DATA PROTECTION
 
We are delighted by your interest in Hamburger Hafen und Logistik AG (HHLA). We take the protection of the personal data provided by you for the purpose of your application very seriously, and we would like to assure you that we comply with data protection regulations when processing your personal data. This includes that we inform you about the handling of your data in the application process at HHLA as follows:

Data Controller
Hamburger Hafen und Logistik Aktiengesellschaft
Bei St. Annen 1
20457 Hamburg, Germany
Tel.: +49 40 3088-0
karriere@hhla.de

HHLA uses the electronic applicant management system as a central application tool to handle the staffing and application process, also of individual companies and the operative holding companies belonging to HHLA Group. As a rule, the responsible entity for each particular job advertisement and the processing of personal data during the application process is the HHLA affiliated company mentioned in the respective job advertisement.

Questions regarding this information can be directed to our data protection officer at the above address or by email at datenschutz@hhla.de.

Collection of your information

The categories of personal data processed include, in particular, your contact details (such as first name, last name, telephone number, e-mail address) as well as other data relating to your background (e.g. curriculum vitae, qualifications and degrees, work experience) and your person (e.g. cover letter). This may also include special categories of personal data (e.g. information on a severe disability).

In sending us an application, you are transmitting your personal information along with documents like cover letter, CV, certificates and other documentation. All documents sent as part of an application are automatically processed by us and stored in an applicant database. Your documents are processed with a text recognition software and the identified contents are saved to your data set. The original files are converted to PDF and are also saved to your data set. The original files are then deleted. In the event that a document is missing, we may ask you to send it and will also add it to the applicant management system following the process described above.

Please make sure you do not send us any harmful file attachments (e.g. viruses). Personal data sent to us must generally not contain any of the following:

• Information about illnesses
• Information about potential pregnancy
• Information about ethnic origin
• Political, religious or philosophical convictions
• Union affiliation or sexual orientation
• Defamatory or degrading information
• Information not relevant to your application

The information that you send to us must be truthful and must not violate public law regulations, the rights of third parties or moral standards.

We process only the personal data you make available to us in the HHLA application form and the further application process.

Purposes and lawfulness of data processing

We process your personal data in compliance with the EU General Data Protection Regulation (GDPR) as well as with the German Federal Data Protection Act (BDSG) and any other relevant legal provisions. The data processing serves to initiate an employment relationship. The primary legal basis for this is Article 6 (1) (b) GDPR in conjunction with Section 26 (1) BDSG. In individual cases, we process your data to safeguard the legitimate interests of the controller or of third parties (e.g. subsidiaries or affiliated companies of the HHLA Group). Such a legitimate interest exists in particular if the processing of your data is necessary for an intra-group data exchange for administrative purposes (legal basis Article 6 (1) (f) GDPR). Insofar as special categories of personal data are processed pursuant to Art. 9 (1) GDPR, this serves the exercise of rights or the fulfilment of legal obligations under Labour Law, Social Security Law and/or Social Protection Law (e.g. informing the representative for severely disabled persons SGB IX § 81) in the context of the application process. This is done on the basis of Art. 9 (2) lit. (b) GDPR in conjunction with § 26 (3) sentence 1 BDSG. 

The necessity and the scope of data collection are assessed, among other things, according to the position to be filled. If the position to be filled is associated in particular with the performance of particularly confidential tasks or increased personnel and/or financial responsibility or is linked to certain physical and health requirements, further data collection may be necessary on a risk-oriented basis. These special data collections or procedures (e.g. aptitude test, police clearance certificate, pre-employment screening) usually only take place immediately before your employment and may be accompanied by separate information.

In certain cases, we also process your data to protect a legitimate interest of us or a third party. Among other things, this may be to defend legal claims under the Allgemeines Gleichbehandlungsgesetz (AGG). In this context, we have a legitimate interest in processing your data for evidence purposes.

Your data may be passed on to other HHLA Group companies if this is necessary to carry out the application procedure. The legal basis here is Article 6 (1) lit. (f) DSGVO.

In addition, we are legally obliged to carry out certain data processing due to European and national regulations, in particular a name comparison / data comparison with the official sanctions and anti-terror lists (e.g. according to EU regulations no. 2580/2001 and 881/2002). The background to the comparison is that no funds may be made available to persons and organisations on the sanctions and anti-terror lists. This comparison is carried out immediately prior to your recruitment on the legal basis of Art. 6 (1) lit. (c) DSGVO.

Data recipient and transmission of data

The application portal is used centrally by HHLA and also for individual companies of the HHLA Group and the operative holding companies. Along with the company that you applied to, the central HHLA human resources department also has access to your application data. As a rule, only those persons who need access to your data for the proper course of the application process or to fulfil legal obligations have access to your data.

We use a specialized software provider for the application process. They act as a data processor for us and may also obtain knowledge of your personal data in connection with the maintenance of the systems. We have concluded a data processing agreement with this provider which ensures that the data processing is carried out in a permissible manner. The application portal is operated by concludis GmbH, Frankfurter Strasse 561, 51145 Cologne on behalf of HHLA. The website is hosted on servers belonging to Hetzner Online GmbH, Industriestrasse 25 in 91710 Gunzenhausen. Your CV is automatically processed by a parsing tool belonging to Textkernel BV. The parsing occurs on a server in Germany and your data are then deleted by Textkernel BV.

The application data are exclusively processed in data centres in the Federal Republic of Germany and no transferal of your data to third parties – or to third countries – occurs.

Data storage period

As a rule, we anonymise or delete your personal data as soon as they are no longer relevant to the purpose stated above. This occurs regularly three months after the completion of an application process. In the event that you have agreed to the extended storage of your personal data (legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR), your data will be deleted after the agreed period. As a rule, this period is two years. You also have the right to revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.

Questionnaire for evaluating the application process

After completing an application process, you can voluntarily evaluate our application process using a questionnaire. You can access the questionnaire via a link that will be sent to you by e-mail. The processing of your e-mail address in order to send you the link to the questionnaire is based on your consent (Art. 6 Para. 1 Sentence 1 lit. a GDPR taking into account § 26 Para. 2 Sentence 1 BDSG), which you can give us during the process by clicking the respective checkbox. Your participation in the questionnaire has no consequences for your application procedure. The sole purpose of the survey is to analyse our application process and to identify opportunities to improve our processes through feedback.

For the online questionnaire, we use a specialized provider with whom we have concluded a data processing agreement in accordance with Art. 28 GDPR. When submitting the questionnaire, only meta data (e.g. IP address) as well as the questions and your answers are transmitted. The processing of the data is legally based on your consent (Art. 6 para. 1 sentence 1 lit. a GDPR taking into account § 26 para. 2 sentence 1 BDSG). The survey data is sent via a secure SSL connection. The results of the questionnaire will be evaluated by our HR department and will at no time be linked to your person or data that you have submitted as part of the application process. Your answers will be anonymized or deleted as soon as we have completed the evaluation. This usually takes place three months after you submitted your questionnaire. The documentation and any internal publication of the evaluation results will be carried out exclusively in anonymous form, without naming you and without providing any information that would allow us to draw conclusions about you personally.

Your data protection rights

You have the following rights based on the applicable data protection laws:

• The right to obtain information about the processing of your personal data pursuant to Art. 15 GDPR.
• The right to rectification as well as erasure including the "right to be forgotten" according to Art. 16, 17 GDPR.
• The right to request restriction of processing pursuant to Art. 18 GDPR.
• The right to data portability pursuant to Art. 20 GDPR.
• The right not to be subject to automated decision-making that produces legal effects or causes detriment pursuant to Art. 22 GDPR.
• The right to object to processing, including profiling, based on your particular situation pursuant to Art. 6 (1) f, 21 GDPR.
• The right to lodge a complaint with the competent supervisory authority. In particular, the right to complain may be asserted before a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.

All data subject rights with the exception of the right to complain to the supervisory authority can be exercised towards the controller. Please use the contact details above for this purpose.