1.Controller and data protection officer
Responsible for the data processing as controller in terms of data protection law is:
Dr. Ing. h.c. F. Porsche AG
Phone: (+49) 0711 911-22911
If you have any questions or suggestions regarding data protection, please feel free to contact us. You can reach our data protection officer as follows:
Dr. Ing. h.c. F. Porsche AG
Data Protection Officer
The electronic application system is a central portal for Porsche group. In this respect, we are jointly responsible with the following other group companies of Porsche AG as joint controllers:
- Porsche Logistik GmbH
- Porsche Dienstleistungs GmbH
- Porsche Leipzig GmbH
- Porsche Deutschland GmbH
- Porsche Engineering Services GmbH
- Porsche Engineering Group GmbH
- Porsche Consulting GmbH
- Porsche Lizenz- und Handels GmbH
- Porsche Financial Services GmbH
- Porsche Digital GmbH
- Porsche Werkzeugbau GmbH
- Porsche Niederlassung Stuttgart GmbH
- Porsche Niederlassung Berlin GmbH
- Porsche Niederlassung Potsdam GmbH
- Porsche Niederlassung Hamburg GmbH
- Porsche Niederlassung Leipzig GmbH
- MHP GmbH
- MHP Consulting Romania SRL
With respect to the joint processes for the electronic application system, we and the respective group companies of Porsche AG jointly determine the purposes and means of processing.
In an agreement on joint controllership pursuant to Article 26 GDPR, we and the respective group companies of Porsche AG have determined how the respective tasks and responsibilities in the processing of personal data are structured and who fulfills which data protection obligations. In particular, it was determined how an appropriate level of security and your rights as a data subject can be ensured, how the information duties under data protection law can be fulfilled jointly and how potential data protection incidents can be monitored. This also includes ensuring that reporting and notification obligations are fulfilled.
Porsche AG is at your disposal as your central contact point in relation to the electronic application system in the role of technical operator (e.g. for questions regarding the management of your application account). You can also assert your rights with regard to the processing of personal data in joint controllership vis-à-vis any jointly responsible group company of Porsche AG. In case you contact us, we and the relevant group company of Porsche AG will coordinate in accordance with the aforementioned agreement pursuant to Article 26 GDPR in order to respond to your inquiry and to guarantee your rights as a data subject.
2. Subject of data protection
The subject of data protection is the protection of personal data. This is all information relating to an identified or identifiable natural person (so-called data subject). This includes information such as name, postal address, email address or telephone number, as well as information that originates during the application procedure and during use of the electronic application system, such as details of your qualifications, education and training, and previous jobs.
3. Purposes and legal basis of data processing
Below you will find an overview of the purposes of and legal grounds for data processing in personnel marketing and during the application procedure at Porsche AG.
The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will point it out separately if you are obliged to provide personal data and what possible consequences the non-supply would then have (e.g. a loss of claims or our position not to provide the requested service without providing certain information). The use of the Online Service is generally possible without registration. The use of individual functions may require prior registration. Even if you use the Online Service without registration, personal data may still be processed.
3.1 Performance of a contract and pre-contractual measures
We process your personal data if this is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken in response to your request. The data processing is based on Article 6 paragraph 1 letter b) GDPR.
We process personal data insofar as this is necessary for the application procedure and, if applicable, to prepare an employment contract with you. The main purposes of data processing are:
- Recording and checking your application
- Application management and the selection process (forwarding to the responsible persons in-house, organizing and conducting interviews, recruitment management and administration)
- Organizing and holding selection days and tests for certain application procedures, such as the trainee program, apprenticeships, and general application days
- In the case of internal applications for in-house programs: application management and the selection process
Data is processed on the basis of Section 26 (1) (1) BDSG. We process the personal data that is required to conduct the application procedure and, if applicable, to prepare an employment contract.
If no employment contract arises, we will anonymize your data after four months, unless legal grounds apply for not doing so. If the latter is the case, we anonymize the data once the other legal grounds cease to apply. You can then no longer be identified. Data is processed after anonymization only for the purpose of statistical analysis.
3.2 Fact check
We conduct a review of your personal information to ensure that potential employees perform their duties without conflicting interests and in compliance with high ethical standards while they commit to the company’s principles.
Personal data verification includes your personal data (surname, first name, date of birth, address), your original identity document (or an equivalent document) and your certificates (in particular the last certificate of secondary education) either in the original or in the form of a certified paper copy. In addition, it is checked whether you already have been employed by Porsche and if so - limited to this case and in compliance with the data protection regulations - whether written disciplinary measures have been issued to you in the past three calendar years. For this purpose, personal data in the existing personal file for the past three calendar years are queried. Your personal data will also be compared with publicly available EU sanction lists under Regulations (EC) No. 2580/2001 and 881/2002, as well as with the additions made and received by the European Commission. Only in case of need, you will be asked to provide further documents such as your original residence permit, severely disabled person's card or certificate of good conduct (reliability test).
The fact check is carried out by the respective HR department and, if necessary, additionally by the HR Compliance & labor law department (MAC). Only a limited group of people internally has access to your data. In the case of conspicuous findings within the framework of the fact check, the results are discussed in a committee (department, personnel area, works council). The result of the consultation is documented and stored in the personnel file. For new hires, the completed checklist for the fact check will be deposited in the personnel file and will remain there according to the deletion period for relevant personnel documents and data. Other data storage or processing does not take place. For not hired external candidates, the checklist for the fact check will be deleted after four months while for all other candidates, it will be deleted after three years of storage in their personal file.
The processing of your personal data for the purpose of establishing an employment relationship is required in the sense of Section 26 (1) (1) BDSG, since we have a legitimate interest in people who are integer and acting in accordance with applicable law. The contents of the fact check are also regulated in a collective agreement.
The provision of personal data is required for a contract.
3.3 Job Abo
In order to subscribe to the newsletter “Job Abo”, you only need to enter your e-mail address and how often you would like to receive the newsletter. The newsletter is only sent to individuals who have subscribed, i.e. given their consent based on Article 6 (1) (a) GDPR. The contents of the newsletter “Job Abo” are relevant for the scope of the consent, provided they are actually described during the subscription process. In addition, the newsletter contains information about your career opportunities at Porsche AG and at other group companies of Porsche AG.
Subscription is carried out using the so-called double opt-in process, i.e. after subscribing, you receive an e-mail prompting you to confirm your subscription to prevent misuse of your e-mail address. We make a record of all subscriptions so that we can provide evidence of the subscription process and associated consent in line with legal requirements. Subscriptions are always logged and the mandatory processing of data you entered during the subscription process is performed accordingly on the basis of legitimate interests according to Article 6 (1) f) GDPR. You can withdraw your consent to receive our Job Abo at any time by unsubscribing, for example. You can exercise this right using the unsubscribe link at the end of each Job Abo.
3.4 Application account
You can use the application account to send your application to us or other group companies of Porsche AG via the electronic application system, and to manage and keep an eye on job offers. We recommend that you use the application account, because the internal processes and the application procedure itself at Porsche AG and other group companies of Porsche AG are adapted to work with this account. Even if you send us your application via another channel, your application will be scanned in as part of our internal processes, and the data will be further processed electronically (see Item 3). Your paper documents will then be returned to you by post.
If you wish to create an application account, you will need to register. Your registration details (username and password) during registration and login are then collected and processed.
Your application account gives you the option of creating an applicant profile. You can enter or upload your personal data (e.g., title, first name, surname, date of birth, place of birth, birth country, nationality, address, telephone number, e-mail address), your qualifications (e.g., education and training, any professional experience, language skills, IT skills), your application documents (e.g., cover letter, résumé, etc.), and other relevant information (e.g., desired salary, availability). Required fields in the online form are marked.
This data is processed on the basis of Section 26 (1) (1) BDSG in order to create your application account and applicant profile for conducting the respective application procedure(s) and – if you have given your consent – to check your application in the Porsche group or Talent Pool on the basis of Article 6 (1) (a) GDPR.
If you delete your application account, your user profile will also be deleted. For the deletion of actual applications, please see Item 3. With regard to the deletion of data relating to specific applications at other group companies of Porsche AG, the provisions of the corresponding Privay Policies shall apply (see Item 1).
3.5 Compliance with legal obligations
We process your personal data to comply with legal obligations to which we are subject. The data processing is based on Article 6 paragraph 1 letter c) GDPR. These obligations may arise, for example, from commercial, tax, money laundering, financial or criminal law. The purposes of the processing result from the respective legal obligation; as a rule, the processing serves the purpose of complying with state control and information obligations.
Data is processed on the basis of Article 6 (1) (c) GDPR. We process the personal data that is required in order to comply with the respective statutory obligation.
We delete the data once the statutory obligation ceases to apply, unless other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
3.6 Safeguarding of legitimate interests
We also process your personal data to pursue the legitimate interests of ourselves or third parties, unless your rights, which require the protection of your personal data, outweigh these interests. The data processing is based on Article 6 paragraph 1 letter f) GDPR. The processing to safeguard legitimate interests is carried out for the following purposes or to safeguard the following interests.
- Operational reporting
- Performing and optimizing personnel marketing and the recruitment process (performing consultations in personnel marketing, applicant surveys and statistical analyses)
When you call up the Online Service, data relating to your end device and your use of the online offer are processed and stored in a so-called log file. This concerns in particular technical data such as date and time of access, duration of the visit, type of terminal device, operating system used, functions used, amount of data sent, IP address and referrer URL. We process this data to ensure technical operation and to determine and eliminate faults. In doing so, we pursue the interest of permanently ensuring technical operability. We do not use this data for the purpose of drawing conclusions about your person.
We process your personal data on the basis of corresponding consent. The data processing is based on Article 6 paragraph 1 letter a) GDPR. If you give your consent, it is always for a specific purpose; the purposes of processing are determined by the content of your declaration of consent. You may revoke any consent you have given at any time, without affecting the legality of the processing that has taken place on the basis of the consent until revocation.
If you have given consent for certain purposes, such as the checking of your application in other companies of Porsche group, for inclusion in a Talent Pool, or in order to receive the newsletter "Job Abo", for example, the purposes are evident in the wording of this granted consent.
To prevent misuse, we use the so-called double opt-in process for sending the newsletter.
Data is processed on the basis of Article 6 (1) (a) GDPR. You may withdraw your consent at any time without stating a reason. This withdrawal will not affect the lawfulness of processing based on consent given before it is withdrawn.
We delete the data when you have withdrawn your consent, unless other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply
3.8 Change of purpose
If we process your personal data for a purpose other than that for which the data was collected, beyond the scope of a corresponding consent or a mandatory legal basis, we will take into account, in accordance with Article 6 paragraph 4 GDPR, the compatibility of the original and the now pursued purpose, the nature of the personal data, the possible consequences of further processing for you and the guarantees for the protection of the personal data.
We do not carry out automated decision making or profiling in accordance with Article 22 GDPR. Profiling is only carried out to protect our legitimate interests as described above.
4. Access authorizations in the end device
Some functions of the Online Service require the granting of authorization to access your end device (e.g. access to location data). The granting of these authorizations is voluntary. However, if you wish to use the corresponding functions, you must grant the appropriate authorizations, otherwise you will not be able to use these functions. The permissions remain active as long as you have not reset them in your device by deactivating the respective setting.
5. Cookies and comparable technologies
6. Integrated third-party services
Services of other providers which we integrate or to which we refer are provided by the respective third parties. Third-party services may also include offers from other Group Companies of Porsche AG and from Porsche Centers. We have no influence on the content and function of the third-party services and are generally not responsible for the processing of your personal data by their providers, unless the third-party services are completely designed on our behalf and then integrated by us on our own responsibility. Insofar as the integration of a third-party service results in us establishing joint processes with its provider, we will define with this provider in an agreement on joint controllership pursuant to Article 26 GDPR how the respective tasks and responsibilities in the processing of personal data are structured and who fulfils which data protection obligations. Insofar as Cookies are to be set on the basis of your consent, you will receive further information on the responsibility for setting these Cookies and any associated third-party services in the corresponding areas of the consent management.
Unless otherwise stated, profiles on social media are generally only included in the Online Service as a link to the corresponding third-party services. After clicking on the integrated text/image link, you will be redirected to the offer of the respective social media provider. After the redirection, personal data may be collected directly by the third-party provider. If you are logged in to your user account of the respective social media provider, the provider may be able to assign the collected information of the specific visit to your personal user account. If you interact via a "share" button of the respective social media provider, this information can be stored in the personal user account and published if necessary. If you want to prevent the collected information from being assigned directly to your user account, you must log out before clicking the included text/image link.
7. Recipients of personal data
Within our company, only those persons who need your personal data for the respective purposes mentioned have access to it. Your personal data will only be passed on to external recipients if we have legal permission to do so or have your consent. Below you will find an overview of the corresponding recipients:
- Commissioned processors: Group companies or external service providers, in particular the companies JobAmbition GmbH (for digitizing applications that are not submitted via the electronic application system, and for answering queries), and milch & zucker Talent Acquisition & Talent Management Company AG (Provision, operation and support of the electronic application system). We carefully select and regularly inspect these processors, to make sure that your privacy is maintained. The processors may only use the data in accordance with our instructions.
- Public bodies: Authorities and state institutions, such as tax authorities, public prosecutors' offices or courts, to which we (must) transfer personal data, e.g. to fulfil legal obligations or to protect legitimate interests.
- Private bodies: Group companies, Porsche dealers and service companies, cooperation partners, (non-processor) service providers or commissioned persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers.
8. Data processing in third countries
If a data transfer takes place to entities whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we will ensure prior to the transfer that either the data transfer is covered by a statutory permit, that guarantees for an adequate level of data protection with regard to the data transfer are in place (e.g., through the agreement of contractual warranties, officially recognized regulations or binding internal data protection regulations at the recipient), or that you have given your consent to the data transfer.
If the data is transferred on the basis of Articles 46, 47 or 49 paragraph 1, subparagraph 2 GDPR, you can obtain from us a copy of the guarantees for an adequate level of data protection in relation to the data transfer. Please use the information provided under Section 1.
9. Storage duration, erasure of data
We store your personal data, if there is legal permission to do so, only as long as necessary to achieve the intended purposes or as long as you have not revoked your consent. In the event of an objection to processing, we will delete your personal data, unless further processing is still permitted by law. We will also delete your personal data if we are obliged to do so for other legal reasons. Applying these general principles, we will usually delete your personal data immediately
- after the legal permission has ceased to apply and provided that no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter applies, we will delete the data after the other legal basis has ceased to apply;
- if your personal data is no longer required for the purposes we pursue and no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter is the case, we will delete the data after the other legal basis has ceased to apply ;
10. Rights of data subjects
Right to access: You have the right to receive information about your personal data stored by us.
Right to rectification and erasure: You can demand that we correct incorrect data and, if the legal requirements are met, delete your data.
Restriction of processing: You can demand that we restrict the processing of your data, provided that the legal requirements are met.
Data portability: If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, demand that the data you have provided us with are handed over in a structured, common and machine-readable format or that we transfer it to another controller.
Objection: You have the right to object at any time to data processing by us based on the safeguarding of legitimate interests for reasons arising from your particular situation. If you make use of your right to object, we will stop processing the data unless we can prove compelling reasons for further processing worthy of protection which outweigh your rights and interests.
Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose.
Revocation of consent: If you have given us your consent to process your personal data, you can revoke it at any time with effect for the future. The legality of the processing of your data until revocation remains unaffected.
Right to lodge a complaint with a supervisory authority: You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or your country or the supervisory authority responsible for us.
Your contact with us and the exercise of your rights: Furthermore, you can contact us free of charge if you have questions regarding the processing of your personal data and your rights as a data subject. Please contact us at https://www.porsche.com/privacy-contact/ or by letter mail to the address provided under Section 1. Please make sure that we can definitely identify you. If you revoke your consent, you can alternatively choose the contact method that you used when you gave your consent.
11. Effective date