Processing of (personal) data by the entity in charge of the online application process

Privacy policy for the processing of your personal data as part of your application

We are very happy about your interest in tonies. The protection and security of your personal data is of particular concern to us. We are therefore happy to fulfil our legal obligation and inform you below about the collection and processing of your personal data and your rights as a data subject.

All information applies both to applications for positions advertised by us and to unsolicited applications. Please read all the information carefully before sending us your application.

1. Who is responsible and who can you contact?  

tonies GmbH is responsible for the processing of your personal data within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (GDPR).           
You can reach us under the following contact details: 

2. What personal data do we process, for what purpose and where does the data come from?  

Data provided by you. As part of an application process, after receiving your application we process the data that you have provided to us and that is necessary for us to carry out the application process. These are in particular         

• Your master data (in particular name, name affixes and date of birth),
• Your contact details,
• The information you have provided as proof of your qualification and the
• documents you send us for this purpose and their content (e.g. cover letter, CV, certificates, proof of employment, references, residence permit, work permit).

You are not obliged to provide us with the aforementioned data. In principle, you only need to provide the data that is necessary for processing your application or for a pre-contractual relationship with us or that we are legally obliged to collect. If we realise when reviewing your documents that crucial information is missing, we cannot promise that we will ask you to complete it. Therefore, please note that it is highly unlikely that we will be able to consider your application without the aforementioned data and will generally not be able to continue with the application and selection process.

Data from external sources. Insofar as this is necessary for the contractual relationship with you and the application you have submitted, we may process data legitimately received from other bodies or other third parties. In connection with an application, however, we may also collect personal data about you on professional social networks (e.g. LinkedIn, XING), insofar as this is necessary in the context of the decision to establish an employment relationship with us.

3. What is the legal basis for processing your data?

We process your personal data as part of the application process only to the extent permitted by applicable law, i.e. in particular in compliance with the provisions of the GDPR and the German Federal Data Protection Act (BDSG). 

Purposes for the fulfilment of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR in conjunction with § 26 para. 1 in conjunction with § 26 para. 8 sentence 2 BDSG). Your personal data will be processed to process your application in response to a specific job advertisement or as a unsolicited application, and in this context in particular for the following purposes: examination and assessment of your suitability for the position to be filled, performance and behavioural assessment to the extent permitted by law, if necessary for registration and authentication for the application via our website, if necessary for the preparation of the employment contract, contract-related communication (including appointments) with you, assertion of legal claims and defence in the event of legal disputes. If there is an employment relationship between you and us, we may process the personal data already received from you for the purposes of the employment relationship in accordance with Section 26 para. 1 BDSG or Art. 6 para. 1 lit. b GDPR, if this is necessary for the performance of the employment relationship or for the exercise or fulfilment of the obligations arising from a law.

Purposes within the scope of a legitimate interest of us or third parties (Art. 6 para. 1 lit. f GDPR). We may process your data beyond the actual fulfilment of the (preliminary) contract if this is necessary to protect our legitimate interests or those of third parties. Your data will only be processed on the basis of legitimate interest and to the extent that no overriding interests on your part speak against such processing, such as in particular for the following purposes: Comparisons with European and international anti-terror lists, insofar as they go beyond the legal obligations; enrichment of our data, e.g. by using or researching publicly accessible data where necessary; building and plant security (e.g. access control and documentation of your visit), insofar as they go beyond the general duties of care; internal and external investigations, security checks. 

Purposes within the scope of your consent (Art. 6 para. 1 lit. a GDPR). Your personal data may also be processed for certain purposes (e.g. obtaining references from previous employers or using your data for subsequent vacancies (talent pool) on the basis of your consent. You can revoke this consent at any time with effect for the future. Processing that took place before the revocation is not affected by this and remains lawful. You will be informed accordingly about the purposes and consequences of revoking or refusing consent when consent is requested.

4. Who receives or gains access to your personal data? 

Access by internal departments. Within our company, those internal departments or organisational units (tonies UK Ltd., tonies France SAS) receive your data that need it to fulfil our contractual and legal obligations (such as managers and specialist managers who are looking for a new employee or are involved in the decision to fill a position, accounting, company doctor, occupational safety, employee representatives, etc.) or in the context of processing and implementing our legitimate interest.

Access by external organisations. Your data will only be passed on to external bodies     

• for purposes for which we are obliged (e.g. tax authorities) or authorised to disclose, report or pass on data in order to comply with legal requirements or if the data transfer is in the public interest (see section 4);
• insofar as external service providers process data on our behalf as processors or function providers (e.g. credit institutions, external computer centres, travel agencies/travel management, printing companies or companies for data disposal, courier services, post, logistics);
• on the basis of our legitimate interest or the legitimate interest of the third party for the purposes mentioned in section 4 (e.g. to authorities, credit agencies, lawyers, courts, experts, group companies and bodies and supervisory authorities); 
• if you have given us your consent for transmission to third parties.

5. Will your data be transferred to a third country or an international organisation?

Transfer to third countries. Data is transferred to bodies in countries outside the European Economic Area EU/EEA (so-called third countries) if it is necessary to fulfil a contractual obligation towards you (e.g. application for a job abroad), or if it is in our or a third party's legitimate interest or if you have given us your consent.

Protection of your data when transferred to a third country. Your data may also be processed in a third country in connection with the involvement of service providers as part of order processing. If there is no adequacy decision by the EU Commission on an adequate level of data protection in the country in question, we will ensure that your rights and freedoms are adequately protected and guaranteed in accordance with EU data protection regulations by means of appropriate contracts. Information on the appropriate or adequate safeguards and how and where to obtain a copy of these can be obtained on request from the responsible data protection officer or via the People & Culture team.

6 How long will your data be stored?

Application process. In principle, we process and store your data for the duration of your application process. This also includes the initiation of an employment contract (pre-contractual legal relationship).       

We store your personal data provided during the application process for a period of 6 months after the end of the application process and notification of rejection or acceptance. This is necessary for the burden of proof in the context of proceedings under the General Equal Treatment Act (AGG). If the data is no longer required for the fulfilment of contractual or legal obligations and rights, it is regularly deleted, unless its - temporary - further processing is necessary for the fulfilment of the purposes listed in section 4.2 for a predominantly legitimate interest on our part. Such a predominant legitimate interest exists, for example, if deletion is not possible or only possible with disproportionate effort due to the special type of storage. A disproportionately high effort may, for example, consist in the deletion of information in your CV that is not relevant to the core activity of the company and should therefore actually be deleted in accordance with the purpose limitation. Where possible, we will restrict processing instead of deleting data that cannot be deleted for the reasons stated above. In other words, the data will be blocked against the usual use by appropriate measures.

Return of physical documents. We will destroy your application submitted in paper form in accordance with the regulations using a document shredder as soon as we have digitised it. If you indicate that you would like the application returned to you after digitisation, we will of course send it back to the sender address provided. Your application documents submitted on electronic data carriers will be returned to you in the original after 6 months if you are not hired. If you are hired, you will receive your electronic data carrier back from us on your first day of work.

Deletion of electronic documents. Electronic data will be deleted accordingly after 6 months.

Consent-based deadline extension. If we wish to store your data for longer for subsequent vacancies or have stored your data in our talent pool, the data will be deleted at a later date; details of this will be communicated to you in connection with the respective process.

Termination of the application process. The application process usually ends with acceptance or rejection by us. You can also withdraw your application at any time by contacting us by e-mail at jobs@tonies.com.

Establishment of an employment relationship. If your application is successful, we will store your application documents that are currently or could be relevant to your employment in the future until the end of your employment relationship, in accordance with the privacy policy for employees that we provide to you when you are hired. Application documents that are not relevant to the employment relationship will be deleted 1 month after the end of your probationary period. 

7. Talent pool

You can agree to have your data included in the talent pool of tonies GmbH.

Talent pool. A talent pool is a database of potential candidates for vacant positions at the company you have applied to. The talent pool enables us to quickly find candidates who have already applied for jobs at tonies GmbH and to check whether another advertised position matches their skills.

Consent process. If we see potential in your talent, you will be asked whether you would like to be included in the talent pool. You can give us your consent by e-mail. The e-mail correspondence takes place in our personnel management system Personio.

Revocation of your consent. You can revoke your consent at any time with effect for the future by contacting us by email at jobs@tonies.com.

Deletion. We check the talent pool regularly (once a year) to assess whether your profile is still of interest to us. If this is not the case, your data will be deleted from the talent pool.

8. What rights do you have (data subject rights)?

Access. You have the right to request access free of charge at any time in accordance with Art. 15 GDPR about whether we process personal data about you and also specifically which data about you is stored, as well as to receive a copy of this data, provided that your right to information is not restricted in accordance with § 34 BDSG.

Rectification. You have the right to rectification of your personal data in accordance with Art. 16 GDPR.

Erasure. You have the right to erasure of your personal data in accordance with Art. 17 GDPR, unless your right to erasure is restricted in accordance with Section 35 BDSG.

Restriction of processing. You have the right to restrict the processing of your personal data in accordance with Art. 18 GDPR.

Data portability. You have the right to data portability under Art. 20 GDPR.

Objection to data processing. You have the right to object at any time to the processing of your data, which is based on our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR, in accordance with Art. 21 GDPR. However, the requirement is that there are reasons for your objection that arises from your particular personal situation. This also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right of appeal. In accordance with Art. 77 GDPR in conjunction with. § Section 19 BDSG, you have the right to lodge a complaint with the competent data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Exercising your rights. You can assert your rights by contacting us by e-mail to jobs@tonies.com.

9. Is there automated decision-making in individual cases (including profiling)?

We do not use any purely automated decision-making processes in accordance with Article 22 GDPR. If we do use such a procedure in individual cases in the future, we will inform you of this separately if this is required by law.