II. WHICH DATA DO WE PROCESS?

In order to execute your application process, we need to process the following personal data:

1. Master data: We process basic information about you and the circumstances of your application. We refer to this data collectively as “master data”. In particular, it includes any information that you have communicated to us or we have requested from you as part of the application process (such as your name, address, phone number, email address, date of birth, marital status, nationality, religious denomination, education, career background and photo).

III. FOR WHAT PURPOSES AND ON WHAT LEGAL BASES DO WE PROCESS YOUR DATA?

1. We process your data in accordance with Article 6(1) (b) GDPR (steps prior to entering into a contract), combined with Article 88 GDPR and Section 26 BDSG concerning employment decisions. The purposes of data processing are primarily based on the application process. Data is mainly processed in order to:
   a) execute application processes; or
   b) fulfil existing obligations arising from legislation, regulations, company agreements and individual contractual provisions.
2. We may also process your personal data in order to fulfil legal obligations to which we are subject in accordance with Article 6(1) (c) GDPR. In particular, these legal obligations include our mandatory requirements for reporting to social security agencies and authorities (including tax authorities), retention regulations under employment, tax and social security legislation, and retention requirements under trade and tax legislation in accordance with the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code of Germany (Abgabenordnung).
3. Where necessary, we process your data – beyond the scope of executing the application process and fulfilling legal obligations – to safeguard our legitimate interests or the legitimate interests of third parties in accordance with Article 6(1) (f) GDPR. Our legitimate interests include:
   a) Asserting legal claims and defense against lawsuits;
   b) Preventing and resolving offenses;
   c) Safeguarding the security of the IT systems we use; and
   d) Pursuing information-logging and communication purposes in business contexts.
4. If the data categories referred to in II above include special types of personal data (such as health-related data), we process this data in order to fulfil our obligations arising from employment legislation and social security legislation to the extent provided for by law; this processing is based on Article 9(2) (b) GDPR.
5. In accordance with Article 6(1) (a), processing personal data is deemed lawful when the data subject has given consent for specific purposes (such as storing data in the group’s pools of applicants or retention of data after the application process).

Please be aware that:

• consent is always granted to us on a voluntary basis and neither granting nor withdrawing consent will have negative consequences for your application process;
• not granting consent or withdrawing consent may however have other consequences that we inform you about before you grant consent; and
• you may withdraw consent granted to us at any time with future effect; for example, by notifying us by post, fax or email using one of the contacts listed on the first page of this data protection information.

IV. ARE YOU OBLIGATED TO PROVIDE DATA?

The personal data referred to in II above must be provided so that we can execute and manage your application process, unless otherwise explicitly specified by us when this data is being collected. Without this data we cannot execute your application process. If we collect personal data from you beyond this scope, we will communicate to you whether providing this information is required by law or contract, or is required for your application process. In doing so, we usually identify information that is provided voluntarily and not required to fulfill any of the aforementioned obligations or to conclude a contract.

V. WHO RECEIVES YOUR DATA?

As a rule, your personal data is processed within our company. Only specific departments and organizational units are given access to your personal data, based on the type of personal data concerned. In particular, these include the HR department, your potential supervisor(s) and – in the case of data received via the IT infrastructure – the IT department to a certain extent. We have a roles and authorization concept in place to ensure that access within our company is restricted to the roles and scope necessary for the processing purpose in question. To the extent permitted by law, we may also transfer your personal data to third parties outside our company. These external recipients may include, in particular:

• affiliated companies within the Investa Real Estate group, to which we transfer personal data for internal administrative processes, in particular, for executing application processes within those companies; or
• service providers we engage – which, on the basis of separate contracts, provide services that may include processing personal data – and service provider subcontractors, which are engaged with our consent. Our service providers are carefully selected by us and appointed in line with data protection requirements.

With regard to passing data on to other recipients, we are only permitted to pass on your data if required by law, if you have granted your consent or if we are authorized to do so. Other parties may also receive data if you have granted us your consent to transfer data.

VI. ARE AUTOMATED DECISION-MAKING PROCESSES USED?

As a rule, we do not use any automated decision-making (including profiling) as defined by Article 22 GDPR in order to execute or in the course of the application process. However, if we decide to use processes of this kind in isolated cases, we will notify you separately to the extent required by law.

VII. IS DATA PROCESSED IN COUNTRIES OUTSIDE THE EU/EEA?

Your personal data is processed exclusively within the EU or European Economic Area and is not transferred to other countries (third countries).

VIII. FOR HOW LONG IS YOUR DATA STORED?

The criteria for defining the storage duration are determined on the basis of the purpose and any subsequent statutory retention periods. As a rule, we store your personal data if we have a legitimate interest in doing so and provided that your interests do not outweigh the interests in continuing to store the data. Even without a legitimate interest, we may continue to store data if we are legally required to do so (in order to fulfil retention obligations, for example). We will erase your personal data without your intervention as soon as it is no longer required to fulfil the purpose of processing or storing it would not otherwise be permitted by law. Personal data is normally stored until at least the end of the application process. Data will be erased no later than the point at which the purpose of storing it has been achieved. Where applicable, this may not take place until after the application process is complete. Personal data that we need to store in order to meet retention obligations will be stored until the end of the retention obligation in question. If we store personal data exclusively for the purpose of fulfilling retention obligations, the data will be blocked in a way that ensures it can only be accessed if required for the purpose of the retention obligation. Retention obligations may refer to:

• fulfilling retention obligations under employment, social security, trade and tax legislation; specifically, the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code of Germany (Abgabenordnung). These specify retention and documentation periods of up to 10 years.

IX. WHAT RIGHTS DO YOU HAVE AS A DATA SUBJECT?

1. As a data subject, you have the right to:

• access your stored personal data in accordance with Article 15 GDPR;
• have inaccurate or incomplete data rectified in accordance with Article 16 GDPR;
• have personal data erased in accordance with Article 17 GDPR;
• have processing restricted in accordance with Article 18 GDPR;
• data portability in accordance with Article 20 GDPR; and
• object to the processing of your personal data in accordance with Article 21 GDPR.

Where the right to access and erasure is concerned, the restrictions apply in accordance with Section 35 BDSG. To exercise these rights, you can contact us at any time using one of contacts stated at the beginning of this data protection information, for example. If you have any questions about how your data is processed, you can also contact our data protection officer.

2. In addition, you are entitled to lodge complaints with the relevant supervisory authority for data protection in accordance with Article 77 GDPR.