Personal data comprises all information about an identified or identifiable natural person. When you apply for a job with us, we process the following categories of personal data:

• Master data and contact information, in particular first and last name, title, private address, e-mail address, telephone number(s)
• Application documents (e.g., cover letter, curriculum vitae)
• Details of qualifications (e.g., data on higher education, primary and secondary education, professional qualifications)
• Information about your previous and current employment (e.g., job title, place of work, department, position/function, tasks and projects, name of supervisor, details of business trips, information on further training, start and end dates, and, where applicable, reason for leaving the company)
• Communication data (e.g., e-mail traffic, telephone connections)
• Log data generated when using IT systems
• Where applicable, disability-related information

We do not specifically request or collect special categories of personal data (details on racial and ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, health or sexual orientation, as well as genetic and biometric data, except for any voluntarily disclosed information regarding a disability). Accordingly, we would ask you not to provide any information on the above circumstances as part of your application.

We or the group company responsible for the relevant job advertisement process the information provided by you or obtained from public sources, such as the Internet or previous employers, exclusively for the purpose of processing your application and filling the vacant position.

The legal basis for the processing is art. 6(1)(b) GDPR (performance of a contract). Data processing is necessary for making a decision on the grounds for creating an employment position. If the application process leads to the filling of a vacant position, your personal data will be included in your personnel file for the purpose of substantiating and implementing the employment relationship and stored there for the duration of your employment relationship. We or the respective group company otherwise store your personal data for as long as necessary for the aforementioned purposes and delete the data concerning rejected applicants within 6 months of notification of the decision on the application. 

In certain cases, we also process your data to protect our legitimate interests, particularly disclosing your data to other group companies, if required, to complete the application process as well as to defend legal claims in accordance with the General Act on Equal Treatment (AGG). In this context, we have a legitimate interest in processing your data for the purpose of providing evidence. The legal basis for the processing is art. 6(1)(f) GDPR (overriding legitimate interests). Processing will then continue until these procedures are completed.

Voluntary information within the scope of your application (e.g., application photo) as well as the voluntary inclusion in an applicant pool for future job advertisements are processed on the basis of your consent. The provision of voluntary information, based on our notice regarding the voluntary nature of such information, constitutes your consent. To be included in the pool of applicants, you must click on a separate consent box. The legal basis for the processing is art. 6(1)(a) GDPR in conjunction with section 26(2) of the German Federal Data Protection Act (BDSG). The deletion of your personal data contained in the pool of applicants takes place after 12 months.

Within SMS group and/or the respective group company, your application documents and personal data are only made available on a need-to-know basis and to the necessary extent to the persons responsible for this and to the parties involved in the application process (e.g., potential supervisors, human resources team, department, employee representatives and, where applicable, the relevant disabled employee representatives). For the purpose of specialist supervision within the framework of matrix structures, this may also involve management staff from other group companies. 

In addition, certain third parties may receive your personal data for processing under appropriate instructions, regardless of whether they are group companies or external parties (“processors”). In some cases, we use service providers as processors, in compliance with all statutory requirements, to perform commissioned processing, which is carried out on our behalf, on the basis of a contract on the processing of personal data, in accordance with our instructions and under our supervision. In such cases, we or, respectively, the relevant group company remain responsible for the data processing; the transfer and processing of personal data to or by our commissioned data processors is performed on the legal basis upon which we, or the relevant group company, are permitted to process this data. A separate legal basis for the processor in question is not required. As part of the recruitment and application process, we use a software solution for applicant management and the group company SMS Metallurgie Polska Sp. z o. o. for active sourcing, planning, and conducting interviews for SMS group GmbH.

As a rule, your personal data shall not be transferred to third countries outside the European Union (EU) or the European Economic Area (EEA). If, in exceptional cases, the transmission of personal data does take place nonetheless, and the EU Commission has not yet issued a so-called adequacy decision for these third countries, according to which said third countries offer an adequate level of protection of your personal data, the data shall only be transmitted based on appropriate guarantees, such as the EU standard contract clauses adopted by the EU Commission, and provided that we have ensured an adequate level of protection, which essentially corresponds to the EU legal standard, by means of additional security measures. You can request a copy of the relevant guarantees by contacting us: details are given in section 1. In individual situations, we make use of one of the statutory derogations. 

Insofar as the advertised position concerns a job in a group company outside the EU or the EEA, or if your technical supervisor/manager works outside the EEA, your personal data will also be transmitted to this group company.

• If you have any questions about how we process your personal data, we will be happy to provide you with information on any personal data we have stored about you (art. 15 GDPR).
• You have the right to the rectification of inaccurate data and to the completion of incomplete personal data (art. 16 GDPR).
• You have the right to block/restrict the processing and to the erasure of personal data concerning you that are no longer required or were stored due to legal obligations (art. 17 and 18 GDPR).
• You have the right to receive your personal data in a structured, commonly used, and machine-readable format, insofar as you have provided us with the data based either on your consent or on a contract between us or between yourself and the relevant group company (art. 20 GDPR).
• You have the right to object at any time to the processing of your data for direct marketing purposes (art. 21(2,3) GDPR).
• If the processing of your personal data takes place based on article 6(1)(f) GDPR, you may object to it. We can then only continue processing the data if there are compelling reasons for processing it. If no compelling reasons exist, we shall cease processing the data and delete any data already collected (art. 21(1) GDPR).
• Should you have consented to the processing of your personal data (see above), you may revoke this consent at any time with future effect, thereby stopping any further processing. This does not affect the lawfulness of data processing performed up to the time of withdrawal. If you revoke your consent, we will cease processing your personal data unless processing is permitted on another legal basis. Once you have revoked your consent, you may no longer be able to participate in the process (e.g., pool of applicants) as this is contingent upon your approval.
• In addition, you have the right to lodge a complaint with a supervisory authority for data protection if you believe that the processing of your personal data violates the GDPR or other laws (art. 77 GDPR).

If you wish to exercise your rights, please contact us or the relevant group company in writing (subject: data protection) or by e-mail at the contact details given in section 1. We reserve the right to check your identity to ensure that your personal data is not disclosed to unauthorized persons.