Data protection information for employees

pursuant to EU General Data Protection Regulation (GDPR), Article 13 and 14

Data protection is of utmost importance to us. The following information explains how we process your data and what your rights are.

1.    Who is responsible for data processing and who can you contact?
Gänsäcker 15
D-78532 Tuttlingen
Phone: +49 (0)7462 200 90
Fax: +49 (0)7462 200 950

2.    Contact details of the Data Protection Officer

Edmund Hilt, hilt evolution, 

3.    Purpose of processing and legal basis

Your personal data shall be processed in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other relevant data protection regulations. Please find further details and additional information regarding processing purposes in our contractual documents, forms, declarations of consent and other information provided (e.g. on the website or in the Terms and Conditions).

3.1    Consent (GDPR, Art. 6(1)(a))

If you have given us consent to process your personal data, this consent shall serve as the legal basis for the processing specified therein. You may revoke your consent with future effect at any time.

3.2    Fulfilling contractual obligations (GDPR, Art. 6(1)(b))

We shall use your personal data on the basis of employment contracts we enter into with you. We require this information to maintain the employment relationship.

3.3    Fulfilling legal obligations (GDPR, Art. 6(1)(c))

We shall process your personal data if this is necessary for compliance with legal obligations.
Furthermore, we shall process your data if necessary for identification purposes, the fulfilment of fiscal control and reporting obligations, the archiving of data for the purposes of data protection and data security as well as for auditing by tax authorities and other authorities. Disclosure of personal data may also become necessary in the course of official/judicial action for the purposes of gathering evidence, prosecution or enforcement of civil claims.

3.4    Legitimate interest on our part or on the part of third parties (GDPR, Art. 6(1)(f))

We may also use your personal data on the basis of a weighing of interests to protect the legitimate interests on our part or on the part of third parties. This shall apply with regard to the following purposes:

  • For the limited storage of your data if deletion is not possible or only possible with disproportionately great effort on account of the special type of storage
  • For statistical analyses
  • For the assertion of legal claims and defence in legal disputes which are not directly attributable to the contractual relationship
  • For internal and external investigations and/or security audits
  • For certification under private law or official matters
  • For safeguarding and exercising our property rights through appropriate measures (e.g. video surveillance)

4.    Categories of personal data processed by us
The following data shall be processed:

  • First name and last name
  • Contact details (e.g. e-mail address, postal address, phone number)
  • Full application (e.g. CV, certificates, references)
  • Social contribution information (e.g. date and place of birth, maiden name, social insurance number (SV-Nr.), medical insurer, ‘German Data Entry and Transfer Ordinance’ (DEÜV), marital status)
  • Payroll data (e.g. salary, wage, working hours, sick leave, leave entitlement, bank data)


5.    Who receives your data?

We pass on your personal data within our company to those departments that require this data to fulfil their contractual and legal obligations, or to comply with our legitimate interest.
Moreover, the following bodies may receive your data:

  • Contract processors used by us (GDPR, Art. 28), providers of support services and other parties responsible pursuant to the GDPR, in particular in the areas of: IT services, logistics, courier services, printing services, external computer centres, support/maintenance of IT applications, archiving, document processing, bookkeeping and controlling, data destruction, purchasing/procurement, customer administration, letter shops, marketing, telephony, website management, tax consultancy, auditing services, credit institutions
  • Public bodies and institutions where there is a legal or official obligation requiring us to provide information, report or disclose data or where the disclosure of data is in the public interest
  • Bodies and institutions on the basis of our legitimate interest or the legitimate interest of the third party (e.g. to authorities, credit agencies, debt collection agencies, lawyers, courts, experts and supervisory bodies)
  • Other bodies for which you have given us your consent for the data transfer

6.    Transfer of your data to a third country or an international organisation

Data processing shall not take place outside the EU or EEA.

7.    How long do we store your data?

If required, we shall process your personal data for the duration of our employment relationship.
Furthermore, we are subject to various storage and documentation obligations, including those arising from statutory framework conditions. The periods for storage and documentation specified therein are up to ten years following termination of the employment relationship.
Ultimately, the storage period shall also be determined by the statutory limitation periods, which pursuant to Sections 195 et seq. of the German Civil Code (BGB), for example, are generally three years; however, in certain cases, these may be as long as thirty years.

8.    To what extent is there automatic decision-making in individual cases (including profiling)?

We do not use purely automated decision-making procedures in accordance with GDPR, Article 22. If we use these procedures in individual cases, we shall inform you separately of this, insofar as this is required by law.

9.    Your privacy
You have the right of access to information under GDPR, Article 15, the right to correction under Article 16, the right to deletion under Article 17, the right to limitation of processing under Article 18, and the right to data transferability under Article 20. Furthermore, the right to appeal to a data protection supervisory authority shall apply pursuant to GDPR, Article 77. In accordance with GDPR, Article 21, the right to object to the processing of personal data by us shall always apply. However, this right of objection shall only apply in the case of very special circumstances in your personal situation, where the rights of our company may conflict with your right of objection. If you wish to exercise any of these rights, please contact our Data Protection Officer

10.    Extent of your obligations to provide us with your data

You shall only be required to provide data which is necessary for the establishment and performance of an employment contract with us or which we are legally obliged to collect. Without this data, we shall not usually be able to enter into an employment contract with you. If we request additional data from you, you shall be informed of the voluntary nature of the information separately.

11.    Your right to appeal to the competent supervisory authority

Pursuant to GDPR, Art. 77, you have the right to appeal to the data protection supervisory authority. The responsible supervisory authority is:
The State Commissioner for Data Protection and Freedom of Information (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit)
Königstrasse 10 a
70173 Stuttgart