Information about the processing of your personal data for the application procedure at RatePAY GmbH

With this information sheet, we aim to inform you – the applicant – about the collection, processing, and storage of your personal data when applying for a position at RatePAY GmbH.

The European General Data Protection Regulation (hereinafter abbreviated as GDPR) and the German Federal Data Protection Act (hereinafter abbreviated as BDSG) strive to, among other things, make every person affected by data processing (“data subjects”), including you as an applicant, aware of the extent to which your personal data are processed.

Personal data are data that are related to your person or allow for a conclusion to be drawn about you (e.g. your name, your date of birth, or your mobile phone number). In the following, these will be referred to as “data”, which always refers to personal data. In the following, “processing of data” means any collection, storage, or other use of data.

We are happy to comply with the transparency requirements of the GDPR and the BDSG by explaining how data are processed as we process your application.

I. Name and contact details of the responsible party (controller)

The controller for the processing of your personal data is:

RatePAY GmbH

Franklinstraße 28–29

10587 Berlin, Germany

Management: Jesper Wahrendorf, Miriam Wohlfarth

info@ratepay.com

II. Contact details of the data protection officer

The contact details of the data protection officer at RatePAY GmbH are:

ISiCO Datenschutz GmbH

Philipp Kaufold

Am Hamburger Bahnhof 4

10557 Berlin, Germany

philipp.kaufold@isico-datenschutz.de

III. Data that we process

As part of our application process, we collect data about you that you yourself have provided. In the following, we strive to provide an overview of which data we process, the processing purposes, the legal basis, and the storage duration.

Data received through your application documents and job interviews

During the application process, we process data that we receive through your application documents by e-mail, by online application, by telephone or by post, as well as through job interviews with you. In addition, during the online application process, we receive data that you fill in using the relevant online application form. These data will usually encompass:

Data that we process

First and last name, date of birth, address, telephone number, mobile number, private e-mail address, data on your qualifications, work experience, and education.

Additional data

In addition to these data, we will process your salary expectation, potential start date, gender (if specified), communication with you, scheduling information, contract documents, and offer details.

Data we collect from third parties

In certain constellations, your data may also be collected from third parties. This in particular includes instances in which we access your public profile on professional social networks such as Xing and LinkedIn, as well as if we receive your data and application documents from a recruitment agency.

Purpose of processing

We process all aforementioned data to process the application, to check whether we are offering you the position for which you have actually applied, and to determine whether we intend to hire you as an employee.

If you have agreed that we may also consider your application and relevant data for further positions, we will process your data to check whether we can offer you a position for which you haven’t applied and whether we can employ you within our company.

If you accept our offer to become our employee, we will store your data to carry out the employment relationship with you. In this case, you will receive further information about the processing of your data as part of your employment relationship at RatePAY GmbH as soon as this commences.

Legal basis for the processing

Your data will be processed in relation to the specific position for which you have applied, on the legal basis of Art. 6(1)(s) lit. b, Art. 88 GDPR, Art. 26(1)(1) BDSG.

If these data concern so-called special categories of personal data, such as data on your health, which you yourself provide to us (e.g. information about a possible disability), the processing is carried out on the legal basis of Art. 6 (2)(1) lit. b, Art. 9, Art. 88 GDPR, Art. 26(3)(1) BDSG.

If you have agreed that we may also consider your application and relevant data for further positions, the data processing takes place on the legal basis of Art. 6(1)(1) lit. a, Art. 88 GDPR: Art. 26(1)(1) BDSG.

Duration of storage

We essentially store your data as long as they are necessary for the application process.

If you have only applied for a specific position (and have not provided your consent to the consideration of your application and your related data for further positions), and receive a rejection from us for this position, we will delete your data after 3 months at the latest, starting from the moment you have received the rejection from us, unless storage is required for legal reasons.

If you have agreed that we may also consider your application and your related data for further positions, we will store your data for a period of six months from the time you provide your consent. Before the six-month period expires, we will ask whether you would like to provide consent to the processing of your data for a further period of six months to be considered for jobs within our company. If you agree to this, we will store and process your data for a further period of six months. If you do not respond to our request, we will delete your data after the six-month period starting from the provision of your original consent expires.

If you accept our offer to become our employee, we will store your data for the duration of the employment relationship with you. In this case, you will receive further information about the processing of your data as part of your employment relationship at RatePAY GmbH as soon as this commences.

IV. Categories of recipients of your personal data

If you apply for a position with us, we will not pass on your data to third parties. Service providers – such as the recruiting software Personio by the provider Personio GmbH – whose services we use and who act on our behalf, partly process data for us. If this is the case, we conclude a so-called order processing contract with the service provider, obliging the service provider to process the data in a careful manner in accordance with our instructions. We have also concluded an order processing contract with Personio GmbH. Service providers solely process the data according to our specifications and on our behalf, which is why they are referred to as contract processors.

Besides this, only those employees of our company who need to view your data for the application procedure have access to your personal data, i.e. in particular the HR department and decision-makers in specialist departments.

If we need your data to support the activities of lawyers working on our behalf, we will pass on your data to the required extent.

V. Transfer to a third country

RatePAY GmbH does not transfer your personal data to third countries.

VI. Your rights in relation to data processing at RatePAY GmbH

You have the following rights in relation to data processing at RatePAY GmbH. We have outlined these rights below; please note that this is a rough outline to assist your better understanding and that the exact scope of your rights naturally follows the legal provisions of Art. 15 to 22 GDPR:

Right to information about what data we process about you (Art. 15 GDPR);

You have a right to information about which of your data are processed by us, as well as further information relating to data processing in accordance with Art. 15 GDPR. Upon request, we will be happy to provide you with the relevant data and information, and to make a copy of this data available to you.

Right to rectification (Art. 16 GDPR);

You have the right to demand that your data be corrected if it is incorrect or incomplete (under consideration of the purposes of the processing).

Right to deletion (Art. 17 GDPR);

You have a right to demand your data be erased if they are no longer needed, if the processing is not lawful, or in other instances when Art. 17 of the GDPR applies. In such cases, we will delete your data immediately.

Right to restriction of the processing of your data (Art. 18 GDPR);

You have the right to have the processing of your data restricted in the instances mentioned in Art. 18 of the GDPR. This applies, among other cases, if we process data in places or to an extent which renders data processing no longer legally justified.

In addition, data might be subject to a retention obligation, meaning we are not allowed to readily delete it. In this instance, we will limit processing to the greatest possible extent. Restriction usually means that the data is retained but can no longer be accessed by employees.

Right to data portability (Art. 20 GDPR);

The right to so-called data portability allows you to receive data about you that you yourself have provided to us and to have it submitted by us. You will receive the data in the format set out in Art. 20 of the GDPR. However, data that we obtain through the act of processing itself (so-called processing results) are excluded from publication.

Right to object to the processing operations substantiated by Art. 6(1)(1) lit. e and f GDPR (Art. 21 GDPR);

We halt the processing of data that is carried out on the basis of Art. 6(1)(1) 1 lit. e and f GDPR (performance of a task carried out in the public interest or in the exercise of official authority vested in the controller/processing to protect legitimate interests) if you lodge a justified objection to this.

The right not to be subject to a decision based solely on automated processing (Art. 22 GDPR);

If an automated decision-making process exists, we will inform you in particular about the scope and intended effects of the processing of your data. You have the right not to be subject to such a decision if it produces legal effects concerning you or similarly significantly affects you, unless one of the reasons specified in Art. 22(2) GDPR applies.

You also have a right to appeal to the responsible supervisory authority (“Berliner Beauftragte für Datenschutz und Informationsfreiheit”) [Berlin Commissioner for Data Protection and Freedom of Information], Friedrichstraße 219, 10696 Berlin, Germany.

We at RatePAY GmbH take your rights as a data subject seriously. Please do not hesitate to contact us using the following e-mail address: datenschutz@ratepay.com. Alternatively, you can naturally also assert your rights by post or telephone.

VII. Your right of revocation after consenting to the processing of certain data

If you consent, or have consented to, the processing of your data, we process these data for the purpose and to the extent to which you have consented. We will inform you about the type and scope of data processing when you provide your consent.

If you provide RatePAY GmbH with your consent, you also have a right of revocation. If you revoke your consent, your data will no longer be processed on the basis of this consent. The legality of the processing of data which has already occurred before we receive your revocation remains unaffected by this.