Privacy information for applications.

The controller is ecc process GmbH, Pfarrer-Melf-Str. 20, 85669 Pastetten, Germany. Please send questions about data protection informally to datenschutz@group-ecc.com. This information applies to applications made through our application form and by email.

• Master data: name, email address, phone number
• Postal address
• Form of address, voluntary; “not specified” is preselected
• Professional background: LinkedIn profile, cover letter, availability
• Application documents: CV, references, other documents
• The position and area you are applying for
• During the procedure: appointment arrangements, our notes and assessments from the interviews, and the status of your application
• How you heard about us: your voluntary answer in the form and, if you came via a link we distributed, its campaign identifier

We process your data to decide on your application (Art. 6(1)(b) GDPR). We do not ask for consent for this; with the tick box in the form you only confirm that you have read this information. We use your answer on how you heard about us only to learn which job adverts work; it plays no part in the decision on your application. You can leave the field empty without any disadvantage to your application. The legal basis for this, and for keeping data after the procedure has ended, is our legitimate interest (Art. 6(1)(f) GDPR).

For an application through the form we need your name, email address, phone number and CV, and your confirmation that you have read this information. Without these details we cannot process your application. All other details are voluntary. There is no legal or contractual obligation to provide us with data.

Your data is seen by the responsible persons in recruiting, by the management and by the staff we assign to interviews with you. Before an interview they receive your contact details by email and, where available, your CV and documents. We also use these service providers as processors under Art. 28 GDPR:

• Supabase Pte. Ltd. (Singapore; servers in the EU, Ireland): database, authentication and storage of your application documents
• Vercel Inc. (USA): hosting of the application form
• Microsoft Ireland Operations Ltd. (Ireland): email, calendar invitations and Teams meetings for interviews
• Railway Corporation (USA; Amsterdam data centre): our signing service, if an offer leads to contract signing
• Cloudflare, Inc. (USA): bot protection for the application form

For transfers to the USA and Singapore we rely on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); where a provider is certified under the EU-US Data Privacy Framework, also on the Commission’s adequacy decision (Art. 45 GDPR).

If your application is unsuccessful, we delete your data and documents no later than six months after the procedure has ended. This period follows from the deadlines for claims under Section 15(4) AGG and for actions under Section 61b ArbGG, plus a margin; until then we keep the data so that we can defend ourselves against possible claims. If you withdraw your application, we delete it as soon as we no longer need the data for this. If you are hired, we transfer the documents to your personnel file.

Your data and documents are stored in our database in the EU, the documents in non-public storage without a direct address. Transmission is encrypted throughout.

Before we store an application, we check two characteristics of automated submissions: whether a field invisible to humans has been filled in and whether the form was submitted in less than five seconds. If either applies, we do not store the submission. In addition, a simple rule checks the cover letter for wording typical of machine-generated text. If it is triggered, the application receives a note that a person sees; it is not rejected because of it. Decisions on your application are always made by people; we do not make automated decisions under Art. 22 GDPR.

We do not machine-read your application documents. Your CV, certificates and other documents are neither read by a language model nor automatically searched for content; they are not scored and not matched against job profiles.

If we send you a job offer with a link to accept or decline it, we store your decision, its time and an optional reason.