Principles of data processing for applications at the IUF – Leibniz Research Institute for Environmental Medicine

We are delighted to receive your application. Below, we are going to explain how we process your personal data within the context of an application. In order to fulfil our information obligations pursuant to Article 12 et seq. of the General Data Protection Regulation (GDPR) we are going to provide you with our information on data protection.

Who is responsible for data processing?

The responsible party in terms of data protection law is the

IUF – Leibniz Research Institute for Environmental Medicine
represented by the Managing Directors Dr Alexander Beaucamp and Prof Dr Jean Krutmann
Auf´m Hennekamp 50
40225 Düsseldorf
Tel.: +49 (0)211 - 3389-0
Mail: info@iuf-duesseldorf.de
Web: www.iuf-duesseldorf.de

You will find further information about our institute, details on the persons authorised to represent it as well as further contact options in the imprint of our website: https://iuf-duesseldorf.de/en/imprint/

For what purposes is the data processing carried out and on what legal ground is it based?

We process your personal data for the purpose of processing your application for employment at the IUF to the extent necessary for a decision on establishing an employment relationship between us. The legal ground for this is Article 6 (1) (b) of the GDPR, Section 26 (1) in conjunction with Section 26 (8), second sentence, of the BDSG (Federal Data Protection Act).

Furthermore, we may process your personal data in order to protect our legitimate interests. A legitimate interest exists, for example, if the data processing is necessary to defend asserted legal claims against us arising from the application process or if we are subject to a burden of proof in proceedings under the General Act on Equal Treatment (AGG). The legal ground for this is Article 6 (1) (f) of the GDPR.

If an employment relationship is established between us, we may further process your personal data for the purposes of the employment relationship pursuant to Article 6 (1) (b) of the GDPR, Section 26 (1) in conjunction with Section 26 (8), second sentence, of the BDSG should this be necessary for the implementation or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations arising from a law or a collective agreement, a company or a service agreement (collective agreement).

How long will the data be stored?

We will store your personal data as long as it is necessary for the decision on your application. If an employment relationship between us does not come about, we may continue to store your personal data if this is necessary for the defence against possible legal claims. In this case, the application documents will be deleted six months after the last contact or rejection, unless longer storage is required due to legal disputes or statutory retention periods.

To which recipients is the data transferred?

Within the Institute, those offices receive your data that need it to fulfil our contractual and legal obligations. Processors appointed by us (Article 28 of the GDPR) may also receive data for these purposes. These are companies in the categories of IT services, accounting, logistics, printing services, telecommunications, occupational healthcare, occupational safety and consulting.

To recipients outside the Institute who are not processors we will only pass on your personal data if this is permitted or required by law, if you have given your consent or if we are authorised to provide information. Under these conditions recipients of personal data may be, for example:

  • Public authorities and institutions (e.g. public prosecutor's office, police, supervisory authorities) if there is a legal or official obligation.
  • Other companies or bodies to whom we transfer personal data in order to carry out a business relationship with them (depending on the contract e.g. banks, credit agencies, suppliers, commercial agents, funding authorities).

Other data recipients may be those bodies for which you have given us your consent to transfer data.

Where is the data processed?

We process your personal data exclusively within the EU. There is no transfer to a third country.

Automated decision-making

Automated decisions within the meaning of Article 22 of the GDPR do not take place.

Your rights as a "data subject"

a) Right of access pursuant to Article 15 of the GDPR

You have the right to obtain information free of charge upon request, in particular, whether and what data about you are stored and for what purpose your data are stored, to which categories of recipients your personal data have been or will be disclosed as well as the envisaged period for which your personal data will be stored.

b) Right to rectification pursuant to Article 16 of the GDPR

You have the right to obtain without undue delay the rectification of your inaccurate personal data. Taking into account the purposes of the processing you have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

c) Right to erasure ("right to be forgotten") pursuant to Article 17 of the GDPR

You have the right to obtain the erasure of your personal data without undue delay. We are obliged to erase your personal data without undue delay where one of the following grounds applies:

  • The purposes for which the personal data were collected cease to apply.
  • You withdraw your consent to the processing and there is no other legal ground for the processing.
  • You object to the processing and there is no other legal ground for the processing.
  • The personal data have been processed unlawfully.
  • The erasure of the personal data is necessary for compliance with a legal obligation in Union or Member State law to which we are subject.
  • The personal data have been collected in relation to the offer of information society services referred to in Article 8 (1) of the GDPR.

d) Right to restriction of processing pursuant to Article 18 of the GDPR, Section 35 of the BDSG

You have the right to obtain the restriction of processing where one of the following applies:

  • The accuracy of the personal data is contested by you.
  • The processing is unlawful but you oppose the erasure of the personal data.
  • The personal data is no longer needed for the purposes of the processing, but you require the data for the establishment, exercise or defence of legal claims.
  • You have objected to the processing pursuant to Article 21 (1) of the GDPR. Pending the verification whether our legitimate grounds override yours, processing will be restricted.

e) Right to data portability pursuant to Article 20 of the GDPR

You have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format and you have the right to transmit those data to another responsible party without hindrance from us.

f) Right to object pursuant to Article 21 of the GDPR

You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6 (1) (e) or (f) of the GDPR if applicable in conjunction with point (f) of Article 9 (2) of the GDPR. The processing of your personal data will be stopped unless there are compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the personal data will not be processed further for these purposes if you object to it.

g) Right to lodge a complaint with the supervisory authority pursuant to Article 13 (2) (d), Article 77 of the GDPR in conjunction with Section 19 of the BDSG

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority. To do so, please contact the competent supervisory authority.
The authority responsible for you is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, tel.: +49 (0)211 - 38424-0, fax: +49 (0)211 - 382424-10, email: poststelle@ldi.nrw.de, web: www.ldi.nrw.de.

h) Revocation of consent pursuant to Article 7 (3) of the GDPR

If the processing is based on your consent pursuant to Article 6 (1) (a) of the GDPR or Article 9 (2) (a) of the GDPR (processing of special categories of personal data), you are entitled to revoke the purpose-bound consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until the revocation. You will not suffer any disadvantages as a result of the revocation.

Our data protection officer

We have appointed a data protection officer at our institute. You can contact him via following options:

IDR – Institut für Datenschutzrecht
Mr Sascha Weller
Ziegelbräustraße 7
85049 Ingolstadt
Tel.: +49 (0)841 – 885 167 15
Fax: +49 (0)841 – 885 167 22
Mail: ra-weller@idr-datenschutz.de
Web: www.idr-datenschutz.de

Effective February 2022

TOP