware GmbH (Universitätsstr. 142, D-44799 Bochum) and Aon Assessment GmbH (Großer Burstah 18-32, D-20457 Hamburg).

4.4    Are data transferred to third countries or international organisations?

Data are only transferred to third countries (including the United States) in the case of data processing on the part of our order processor Aon Assessment GmbH. Protection of your data is ensured, in particular, by entering into standard contractual clauses.

4.5    For how long are your data stored?

Information about the storage of your applicant and test data can be found in Section 2.6, which applies (accordingly). 
 

5.1 Who is responsible for processing your data?

The respective social media platform is primarily responsible in accordance with data protection law for data processing when visiting our social media sites on Facebook, Instagram, YouTube, LinkedIn and Twitter. Information about data processing can be found in the respective data protection statements of the social media providers.

The ista company whose social media presence is involved in each case is jointly responsible with the operator of the social media platform for the following processing in accordance with data protection law:

• Evaluation of statistics on the usage behaviour of visitors. Such data are normally available to us in anonymised form only.
• Interaction with our social media team or reaction to our posts (e.g. via comments and likes, etc.).

5.2 For what purposes and on which legal basis do we process your data?

a.    Visiting our social media sites, user statistics

When you visit our social media sites, regardless of whether or not you are logged in, the respective social media provider collects personal data of the users (usage data), some of which is shared with us in the form of user statistics. However, we do not have full access to collected data or your profile data.

For example, the following information may be provided to us anonymously:

• Followers/fans etc.: development of the number of people who follow ista.
• Reach: e.g. number of people who see a specific post.
• Ad performance (if relevant): how many people have seen an ad?
• Demographics: average age of visitors, gender, place of residence, language.

However, we cannot draw any conclusions about individual users from the usage data. Statistics are only used to improve the online offer on our social media sites and to better respond to user interests.

b.    Interaction

If you interact with us via the social media sites, e.g. by sending us an application or other message or commenting on posts, the corresponding content of the interaction will be processed by Ista SE. In addition, it may be able to see the public information of your profile, which you can manage yourself.

⇒ In conjunction with job applications, the legal basis for this processing is normally Section 26(1), Sentence 1, GDPR, (necessity for decision about establishing an employment relationship).

⇒In other respects, Article 6(1), Point f, GDPR, (our justified interest, managing business correspondence or, e.g. to reply to enquiries directed to us as an employer) is the legal basis for the processing.

5.3 Do you in any way undertake to provide your data or is this necessary to enter into a contract and what happens if you decide not to do so?

You do not undertake to provide your personal data. However, without processing your personal data, use of our social media sites in the context of your application will not possible or only possible to a limited extent.

5.4 Who is involved in the processing of my data?

Your data will only be used or forwarded by us internally by the persons responsible in each case. Please refer to the privacy policy of the respective social media network for information about who is involved in the processing of data at the respective social media provider.

5.5 Are data transferred to third countries or international organisations?

We do not transfer your personal data to a third country or international organisation in conjunction with our social media sites.

It may be the case that an operator of social media platforms connects to servers in third countries (e.g. USA) as part of its services and forwards your personal data there. You will find information about this in the privacy policy of the respective social media provider.

5.6 For how long will your data be stored?

As a matter of principle, we do not store any personal data in conjunction with our social media sites on the servers we use, except in the aforementioned cases in which we process your information internally (direct communication, e.g. applications). Section 2.6 applies in these cases.

We also regularly have access to the data stored by the respective social media platform. For more information on the storage of your personal data by the operator of the social media platform itself, please refer to the privacy policy of the respective social media provider.

5.7 Where can you find the privacy statements of the social media providers?

The data protection declarations of the social media platforms we use and your rights in relation to the processing of your personal data can be found here:

• Facebook (provider: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland): www.facebook.com/privacy/explanation
• Instagram (provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland): help.instagram.com/519522125107875
• LinkedIn (provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland): www.linkedin.com/legal/privacy-policy
• Xing (provider: New Work SE, Dammtorstraße 30, D-20354 Hamburg, Germany): privacy.xing.com/de/datenschutzerklaerung 
• Honeypot (provider: Honeypot GmbH, Schlesische Straße 26, D-10997 Berlin, Germany):www.honeypot.io/de/privacy_policy
• Twitter (provider: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA): twitter.com/de/privacy

Where we process your personal data, to an extent in accordance with GDPR you have a right to

• Information in particular about stored data and processing purposes (Article 15 GDPR),
• Correction of inaccurate or completion of incomplete data (Article 16 GDPR),
• Erasure in particular data that are no longer required (Article 17 GDPR),
• Restriction of processing (Article 18 GDPR),
• Data portability, provided the processing is based on consent or to enter into a contract or is supported by an automated procedure (Article 20 DSGVO),
• Object to the processing (Article 21 GDPR),
• Withdraw the consent you have granted (Article 7(3), Sentence 1, GDPR).

Furthermore, you have the option of making objections

• to our data protection officer (Luxemburger Straße 1, D-45131 Essen, Datenschutz@ista.de) or
• to the relevant supervisory authority (State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, PO Box 20 04 44, D-40102 Düsseldorf, poststelle@ldi.nrw.de, Tel.: ++49 211/38424-0).

You can contact our data protection officer to exercise your legal rights and for questions regarding data processing. If you contact us with a data protection concern, we shall process your personal data on the basis of Article 6(1), Point f, GDPR, (legitimate interest). Our legitimate interest usually consists of responding to enquiries about data protection. Personal data shall be deleted if no longer required to process your enquiry and any statutory retention periods have expired.