Data Protection applicants

1 General Information

We are pleased that you are interested in us and wish to apply for a position with our company. Transparency and the trustworthy handling of your personal data are an important basis for good cooperation. We would therefore like to provide you with information on the processing of your personal data in connection with your application.

1.1 Purposes of Data Processing

We process the data that you send to us in connection with your application in order to assess your suitability for the position or, where applicable, for other open positions within our companies, and to carry out the application process. Your information is therefore used to process your application and to decide whether to establish an employment relationship.

We use AI-powered services and functions, particularly ChatGPT EDU, to support the application process. These services can be used for a variety of purposes, including structuring and summarizing documents, translating text, preparing application documents and internal communications, and enhancing interview performance. They can also be used to streamline organizational processes..

Personal data is processed in this context only to the extent necessary for the specific task. Where the purpose can also be achieved using anonymised, pseudonymised, shortened or generalised information, we use that more data-saving form.

AI-supported applications are used solely as support tools. Decisions regarding your application will not be made automatically, and remain the responsibility of relevant Frankfurt School personnel.

1.2 Software Used

We use the software solutions of d.vinci HR-Systems GmbH (hereinafter d.vinci) for applicant management. The software helps us approach, search for, select and hire suitable employees. It therefore covers the areas of applicant management, personnel marketing, personnel consulting and recruiting services.

In addition, AI providers and IT service providers may be involved in the application process, in particular OpenAI in connection with ChatGPT EDU and Microsoft where AI functions are used in the relevant applications. Where these providers process personal data on our behalf, they are engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR. Inputs and outputs in ChatGPT EDU are not used to train OpenAI models.

1.3 Controller Responsible for Data Processing

The controller within the meaning of data protection law is the respective company to which you have applied:

Frankfurt School of Finance & Management gGmbH

Adickesallee 32-34

60322 Frankfurt am Main

Represented by the President, Prof. Dr. Nils Stieglitz

efiport GmbH

Adickesallee 32-34

60322 Frankfurt am Main

Represented by the Managing Director, Prof. Dr. Nils Stieglitz

Frankfurt School Financial Services GmbH

Adickesallee 32-34

60322 Frankfurt am Main

Represented by the Managing Director, Martin Cremer

Further information about our company, details of the persons authorised to represent us and additional contact options can be found in the imprint on our website:

https://www.frankfurt-school.de/home/imprint

1.4 Data Sources

We process personal data that we receive from you as part of the application process. In addition, we may collect data from publicly available sources, in particular from professional social networks such as LinkedIn or XING.

If we use AI-supported services to assist with the application process, additional inputs, outputs, and technical metadata may be generated. These are usually derived from the application data you have provided, publicly available professional information or the internal steps involved in the application process.

1.5 Legal Basis

We process your personal data in particular in compliance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other applicable laws.

The primary legal basis for processing your personal data in the application process is Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG, insofar as the processing is necessary to carry out the application process and to decide whether to establish an employment relationship.

In addition, we have a legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in particular in the efficient implementation and organisation of the application process, supporting existing processes, using modern technology, quality assurance, IT security and the establishment, exercise or defence of legal claims. This may also include the supportive use of AI-supported services and functions, provided that the processing is necessary for the specific purpose and your interests or fundamental rights do not prevail.

Where information on your terminal device is processed without your consent in connection with your application, the legal basis is Art. 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG.

Where you have given your consent, we process your data on the basis of Art. 6(1)(a) GDPR, where applicable in conjunction with Section 25(1) TDDDG. This applies in particular to inclusion in our applicant pool or other processing activities for which we obtain separate consent. Consent may be withdrawn at any time with effect for the future.

Where we are legally obliged to process personal data, this is carried out on the basis of Art. 6(1)(c) GDPR.

Where special categories of personal data pursuant to Art. 9(1) GDPR are processed, for example information on severe disability or health data, this is done only where there is a data protection legal basis. This may in particular be Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG or explicit consent pursuant to Art. 9(2)(a) GDPR.

If data is stored after completion of the application process, the processing may take place in particular for the purposes of legitimate interests pursuant to Art. 6(1)(f) GDPR. Our interest in this case is the establishment or defence of claims, in particular to meet evidentiary obligations.

Subject to your consent, we will include you in our applicant pool. Further information can be found in section 3.

If an employment relationship is established between you and us, we may continue to process the personal data already received from you for the purposes of the employment relationship if this is necessary for the performance or termination of the employment relationship.

Your application data will not be processed beyond the uses described in this privacy notice.

1.6 Categories of Personal Data

We process your personal data insofar as this is necessary to carry out the application process. This includes, in particular, the following categories of data:

Standard information:

• applicant master data, in particular first name, surname, address and position applied for
• contact data, in particular email address and telephone number
• qualification data, in particular cover letter, CV, previous activities and professional qualifications
• certificates and references, in particular employment references, performance data and assessment data
• communication data from the application process, in particular emails, conversation notes, interview information and organisational arrangements

Special information that may be required due to the position to be filled:

• police clearance certificate
• information on work permits, residence status or comparable evidence, where required

Other information that you voluntarily provide to us in your application, for example:

• application photo
• information on severe disability
• links to professional profiles or other information

Where AI-supported services are used, the following data may also be processed, provided that it is personal data:

• inputs or excerpts from application documents that are necessary for a specific AI-supported task
• prompts, work instructions and other inputs from employees
• outputs, drafts, summaries, translations, assessments or structuring aids generated by AI services
• technical metadata, in particular time of use, account ID, usage logs and system information

1.7 Storage Period and Applicant Pool

In the event of rejection, applicant data will be deleted after 6 months. If you have consented to further storage of your personal data, we will transfer your data to our applicant pool. The data in the applicant pool will be deleted after two years. If you are offered a position as part of the application process, the data from the applicant management system will be transferred to our personnel information system.

If you use AI-supported services to assist with your application, your personal data will only be processed for as long as is necessary for this purpose. The storage periods stated above also apply to the results included in the application file. Technical log and usage data are stored in accordance with the relevant system settings, and only for as long as is necessary for operational, security, troubleshooting or legal purposes. OpenAI may store ChatGPT EDU chat content for up to 12 months where necessary for operational, security, abuse prevention, or troubleshooting purposes.

1.8 Place of Data Processing

Where the d.vinci software solution is used, data is processed exclusively in German data centers, where d.vinci is based. Furthermore, d.vinci is ISO 27001 certified. However, for infrastructural reasons, data in transit may temporarily be processed outside the European Union or the European Economic Area.. 

Where AI-supported services or other IT service providers are used, processing may, depending on the service used, also take place in other data centres within the European Union or the European Economic Area. Details on transfers to third countries can be found in section 1.9.

1.9 Data Transfers to Countries Outside the European Union or the European Economic Area (Third Countries)

If the d.vinci software solution is used, no transfer to a third country is intended.

However, when using AI-supported services or other IT services, personal data may be transferred to recipients outside the European Union or the European Economic Area, particularly to providers or affiliated companies in the USA. Such transfers only take place where an adequacy decision exists from the European Commission, or where appropriate safeguards are in place pursuant to Art. 46 et seq. GDPR, particularly EU standard contractual clauses. Where possible, data is stored or processed in European data centers.

1.10 Automated Decision-Making and Profiling

No solely automated decision-making pursuant to Art. 22 GDPR and no profiling takes place. AI-supported services may only support employees of Frankfurt School. Outputs from such services are reviewed before they are used. Decisions in the application process are made by the responsible persons.

1.11 Your Rights as a Data Subject

Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right of access to this personal data and to the information listed in detail in Art. 15 GDPR. If a request for access is not made in writing, we ask for your understanding that we may first request proof from you to verify that you are the person you claim to be.

Right to Rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete data.

Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of personal data concerning you where one of the grounds listed in Art. 17 GDPR applies.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing where one of the conditions listed in Art. 18 GDPR applies, for example if you have objected to processing, for the duration of the controller's review.

Right to Data Portability (Art. 20 GDPR)

In certain cases set out in detail in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission of this data to a third party.

Right to Withdraw Consent (Art. 7 GDPR)

Where data processing is based on your consent, you are entitled under Art. 7(3) GDPR to withdraw your consent to the use of your personal data at any time. Please note that the withdrawal applies only with effect for the future. Processing that took place before the withdrawal is not affected.

Right to Object (Art. 21 GDPR)

Where data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection law. The complaint may in particular be lodged with a supervisory authority in the Member State of your habitual residence or the place of the alleged infringement.

Exercising Your Rights

Unless otherwise stated above, please contact our Data Protection Officer in accordance with section 1.12 to exercise your rights as a data subject.

1.12 Our Data Protection Officer

We have appointed a Data Protection Officer, who can be contacted as follows:

intersoft consulting services AG

Beim Strohhause 17

20097 Hamburg

Germany

or by email: datenschutzbeauftragter@fs.de

1.13 Data Processing When Accessing the Website

When you use our website for informational purposes only, that is, if you do not register or otherwise provide us with information, for example via the contact form, we collect the following technical information (log file data):

• information about the browser type and version used
  • the user's internet service provider
  • the user's IP address
  • the user's operating system and its interface
  • date and time of access
  • time zone difference to Greenwich Mean Time (GMT)
  • content of the request (specific page)
  • access status/HTTP status code
  • amount of data transferred in each case
  • the previous website from which the user accessed our website
  • language and version of the browser software

The collection of this data is technically necessary to display our website to you and to ensure stability and security. We and our service provider usually do not know who is behind an IP address. We do not combine the data listed above with other data.

As the collection of data for providing the website and the storage of data in log files are essential for the operation of the website and protection against misuse, our legitimate interest in data processing prevails in this respect.

2 Application Procedure

2.1 General Information

You can apply to our company electronically, for example by email or via the web form.

2.2 Obligation to Provide Personal Data

The provision of personal data is neither legally nor contractually required. You are therefore not obliged to provide personal data. However, the provision of personal data is necessary to carry out the application process. This means that if you do not provide us with personal data in connection with an application, we will not be able to carry out the application process.

2.3 Recipients of the Data

Your data is mainly processed by our HR department and the department responsible for filling the relevant position. In some cases, however, other internal and external bodies are also involved in processing your data.

d.vinci acts as a service provider for us and may, in connection with maintenance and system support, obtain knowledge of your personal data. We have concluded a data processing agreement with this provider, which ensures that the data processing is carried out lawfully.

Where AI-supported services are used, AI providers and IT service providers may also receive personal data, in particular OpenAI in connection with ChatGPT EDU and Microsoft where AI functions are used in the relevant applications. In this respect as well, processing takes place only to the extent necessary for the specific purpose and only where the relevant provider has been integrated in accordance with data protection requirements.

After receipt of the application, applicant data is reviewed by the HR department. Suitable applications are then forwarded internally to the department heads responsible for the respective open position. The further process is then coordinated. Within the company, only those persons who need access to your data for the proper conduct of our application process have such access (need-to-know principle).

In particular, the following internal bodies may receive your data:

• HR department
• responsible departments and managers
• works council, where legally required or necessary
• other internal bodies, where this is necessary in the individual case to carry out the application process

External service providers:

• REISSWOLF International AG for document destruction
  • d.vinci
  • OpenAI/ChatGPT EDU, where required for supportive AI use
  • Microsoft and other IT service providers, where required for the provision, maintenance, security or use of the systems deployed

External service providers and partner companies receive your data only to the extent necessary. In these cases, the scope of the data transmitted is limited to what is necessary. Where our service providers process your personal data on our behalf, we ensure through data processing agreements pursuant to Art. 28 GDPR that they comply with data protection law. Please also note the privacy notices of the respective providers. The relevant service provider is responsible for the content of third-party services, although we review services for compliance with legal requirements to the extent reasonable.

2.4 Protection of Your Data

We have implemented extensive technical and organisational safeguards to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security procedures are regularly reviewed and adapted to technological progress.

When AI-supported services are used, internal requirements on data minimisation and information security apply. Personal data may be processed only to the extent necessary for the specific purpose. Where possible, data is anonymised, pseudonymised, shortened or described in general terms. Particularly sensitive data is processed only where this is exceptionally necessary and an appropriate legal basis exists.

SSL encryption on our website ensures that data is exchanged between the visitor's browser and our server via a secure connection. The secure connection can be recognised by the abbreviation HTTPS.

Please note that emails sent without encryption are not protected against access during transmission.

3 Privacy Notice on the Applicant Pool

With your explicit consent, we will review your application for further opportunities within our company, where appropriate forward your profile to other departments within our company for this purpose, and contact you.

For this purpose, we store the personal data that we received as part of the entire application process, for example from cover letters, CVs, certificates, applicant questionnaires and applicant interviews, beyond the end of the specific application process. If you have provided special categories of personal data in your cover letter or other documents submitted during the application process, the consent also covers this data.

The consent also applies to data from publicly available data sources, in particular professional social networks, that we lawfully collected as part of the application process.

AI-supported tools may also be used to support the management of the applicant pool, for example to structure profile information, prepare internal coordination or identify generally suitable opportunities. In this context as well, personal data is processed only to the extent necessary for the relevant purpose. No solely automated decision-making takes place.

You may withdraw your consent at any time and without giving reasons. In this case, your data will be deleted unless claims arising from the application process are still to be expected or other retention obligations exist.

To withdraw your consent, please contact the office named in section 1.12.

4 Changes to This Information

We reserve the right to change our security and data protection measures where this becomes necessary, for example due to technical developments. In such cases, we will also update our privacy notice accordingly. Please therefore refer to the current version of our privacy notice. We endeavour to regularly check all links for accuracy and legal compliance.