* The term job applicant does not refer to one gender, but is to be understood in a gender-neutral way.
Last updated: 17 July 2023
The protection of personal data is a high priority for Brainloop AG (‘Brainloop’ or ‘we’). We process any personal data solely in accordance with the legal requirements, in particular the EU General Data Protection Regulation (‘GDPR’) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, ‘BDSG’). This Data Protection Notice for Job Applicants describes how we store and process your personal data when you apply for a job with us by email, post, LinkedIn or otherwise, and which rights you have in this context.
1. Who is responsible for the processing of my data? How can I contact Brainloop?
Brainloop is responsible for the processing of your personal data as controller. You can reach Brainloop, as well as Brainloop’s data protection officer, at any time using the following contact details:
Controller: Brainloop AG,
Theatinerstrasse 12, 80333 Munich, Germany, Phone: +49 89 444 699 0;
Email: legal@brainloop.com
Data protection officer:
dpo@brainloop.com
2. Which of my data will be processed?
Brainloop collects the data that you disclose to Brainloop in the context of your application, in particular desired position, name, title, address, e-mail, telephone, date of birth, information on education and professional training, current and previous position, certificates, language skills, computer skills.
We may also obtain the aforementioned personal data from recruitment agencies with which we cooperate. In addition, we may collect data from you that you have published via job application platforms as well as via publicly accessible and professionally used social media for maintaining existing and making new business contacts (e.g., LinkedIn, Xing). This includes your name, contact details, career details and other relevant data that you may disclose in the respective network for professional purposes. In addition, in certain cases, we may receive relevant personal data from our risk management service provider (Signum Consulting GmbH, Rungestr. 19, 10179 Berlin, Germany) which supports us – to the extent necessary and legally permitted – in carrying out a pre-employment compliance check of your suitability for the desired position (e.g., verification of your information on reported address, relevant (highest) educational qualifications and, if applicable, financial circumstances (if relevant for recruitment to the specific position), screening against relevant sanctions, terror and negative lists).
When submitting your application, please ensure that you do not disclose any sensitive personal data (e.g., information on health, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation), as this information is not required for an assessment of your skills and qualifications for the purpose of deciding on your application.
3. For which purposes and on which legal basis will my data be processed? How long will my data be stored?
Brainloop processes your personal data in the context of your application only to the extent necessary for the processing of your application (including performing pre-employment compliance checks) and for the decision on establishing an employment relationship with you. As legal basis for processing your personal data, we rely on the necessity of the processing for the decision on establishing an employment relationship with you (Section 26(1) sentence 1 BDSG). In addition, to the extent necessary in connection with the implementation of certain measures for pre-employment compliance checks, we may ask for your prior consent (Art. 6(1) lit. a) GDPR) before processing your personal data. You are free to refuse your consent without any effect on your application process. However, if necessary, we may ask you in this case for further evidence enabling us to perform a full pre-employment compliance check.
If an employment relationship is established with you, we will include your personal data obtained in the context of the application process – as far as it is relevant for the establishment and implementation of the employment relationship – in our personnel database and process it in accordance with our Employee Data Protection Notice in accordance with our data retention and deletion processes, about which we will inform you separately as part of your employment.
If no employment relationship is established, we will, in principle, store your personal data for a period of 12 months after the application process has been fully completed. As legal basis for storing the respective personal data, we rely on the necessity of the processing to protect our legitimate interests in the establishment, exercise, or defense of legal claims, in particular the defense of any claims asserted under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz, ‘AGG’), Art. 6(1) lit. f) GDPR.
If we have received your application via a recruitment agency, we may further store limited personal data (in particular your name, the channel via which we received your application and the date of your application) for an additional 6 months, to the extent necessary to be able to meet our contractual obligations to pay a recruitment fee to the recruitment agency in the event of a possible reapplication and recruitment of you within 18 months of your first application. As legal basis for storing the respective personal data, we rely on the necessity of the processing to protect our legitimate interests in fulfilling our contractual obligations to recruitment agencies (Art. 6(1) lit. f) GDPR).
If, unfortunately, we are unable to offer you a suitable position in response to your application but have nevertheless gained a positive impression from your application, it may also be that we would like to include and store your personal data in a job applicant pool so that we can contact you again when filling any future vacancies. Your personal data will only be included and stored in the job applicant pool with your express consent, which we ask you to provide separately as part of the application process. If you give us your consent for the abovementioned purposes, we will store your personal data in the job applicant pool for a period of 5 years after the application process has been completed. You may withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing of your personal data carried out on the basis of your consent before its withdrawal.
To the extent that, in advance of an application procedure, we collect and process any personal data that you have published via any job application platforms or publicly accessible and professionally used social media platforms, and to the extent that we contact you via these platforms and social media with regard to suitable job offers, we will process your data in this regard on the basis of the necessity of the processing to safeguard our legitimate interest in recruiting suitable job applicants for our company and making them aware of suitable job offers within the legally permissible framework (Art. 6(1) lit. f) GDPR). To the extent legally required to contact potential job applicants, we will rely on prior consent as legal basis for the processing (Art. 6(1) lit. a) GDPR). As far as this is followed by an application process, we will process your data according to the processes described above. If this is not the case, any personal data stored about you will be completely deleted again in accordance with our deletion routines.
We will generally delete your data after expiry of the retention period as specified in each case above, unless the deletion is in contradiction to our statutory retention obligations, or any further storage is necessary in the specific case to fulfill other legal obligations or to protect our legitimate interests (establishment, exercise, or defense of our legal claims).
4. Do I have to provide my data?
You are under neither under any contractual nor legal obligation to provide us with your data. However, we may not be able to fully process your application if you do not provide the data necessary to process your application.
5. Who will my data be disclosed to?
Your data will be kept strictly confidential and disclosed internally only to those departments/employees that need to know your data for handling of your application.
Within the Brainloop group, Brainloop is responsible for the central performance and handling of the application process (including for its affiliated group companies in Austria and Switzerland). If you apply for a position with a Brainloop group company in Austria or Switzerland, your data will be disclosed by Brainloop also to the respective group company to the extent necessary to process your application, in particular to verify the qualifications and suitability as well as to conduct interviews. To this extent, Brainloop and the respective group company will act as joint controllers (in the meaning of Art. 26 GDPR). To effectively exercise your rights as a data subject (see Section 6), you may contact the designated central contact point at Brainloop AG at any time by using the contact details set out in Section 1, even if the processing in the context of the joint controllership is carried out by another Brainloop group company mentioned above. You are of course free to exercise your rights also directly against the respective group company.
The contact details of the other Brainloop group companies are as follows:
Brainloop Austria GmbH,
Ausstellungsstraße 50 /C /2. OG, 1020 Vienna, Austria
Phone: +49 89 444 699 0
Email: legal@brainloop.com
Brainloop Switzerland AG,
Gotthardstrasse 30
6300 Zug, Switzerland
Phone: +41 (0) 41 710 39 71
Email: legal@brainloop.com
Further information on the joint controllership as well as the essence of the respective agreement between Brainloop and the other Brainloop group companies can be obtained from Brainloop at any time upon request using the contact details set out in Section 1.
Brainloop uses global IT-systems and applications operated and provided by affiliates of the Diligent group (and their external service providers) in the context of outsourced functions as well as group-wide integrated and centralized business services and functions in the areas of IT-services and HR provided by employees in various companies of the Diligent group affiliated with Brainloop (e.g., IT support and administration, pre-selection of applicants, coordination of candidate interviews). To the extent necessary for this purpose, Brainloop shares your data with Diligent Corporation (headquarter in 111 West 33rd Street, 16th Floor, New York, NY 10120, USA; data protection officer: privacy@diligent.com) and, as the case may be, other companies of the Diligent group affiliated with Brainloop (including located in the European Union, Canada, India, the UK, and the USA). In this respect, Brainloop and Diligent Corporation (and, as applicable, any other group companies involved in the processing) will act as joint controllers (within the meaning of Art. 26 GDPR). Further information on the joint controllership as well as the essence of the respective agreement between Brainloop and Diligent Corporation (and as applicable, other group companies involved in the processing) can be obtained from Brainloop at any time upon request using the contact details set out in Section 1.
In addition, to the extent legally permitted, we transfer your personal data for the purposes stated in Section 3 above to external service providers in the areas of IT-services (such as the provider of our online recruiting tool Greenhouse Recruiting (Greenhouse Software, Inc, 18 West 18th Street, 11th Floor New York, NY 10011, USA) and our technical service providers for storing your data) and compliance review (Signum Consulting GmbH, Rungestr. 19, 10179 Berlin) that have been carefully selected in advance and are contractually bound in accordance with applicable data protection legislation. These companies may only process your personal data to the extent necessary to provide the services we have contracted them to provide. Your data will not be sold to third parties or marketed in any other way. A current list of all service providers can be obtained upon request from Brainloop using the contact details listed in Section 1.
In certain cases, the aforementioned recipients may be located in countries outside the European Union and the contracting states of the European Economic Area (“Third Countries”), in particular in the USA. The laws of these countries may not ensure a level of data protection as considered to be adequate by the European Commission based on an adequacy decision. However, these cases, we have put into place appropriate measures to ensure that your data will be protected appropriately also by the recipients in Third Countries (e.g., by concluding EU Standard Contractual Clauses and implementing supplementary measures). For more information on the recipients of your data, the Third Countries concerned, and the measures implemented by us to protect your data, and in order to receive a copy of these measures, please contact Brainloop at the contact details set out in Section 1.
6. Which rights do I have and how can I exercise them?
You have the right, subject to and in accordance with applicable law:
- to obtain information on your personal data processed and to obtain a copy of such data (right of access);
- to obtain the rectification of any inaccurate personal data and, taking into account the purposes of the processing, to have incomplete personal data completed (right to rectification);
- if there are legitimate grounds, to request the deletion of your personal data (right to erasure);
- to obtain the restriction of processing of your personal data, if the legal requirements are met (right to restriction of processing);
- if the legal requirements are met, to receive the personal data provided by you in a structured, commonly used, and machine-readable format and to transmit this data to another controller or, where technically feasible, to have it transmitted by us (right to data portability); and
- not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you if the legal requirements are not met. An automated decision-making process is not carried out by Brainloop.
You further have the right to object at any time, in accordance with the statutory provisions, to the processing of your data which is necessary for the purposes of our legitimate interests on grounds relating to your particular situation (right to object). If your personal data is processed by Brainloop for direct marketing purposes, you have the right to object to this processing at any time without any special reason.
You also have the right to withdraw any consent you may have given at any time. The withdrawal of your consent does not affect the lawfulness of the processing of your data based on consent before its withdrawal.
In order to exercise your rights, including the withdrawal of your consent, please contact Brainloop using the contact details set out in Section 1. In order to exercise your rights as a data subject in relation to the processing of data carried out in the context of a joint controllership between several group companies as described in Section 3, you may exercise your rights in respect of and against each of the controllers mentioned. To exercise your rights effectively, we recommend that you contact the designated central contact point at Brainloop AG using the contact details set out in Section 1.
Without prejudice to any other remedies, you also have the right to lodge a complaint with a supervisory authority at any time.