Privacy policy
for applicants

Contact details of the controller and the data protection officer

The responsible party within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union, and other provisions of a data protection nature is:

IVU Traffic Technologies AG
Bundesallee 88
12161 Berlin
Germany

Phone: +49 30 8 59 06-0
Email: contact@ivu.com
Website: www.ivu.com

Contact details of the data protection officer
Data protection officer
IVU Traffic Technologies AG
Bundesallee 88
12161 Berlin
Germany

Phone: +49 30 8 59 06-0
Email: contact@ivu.com
Website: www.ivu.com

Processing of personal data in the context of the application process

Applicants can find out about career prospects and entry-level opportunities at IVU Traffic Technologies via the “Apply” menu on the website and apply directly via an input form on the IVU career portal.

General information
Your personal data will be shared internally with the departments involved in the application process. Only IVU employees who absolutely need to know will have access to this personal data (need-to-know principle).

Collected personal data
During the application process, IVU processes your personal data from your application documents and any interviews. This may include:

Applicant data (e.g., last name, first name, email addresses (private), data on previous professional career, etc.)
Financial data (e.g., bank account details for reimbursement of travel expenses)
Health data (e.g., data on equal treatment)
Other data (e.g., voluntary disclosure of gender)

Purpose
IVU processes the personal data you provide to review your application and your suitability for the advertised and vacant positions, as well as to carry out the associated application process.

Legal basis
As part of the application process, we process your personal data on the basis of Art. 6 (1) (b) GDPR and § 26 (1) BDSG.

This is therefore necessary for the decision on the establishment of an employment relationship or for its implementation.

If special categories of personal data are involved, processing is carried out in accordance with Art. 9 (2) (b) GDPR and § 26 (3) BDSG.

This is therefore necessary to fulfill legal obligations under labour law and social security and social protection law.

Your personal data will be processed exclusively for the application process and for no other purpose.

Storage period
IVU stores your personal data as part of the application process. Personal data is anonymized six months after completion of the application process and deleted after 14 months.

This serves to protect the company in the event that claims of discrimination are asserted. Your data will only be stored for longer with your express consent. After the storage period has expired, your data will be deleted unless there are legal retention obligations that prevent this.

Processor
Applicants can apply for the selected position via the job description by selecting “Apply now.” We use the Sage HR Suite for this process.

Sage GmbH
Franklinstraße 61-63
60486 Frankfurt am Main
Phone: 069 50007-0
E-Mail: info@sage.de

Processing of personal data in video interviews

Job interviews at IVU can be conducted via video interview. Participation in a video interview is not mandatory and is always based on the voluntary wish of the applicant or the wish of all parties involved. If you would prefer to speak with us in person, this is of course always possible and will not result in any disadvantage or negative assessment on the part of IVU.

Collected personal data
If this is the case, IVU must process the following data in addition to the data mentioned above:

Identification and registration data (e.g., name, email address, user name)
Audio and video data

Purpose
Conducting video interviews to assess the suitability of applicants for open positions at IVU Traffic Technologies AG and to carry out the application process.

Legal basis
In the context of the video interview, we process your personal data on the following legal basis: Art. 6 (1) (f) GDPR:

Legitimate interest: Processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data prevail.

Video interviews are now a common and frequent practice in job interviews, with many companies using them as an alternative to face-to-face interviews. For the controller, conducting video interviews has a number of advantages. In addition to saving time and money on long journeys to and from the interview location, video interviews require less organizational effort and are therefore less stressful. They also ensure a faster application process.

Your personal data will only be processed within the scope of the application process described here.

Storage period
We do not store any personal data collected during the video interviews.

Processor
We only use trusted processors who process your personal data exclusively on our behalf (“processors”). We use Microsoft Teams software for the video interview. This software solution is provided by Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland.

Transfers to third countries: Data processing with Microsoft Teams, including data storage, takes place in the Microsoft Cloud in data centers in Europe or, if possible, in Germany. There are no plans to transfer personal data to a third country for the purposes of operating Microsoft Teams. In particular, no data is stored in third countries. According to Microsoft's operating concept, malfunctions should be remedied largely automatically. In individual cases, it may be necessary to call in Microsoft support staff. In extremely rare cases, downstream Microsoft support engineers may also need to access personal data in IVU storage areas. In such cases, it cannot be ruled out that personal data may be viewed (in some cases in part). Access may also take place from third countries where there is no adequate level of data protection within the meaning of the GDPR. In this case, the adequate level of data protection is ensured by an adequacy decision pursuant to Art. 45 (1) sentence 1 GDPR (U.S. Data Privacy Framework, EU-U.S. Data Protection Framework), which grants the data subjects rights similar to those in the EU. Insofar as the Microsoft website www.office.com or “Microsoft Teams” processes personal data or uses cookies, Microsoft is responsible for data processing. Cookies from Microsoft are used on the website to provide the Microsoft Teams service. Further information on data protection at Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement

Processing of personal data in the applicant pool
To ensure that applicants can also be considered for future vacancies at IVU Traffic Technologies AG, it is possible to add them to our database (applicant pool) on a voluntary basis.

Conclude personal data

Applicant data (e.g., last name, first name, date of birth, resume, references)
Health data (e.g., data on equality)
Other data (e.g., voluntary information on gender)

Purpose
Management of potential candidates for (open) positions.

Legal basis
Within the scope of the applicant pool, personal data is processed on the following legal basis: Art. 6 (1) (a) GDPR.

Consent of the data subject: The data subject has given their consent to the processing of their personal data for one or more specific purposes.
For special categories of personal data: If your personal data falls under special categories of personal data, processing is carried out on the following legal basis: Art. 9 (2) (a) GDPR.

In principle, no health data is requested by IVU, but it is possible that a data subject (applicant) may provide information on this in their application documents (e.g., degree of health impairment).

Storage duration
Due to data minimization and the topicality of the data, the data will be stored for 24 months after the applicant has given their consent.

Processing
Sage GmbH
Marketing-Kommunikation
Franklinstraße 61-63
60486 Frankfurt am Main
Telefon: 069 50007-0
E-Mail: info@sage.de

Processing of personal data in the context of checking against sanctions lists in the application process

Checking business relationships (including employment relationships and other types of benefits) against sanctions lists. Companies, individuals, and countries listed on sanctions lists are not permitted to receive benefits. This prohibition applies to all companies, regardless of their size, form, or activity. In order to comply with this legal obligation, all applicants are checked against the current sanctions lists before being hired.

Condluded personal data

Applicant data (last name, first name, resume, references)

Purpose
Avoiding business relationships with persons on current sanctions lists.

Legal basis
In the context of the video interview, IVU processes your personal data on the following legal basis: Art. 6 (1) (f) GDPR:

Legitimate interest: Processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

IVU has a legitimate interest in complying with the prohibitions arising from, among other things, EU standards EC Regulation 2580/2001, EU Regulation 881/2000, and EU Regulation 753/2011, as well as meeting the compliance requirements of customers and partners and avoiding fines against its own company.

Storage period
After the check has been carried out and no match has been found, the check result is deleted along with the processed personal data.

Processing
We only use trusted processors who process your personal data exclusively on our behalf (“processors”). We use Microsoft 365 software. This software solution is provided by Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland.

Processing of personal data during pre-employment screening

As a service provider for KRITIS companies, we must place particular emphasis on IT and data security, which is why it is also important for us to carry out a basic security check on potential employees. Depending on the security classification of the position in question, the following checks are carried out.

Pre-employment screening is always carried out on a voluntary basis. Since it is necessary to carry out a check for certain security-relevant positions from an information security perspective, applicants must expect to be rejected. Applicants are informed in advance whether the position in question has a corresponding security level.

If necessary, CV details, educational qualifications, and information about previous employers are checked.

Police clearance certificate, if applicable.

Concluded personal data

Applicant data (last name, first name, resume, references)
Information from the certificate of good conduct

Purpose
Security screening of potential employees, thereby minimizing internal security risks.

Legal basis
In the context of the video interview, IVU processes your personal data on the following legal basis:
Art. 6 Abs. 1 lit. a) DSGVO.

Consent of the data subject: The data subject has given their consent to the processing of their personal data for one or more specific purposes.

Storage duration
After the review has been completed, the processed personal data will be deleted if it is not relevant to the application process.

Processing
We only use trusted processors who process your personal data exclusively on our behalf (“processors”). We use the services of SIGNUM Consulting GmbH / brand DISA Rungestraße 19 10179 Berlin Germany. The company is based in Berlin. SIGNUM processes data exclusively within the EU.

SIGNUM does not request certificates of good conduct for us, either domestically or abroad.

Processing of personal data when using recruitment agencies

IVU works with recruitment agencies, where appropriate, to fill vacant positions.

Concluded personal data

Applicant data (last name, first name, email addresses (private), data on previous professional career, etc.)
Health data (e.g., data on equality)
Other data (e.g., voluntary information on gender)

The personal data originates from recruitment agencies commissioned by IVU to find potential candidates to fill vacant positions within IVU.

Applicants are solely responsible for the processing of their personal data by recruitment agencies and must inform themselves accordingly about the processing.

Legal basis
As part of the application management/application process, IVU processes applicants' personal data on the following legal basis: Art. 6 (1) (b) GDPR and § 26 (1) BDSG.

This means that data processing is necessary to fulfill a contract or to carry out pre-contractual measures taken at the request of the data subject. This includes the decision to establish an employment relationship and its implementation.

If recruiters submit application documents that contain special personal data in accordance with Art. 9 (1) GDPR (e.g., health data), processing is carried out on the basis of Art. 9 (2) lit. b GDPR in conjunction with § 26 (3) BDSG.

This is necessary in order to comply with legal obligations under labor law and social security and social protection law.

Storage duration
IVU stores your personal data as part of the application process.

The personal data will be anonymized 6 months after completion of the application process and deleted after 14 months. This serves to protect the company in the event that claims of discrimination are asserted. Longer storage will only take place with your express consent. After the storage period has expired, your data will be deleted, provided that there are no legal retention obligations to the contrary.

Rights of the data subject
Data subjects are persons whose personal data is processed by IVU Traffic Technologies AG, in particular when using the website. Data subjects have certain rights with regard to their personal data, which guarantee them control and protection over their data. These rights can be exercised directly at job@ivu.de.

a) Right to confirmation
Data subjects have the right to obtain confirmation at any time as to whether or not their personal data is being processed.

b) Right to information
Every data subject has the right to obtain, free of charge, information about the personal data stored and the following information:

the purposes of the processing,
the categories of personal data being processed,
the recipients or categories of recipients to whom the personal data has been or will be disclosed
if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration,
the existence of a right to correct or delete the personal data concerning them or to restrict processing by the controller or a right to object to such processing,
the existence of a right to lodge a complaint with a supervisory authority, if the personal data are not collected from the data subject,
whether and to whom personal data concerning the data subject have been or will be transferred to a third country, as well as the appropriate safeguards

c) Right to rectification
Every data subject has the right to request the immediate correction of inaccurate personal data concerning them and the completion of incomplete personal data. In doing so, the data subject may also request that the missing information be supplemented by a corresponding statement, provided that this is necessary for the processing purpose.

d) Right to erasure (right to be forgotten)
Data subjects may request that their personal data be deleted if it is no longer needed or if its processing is unlawful. This is particularly the case in:

The data is no longer required for the original purpose.
The data subject withdraws their consent and there is no other legal basis.
An objection to the processing has been lodged and there are no overriding reasons for the processing.
The processing was unlawful.
There is a legal obligation to erase the data.

e) Right to restriction of processing
Every data subject has the right to obtain from the controller restriction of processing where one of the following applies:

The individual disputes the accuracy of the data, and processing is restricted until the accuracy is verified.
The processing is unlawful, and the individual refuses to have the data deleted and instead requests that its use be restricted.
The controller no longer needs the data, but the individual needs it to assert, exercise, or defend legal claims.
The individual has objected to the processing, and it is not yet clear whether the legitimate grounds of the controller override those of the individual.

During the restriction period, personal data may only be stored and not further processed, except with the consent of the data subject or for the establishment, exercise, or defense of legal claims.

Right to data portability
Every data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format.

They may also transmit this data to another controller without hindrance from the original controller, provided that the processing is based on consent or a contract and is carried out by automated means.

The data subject also has the right to request that the data be transferred directly from one controller to another, if this is technically feasible and does not adversely affect the rights and freedoms of others.

g) Right to object
Data subjects have the right to object at any time to the processing of their personal data if it is based on legitimate interest (Art. 6 (1) (e) or (f) GDPR).

After an objection has been lodged, IVU Traffic Technologies AG will no longer process the data unless there are compelling legitimate grounds that outweigh the interests of the data subject, or the processing serves to assert, exercise, or defend legal claims.

i) Right to revoke consent under data protection law
Every data subject has the right to withdraw their consent to the processing of personal data at any time. The withdrawal can be sent directly to job@ivu.de.

Privacy policy for applicants