Data protection declaration as to application procedure pursuant to the EU General Data Protection Regulation (GDPR)

Applicable for applicants of the LOSCH Airport Service GmbH (hereinafter referred to as the “LOSCH“).
With the following information pursuant to Art. 12 et seq. GDPR we will provide an overview of our processing of your personal data in line with the application procedure and your rights from the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The individual course of the application procedure shall be decisive for the data to be processed in detail and the manner they are used.

1. Person responsible for data processing
LOSCH Airport Service GmbH
Luftfrachtzentrum 605/3
70629 Stuttgart
Germany
Telephone +49 (0)711 990 8834
Fax +49 (0)711 990 8835
E-mail info @ loschairportservice.de
Internet www.loschairportservice.de

2. Data protection officer of the controller
Christian Schwinge
Ingenieurbüro Frahm GmbH
Kurze Straße 30
70794 Filderstadt
Germany
Telephone +49 (0) 711 / 258560-0
E-mail datenschutz @ loschairportservice.de

3. Data and data sources
a) Sources
We process personal data provided by you in line with the application procedure. Moreover, we process personal data you have made accessible to us via a profile in a professional social media network (e.g. XING, LinkedIn, Airliners.de, Kimeta, etc.) or we have collected permissibly from other publicly accessible sources and may process (e.g. website with application, Job interview via Skype or other video calling tools, etc.)

b) Categories of personal data
In line with the application procedure the following personal data related to your application can be collected, processed and saved:
Address and communication data (name, address, telephone, e-mail address, Skype ID, other contact details), person master data (date/place of birth, gender, nationality, marital status, legal capacity), as well as information on professional qualifications, education and professional development.
Moreover, further personal data provided to us (CV, certificates, questionnaires, interviews, previous activities) or occupational information we collected from sources (e.g. professional social media networks, website with application, etc.) you have made publicly accessible, will be processed).
If provided by you voluntarily in the application letter or in the course of the application procedure, special categories of personal data (such as health data, religion, degree of disability) will also be processed.
In particular by personal, telephone or written contacts initiated by you or LOSCH further personal data are created. This includes e.g. information on the contact channel, date, occasion and result (electronic) copies of the correspondence, as well as interview transcripts.

4. Purpose and legal basis of processing
We process the personal data mentioned in 3 for the purpose of your application for an employment relationship in compliance with the regulations of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

a) For the purpose of the employment relationship (Art 6 (1) lit. b GDPR combined with Section 26 (1) combined with (8) GDPR)
Personal data shall be processed insofar as it is decisive for the employment relationship.

Insofar as an employment relationship is established between you and us, we can process the personal data already provided by you further pursuant to Section 26 (1) GDPR, if this is required for the realization or termination of the employment or for exerting or fulfilling rights and obligations of representing the interests of employees resulting from legislation or a collective agreement, a works or service agreement (collective agreement).

In the context of your application we shall be entitled to contact you under the data provided by you.

b) On the basis of your consent (Article 6 (1) lit. a GDPR combined with Section 26(2) GDPR)
Provided that you have given us your consent to process personal data in line with the application procedure for certain purposes (e. g. disclosure of data within the corporate group), the processing shall be legitimate on the basis of your consent. A given consent may be revoked at any time. Please note that the cancellation will only be valid for the future. Processing made before the cancellation shall not be affected. You may request an overview of the status of the contents you have given at any time.

c) On the basis of your consent for special categories of personal data (Article 9 (2) lit. a GDPR combined with Section 26(2) GDPR)
The processing of special categories of personal data (e.g. health data) shall be based on your consent pursuant to Art 9 (2) lit. a GDPR combined with Section 26 (2) GDPR, unless legal permissions such as Art 9 (2) lit. b combined with Section 26 (3) GDPR are pertinent.

d) In line with the balancing of interests (Article 6 (1) lit. f GDPR)
To protect justified interests of us or a third party the processing of data submitted by you can be required for the following reasons:
– Defense of asserted claims from the application procedure
– Burden of proof in a process pursuant to the General Equal Treatment Act (GETA)
– Reconciliation with so-called EU terror lists pursuant to the European anti-terror regulation 2580/2001 and 881/2002 to ensure that no funds or other economic resources are provided for terrorist purposes
– Carrying out the background check according to §7 Aviation Security Act
– In-house statistical purposes (e.g. studies as to the behavior of applicants) with anonymized data

e) In line with collective agreements (Article 88 (1) GDPR combined with Section 26(4) GDPR)
Group, overall and individual plant agreements can be used as consent to the processing of your personal data.

5. Recipients of data
Within the LOSCH those persons and entities shall be granted access to your data which are required by them to make a decision and to comply with our (pre-) contractual and legal obligations.

We can transmit your personal data to related companies of the LOSCH group of companies, to the extent permissible in line with the purposes and legal bases mentioned under 4. or data processing tasks for applicant management are centrally executed within the group.

If we are not able to offer you a position to be filled, but think that your application could be of interest for future positions within the group due to your profile, we will forward your personal application data to other companies related to us, provided that your express consent is at hand.

With regard to data transfer to recipients outside LOSCH it must be considered first of all that we will only transfer information about you if provided by legal stipulations, you have given your consent and/or processors commissioned by us guarantee that the requirements of the EU GDPR and the Federal Data Protection Act are complied with and this is required for constituting an employment relationship.
Under these conditions the recipients of personal data may for instance be:
– Public bodies and institutions in the circumstances of a statutory or official obligation
– Processors to which we submit personal data for the execution of the business relationship. In detail: Providers of applicant management systems, support/servicing of EDP/IT applications, data destruction, website management incl. host provider.

Further data recipients may be those entities for which you have given the consent to data transfer.

6. Data transfer to third countries or international organizations
Transfer of data submitted by you to a third country or an international organization shall on no account take place. If you wish to have the data submitted by you transferred to a third country or an international organization on a case-by-case basis, we will do so only with the written consent of you at hand.

7. Term of data storage
We will save your personal data as long as required for the decision as to your application. Insofar as an employment relationship between you and us is not established, we will delete your personal data 6 months upon termination of the application procedure.
This shall not be applicable if legal stipulations are opposed to the deletion or another saving for the purpose of argumentation for defending possible legal claims is required or you have given your consent to longer saving.
If we are not able to offer you a position to be filled, but think that your application could be of interest for future job offers due to your profile, you hereby give your consent that your personal application data will be processed for 6 months in our applicant database.

8. Data protection rights of the data subject
Depending on the situation you, as an applicant, will have the following data protection rights on a case-by-case basis. Please do not hesitate to contact us or our data protection officer as to the assertion of such rights.

a) Right of access by the data subject (Art. 15 GDPR)
You are entitled to access your personal data processed by us, as well as demand access to your personal data and/or copies of these data. This shall include information about the purpose of processing, the categories of the data concerned, its recipients and the recipients or categories of recipient to whom the personal data have been or will be disclosed, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period. The restrictions of Section 34 Federal Data Protection Act shall apply.

b) Right to rectification (Art. 16 GDPR)
You shall have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete personal data completed (also by means of providing a supplementary statement).

c) Right to erasure (Art. 17 GDPR)
You shall have the right to obtain from us the erasure of personal data concerning you without undue delay and we shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
– The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
– You revoke consent to the processing and where there are no other primary legitimate reasons for the processing
– The personal data have been unlawfully processed
– The personal data must be erased for compliance with a legal obligation in Union or Member State law to which we are subject. This shall not apply for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the establishment, exercise or defense of legal claims
The restrictions of Section 35 Federal Data Protection Act shall apply.

d) Right to restriction of processing (Art. 18 GDPR)
You shall have the right to demand restriction of processing where one of the following applies:
– The accuracy of the personal data is contested by you for a period enabling us to verify the accuracy of the personal data
– The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
– We no longer need the personal data for the purposes of the processing, but they are required by you for the assertion, exercise or defense of legal claims.
– You have objected to processing pending the verification whether the legitimate grounds on our part override yours.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If you have obtained restriction of processing we shall inform you before the restriction of processing is lifted.

e) Right to data portability (Art. 20 GDPR)
You shall have the right to receive the personal data provided by you, in a structured, commonly used and machine-readable format.

f) Right to object (Art. 21 GDPR)
As far as the processing is based on Art. 6 (1) lit. f GDPR, you shall at any time have the right to object on grounds relating to your particular situation, to the processing of these personal data. We will then no longer process these personal data, unless we are able to prove compelling legitimate reasons for the processing that override your interests, rights and freedoms or the processing is for asserting, exercise or defense of legal claims.

g) Right to withdraw (Art. 7 (3) GDPR)
Where processing is based on consent, you shall be entitled to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Please do not hesitate to contact our data protection officer at any time under the aforementioned data.

h) Right to complaint (Art. 13 (2) lit. d GDPR and Article 77 GDPR combined with Section 19 Federal Data Protection Act)
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

9. Obligation to provide data
Within the context of your application you must provide the personal data required for the handling of the application procedure and assessment of aptitude. Without these data we cannot conduct the application procedure nor make a decision on the establishment of the employment relationship.

10. Automated decision-making (including profiling)
There will be no automated decision on a case-by-case basis in terms of Art. 22 GDPR, i.e. the decision on your application is not exclusively based on automated processing.

Version: February 2019