Privacy Policy Recruitement

Privacy Policy for the Recruiting Process 

In the following, we inform you about the processing of personal data in connection with your application to PVA TePla AG and its affiliated companies, insofar as they act as potential employers in the specific application process. This policy applies in particular to applications submitted via our online application portal as well as to applications submitted to us by other means. Personal data means any information relating to an identified or identifiable natural person, e.g. name, contact details, application documents or information about professional background.

§ 1 Controller and Data Protection Officer

(1) The controller within the meaning of Art. 4(7) GDPR is PVA TePla AG, Im Westpark 10-12, 35435 Wettenberg, Germany, info@pvatepla.com (see our legal notice), unless another company of the PVA TePla Group is named as controller in the respective job advertisement.

(2) You can contact our Data Protection Officer at Dataprotection@pvatepla.com.

(3) If you apply for a position at another company of the PVA TePla Group, that company is independently responsible for the respective selection and recruitment process. Please refer to the information in the relevant job advertisement.

§ 2 Purposes of Processing in the Application Procedure

(1) We process your personal data insofar as this is necessary for carrying out the application procedure, communicating with you, assessing your suitability and deciding whether to establish an employment relationship.

(2) This includes, in particular, processing your application, conducting selection interviews, coordinating with the responsible specialist departments, documenting the selection process and preparing a possible employment contract.

(3) In addition, we may process your data insofar as this is necessary for the establishment, exercise or defence of legal claims or for compliance with legal obligations.

§ 3 Categories of Personal Data

(1) As part of the application procedure, we process in particular the data that you provide to us yourself or that is added in the course of the application procedure. This includes in particular:

• master data and contact details, e.g. name, address, email address, telephone number, date of birth, nationality and, where applicable, further personal information;
• application data, e.g. cover letter, curriculum vitae, references, qualifications, certificates, work samples, availability, salary expectations and information about professional background;
• communication data, e.g. content from emails, messages via the application portal, interview notes and appointment arrangements;
• assessment and selection data, e.g. assessments from interviews, feedback from the specialist departments involved and results from permissible selection procedures;
• technical data when using the online application portal, e.g. login and usage data, insofar as this is required for the secure operation and provision of the portal.

(2) Insofar as you voluntarily provide us with special categories of personal data, e.g. information about a severe disability or equivalent status, we process this only insofar as this is necessary for the application procedure, for safeguarding your rights or for fulfilling legal obligations.

(3) Please submit to us, as part of your application, only such information as is necessary for carrying out the application procedure.

§ 4 Legal Bases for Processing

(1) The processing of your personal data for carrying out the application procedure and for deciding whether to establish an employment relationship is based on Art. 6(1) sentence 1 lit. b GDPR in conjunction with Sec. 26(1) BDSG (German Federal Data Protection Act).

(2) Insofar as we process special categories of personal data, this is done, where necessary, on the basis of Art. 9(2) lit. b GDPR in conjunction with Sec. 26(3) BDSG or on the basis of consent expressly given by you pursuant to Art. 9(2) lit. a GDPR.

(3) Insofar as processing is necessary to comply with legal obligations, it is based on Art. 6(1) sentence 1 lit. c GDPR.

(4) Insofar as we process data for the establishment, exercise or defence of legal claims, this is based on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in safeguarding and defending our rights.

(5) Insofar as you give us consent, we process your data on the basis of Art. 6(1) sentence 1 lit. a GDPR and/or Art. 9(2) lit. a GDPR. You may withdraw consent given at any time with effect for the future. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.

§ 5 Use of the Online Application Portal and Rexx as Processor

(1) We use an online application portal to handle our recruiting process. The technical service provider and processor is Rexx Systems GmbH, Süderstraße 75-79, 20097 Hamburg, Germany (hereinafter: Rexx).

(2) Rexx processes personal data exclusively on our behalf and in accordance with our instructions. For this purpose, we have entered into a data processing agreement with Rexx pursuant to Art. 28 GDPR.

(3) Via the online application portal, you can enter your application data, upload documents, receive messages and manage the application process. The information marked as mandatory fields in the portal is required so that we can process your application and decide on your suitability. Further information may be voluntary.

(4) The transmission of your data in the application portal is generally encrypted. Access to application data is restricted to those persons who need it for processing the respective application procedure.

§ 6 Recipients of Personal Data

(1) Within the PVA TePla Group, only those departments receive access to your personal data that need it for the application procedure or for fulfilling legal obligations. These may include in particular:

• employees from Human Resources;
• responsible managers and specialist departments;
• management or the Management Board, insofar as this is necessary for filling the position;
• where applicable, the works council, representative body for severely disabled employees or other statutory bodies involved;
• IT and support functions, insofar as this is necessary for the operation of the systems.

(2) Your personal data will only be disclosed to external recipients insofar as this is necessary for carrying out the application procedure, a legal obligation exists or you have given your consent. Insofar as we use service providers that process personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

(3) These service providers include, in particular, rexx systems GmbH as the technical service provider for the online application portal, as described in more detail in § 5, as well as Microsoft in connection with the use of the Microsoft 365 package.

(4) Transfer to third countries outside the European Union or the European Economic Area takes place only if the requirements of Art. 44 et seq. GDPR are met. If a transfer to a third country is not necessary in the specific application procedure, no such transfer will take place.

§ 7 Further Processing in the Event of Hiring

(1) In the event of hiring, we will continue to process the data required for establishing and carrying out the employment relationship.

(2) We will inform you separately about the further processing of your personal data in the employment relationship, insofar as this is necessary.

§ 8 Talent Pool and Unsolicited Applications

(1) If we offer to consider your application for future job vacancies in a talent pool, this will take place only on the basis of your consent, which we will send to you in advance. Participation in the talent pool is voluntary and has no influence on an ongoing application procedure.

(2) You may withdraw consent to inclusion in the talent pool at any time with effect for the future. After withdrawal, your data will no longer be considered for future job vacancies, unless another legal basis for processing exists.

(3) We process unsolicited applications in order to check whether there is a suitable deployment opportunity within the PVA TePla Group. Insofar as forwarding to another group company is considered, this will take place only insofar as it is necessary for reviewing your application or you have consented to it.

§ 9 Storage Period and Deletion

(1) We store your personal data for the duration of the application procedure. After completion of the application procedure, your application data will generally be deleted no later than after six months, unless statutory retention obligations exist, longer storage is necessary for the establishment, exercise or defence of legal claims, or you have consented to longer storage.

(2) If you withdraw your application, your data will be deleted in accordance with the aforementioned periods, unless another legal basis exists for further storage.

(3) In the event of hiring, the data required for the employment relationship will be transferred to the personnel file and processed in accordance with the periods applicable thereto.

(4) Data stored solely on the basis of consent for a talent pool will be deleted after expiry of the defined talent pool period or earlier if you withdraw your consent. We will inform you of the specific period when obtaining your consent.

§ 10 Obligation to Provide Data

(1) The provision of your personal data is neither legally nor contractually required. However, without the information and documents required for the application procedure, we cannot process your application, or can do so only to a limited extent, and cannot decide on your suitability for the respective position.

(2) Mandatory information in the online application portal is marked as such. Voluntary information is not required and generally has no adverse effect on your application.

§ 11 Automated Decision-Making

Exclusively automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place in the application procedure.

§ 12 Your Rights

(1) You have the following rights vis-à-vis a controller with regard to the personal data concerning you:

• right of access pursuant to Art. 15 GDPR;
• right to rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR;
• right to erasure pursuant to Art. 17 GDPR;
• right to restriction of processing pursuant to Art. 18 GDPR;
• right to data portability pursuant to Art. 20 GDPR, insofar as the statutory requirements are met;
• right to object to processing pursuant to Art. 21 GDPR, insofar as processing is based on Art. 6(1) sentence 1 lit. e or lit. f GDPR;
• right to withdraw consent given with effect for the future.

(2) You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us.

§ 13 Currency of this Privacy Policy

This Privacy Policy applies in its current version. Version: 18 May 2026.