Information on data protection concerning how we process applicant data in accordance with Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR)

Philotech Systementwicklung & Software GmbH



Dear employee,

In accordance with the requirements of Art. 13, 14 and 21 of the GDPR, we are informing you in this information sheet about the processing of personal data provided by you and about your data protection rights with respect to these data. To ensure that you have complete information about the processing of your personal data with respect to the reason for, the implementation and ending of the employment relationship, please take note of the following information.


  1. Data controller within the meaning of the GDPR

PHILOTECH Systementwicklung und Software GmbH

Eschenstraße 2

82024 Taufkirchen

Telephone number: +49 - 896108980

E-mail address:

Web site:


  1. Contact data for our data protection officer

Dominik Fünkner

  1. Reasons and lawful basis for processing

We process your personal data in accordance with the requirements of the European data protection regulations (GDPR) and the German Data Protection Act (BDSG) as long as these are necessary for the employment relationship. The legal basis is Art. 88 GDPR along with Section 26 BDSG (new) and possibly Art. 6 Para. 1 lit. b GDPR for the initiation or processing of contractual relationships.

Furthermore, we can process your personal data to the extent that this is necessary to defend legal claims made against us arising from the employment relationship. The legal basis for this is Art. 6 Para. 1 lit. f GDPR. The legitimate interest is, for example, a burden of proof in the course of legal proceedings. As long as you provide us with an explicit consent to process personal data for specific purposes, the legality of this processing exists in accordance with Art. 6 Para. 1 lit. a GDPR. Consent given can be withdrawn at any time (see Point 9 of this data protection document). Please note that a withdrawal is only effective for the future. Processing taking place before withdrawal is not affected by it.

We can continue to process personal data already received from you in an application process in accordance with Art. 88 GDPR and Section 26 BDSG (new) for the purpose of the employment relationship as long as they are needed for the beginning, implementation or ending of the employment relationship or for exercising or fulfilling the rights and duties of the representation of the interests of the employee arising from a law or wage settlement, a company agreement or works agreement (collective agreement).

  1. Categories of personal data

We process data connected with your application. These can be general data on your person (such as name, address and contact details), information on your professional qualifications and schooling, or information on professional training, or other information that you have given us in connection with your application.


We process personal data that we receive from you in the post or by e-mail in the course of making contact and your application, and that you provide to us from other sources such as Xing, LinkedIn, Prescreen, etc.

  1. Recipients of the data

We transfer your personal data within our organisation only to areas that require these data to fulfil contractual and legal duties or to implement our legitimate interest.

We can transfer your personal data to connected organisations as long as this is permitted in accordance with the listed purposes and legal bases listed in Point 3 of the data protection information.

Your personal data are processed on our behalf on the basis of data processing contracts in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the GDPR. The categories of recipients in this case are the host provider Hetzner Online GmbH and our application management system Prescreen.

Transfer of data to recipients outside of the organisation only occurs to the extent it is permitted or required by legal regulations, the transfer is necessary to fulfil legal obligations or you have authorised it.

  1. Transfer to third countries

A transfer to third countries is not envisaged.

  1. Retention periods

We store your personal data as long as is necessary for the decision on your application. Your personal data and application documents are deleted a maximum of six months after the end of the application process (e.g. notification of the rejection decision) as long as longer retention is not legally required or permitted. We store your personal data beyond that only to the extent that it is legally required or in a concrete case required to enforce, exercise or defend a legal claim for the duration of a legal dispute.

Where you have authorised longer retention of your personal data, we store your personal data in compliance with your declaration of consent.

If an employment, training or internship relationship arises after the application process, to the extent that it is necessary and permitted, the data will continue to be stored and then transferred to the personnel file.

At the end of an application process, you may receive an invitation to join a talent pool. In this way, we can put you into the pool of applicants for future suitable vacancies. Where you authorise this, we will store your application data in our talent pool in accordance with your consent and possible future consents.

  1. Your rights

Every person affected has the right to information in accordance with Art. 15 GDPR, the right to rectification in accordance with Art. 16 GDPR, the right to deletion in accordance with Art. 17 GDPR, the right to restrict processing in accordance with Art. 18 GDPR, the right to information in accordance with Art. 19 GDPR and the right to data portability in Art. 20 GDPR.

Furthermore, there is a right to complain to a regulatory authority in accordance with Art. 77 GDPR if you believe that the processing of your data is not being conducted lawfully. The right of complaint exists without affecting other administrative or judicial legal remedies.

As long as the processing of data relates to permission from you, you have the right in accordance with Art. 7 GDPR to withdraw the permission to use your personal data at any time with effect for the future. Please note that we must retain certain data to fulfil legal requirements, potentially for a certain period of time (Point 8 of this data protection information).




Right of objection

As long as the processing of personal data about you is carried out on the basis of Art. 6 Para. 1 lit. f GDPR for the protection of legitimate interests, you have the right for reasons arising from your own particular situation to object at any time to the processing of these data in accordance with Art. 21 GDPR. We will then no longer process your data unless we can provide compelling reasons meriting protection for processing the data that outweigh your interests, rights and freedoms, or the processing serves to enforce, exercise or defend legal claims.

To protect your rights, you can contact us at any time using the information given above.

  1. Necessity for providing personal data

The provision of personal data in the course of the completion of application processes is neither legally nor contractually required. You are, therefore, not required to make personal data available. However, the provision of personal data for the decision on your application and a contract for an employment relationship with us is required. You should, however, only provide such personal data in the course of your application that is necessary for the initiation and processing of the application. Where you do not provide any personal data in an application, we cannot make a decision on establishing an employment relationship.

  1. Automated decision making

The decision on your application is not only on the basis of automated processing. There is thus no automated decision in an individual case within the meaning of Art. 22 GDPR.