Data privacy

Data Protection Regulations for the Recruiting Process

Data protection is very important for grenke AG (hereinafter grenke). The protection and confidentiality of personal data is top priority for us.

In the following, we will inform you about the type, scope, and purposes of the collection and processing of your personal data in connection with your application in accordance with the GDPR, the German Federal Data Protection Act (BDSG), and other applicable data protection regulations.

 

Who is responsible for data processing and who can I contact? 

Controller within the meaning of Art. 4 No.7 GDPR is:

grenke AG

Neuer Markt 2

76532 Baden-Baden

Germany

Phone: +49 7221 5007-0

Fax: +49 7221 5007-222

You can reach our Data Protection Officer at:

grenke AG

Data Protection Officer

Neuer Markt 2

76532 Baden-Baden

Germany

E-Mail: datenschutz@grenke.de

 

From which sources do we obtain your data?

We collect your personal data for the application process in order to determine your suitability for open positions.

Data that you provide to us: We initially process personal data that you provide to us as part of the application/admission process. This applies in particular to your application documents.

 

What data or categories of data will we process?

As part of the process, we will process your personal data to the extent necessary to determine your suitability for filling open positions. This data processing may include, but is not limited to, the following data or data categories:

  • Personal and contact information, such as name, email address and telephone number, home address, date of birth, gender, marital status and nationality
  • Education, performance and employment data, such as information on school and university degrees, professional experience and skills and performance reviews
  • Other application documents that you provide to us, such as a letter of application, application photo, certificates, CVs, or other information, e.g. reference to hobbies or voluntary work
  • Special categories of personal data: If you provide information in your application documents that contain special categories of personal data (e.g. information about your health or health restrictions), we will also process this data to the extent permitted by law.

During the application process, you can choose from three options for the extent to which we can use your data:

  • Consider your application only for the position for which you have applied;
  • Consider your application for open positions in the entire country of your residence;
  • Consider your application for open positions worldwide.

 

What data is processed when you visit our careers website / Creating a Candidate Profile?

We process personal data in accordance with the provisions of the GDPR, the BDSG and other applicable data protection regulations. The data processed in the context of this website is only collected and used to the extent necessary.

In order to ensure the proper operation of a website, personal data must be collected and stored for technical reasons when you visit the website, in particular:

  • the IP address used by your device
  • date and time of the website visit
  • previously visited websites
  • used web browser
  • the operating system for providing and visualizing the website
  • as well as other aspects of the technical operation of the website

The above data is stored to ensure the functionality and security of our website. The legal basis for the temporary storage of this data is Art. 6 (1) lit. c. GDPR in conjunction with § 25 (2) TTDSG (legal obligation).

You have the option of creating a candidate profile. When you create a candidate profile, your email address, first name, last name, country/region of residence and phone number are stored.

 

Which cookies are used?

In order to operate this website and provide you with our services in a more personalized way, grenke uses cookies in some areas. Cookies are identifiers (small text files) that a web server can send to your computer to identify it for the duration of your visit. They also serve to control the internet connection during your visit to our website and for technical analysis of the website. Depending on your cookie settings, cookies are sometimes only stored by your browser for the duration of your visit to the website, but sometimes for a longer period.

Generally speaking, you can set your browser to display cookies. You can also set your browser to notify you when you receive a cookie or to reject cookies. Furthermore, most browsers allow you to delete individual cookies or all cookies that have been set.

The following information is about the cookies used on this website. These are categorized as follows:

Necessary cookies

Necessary cookies are those that are used to ensure the secure and stable operation of the site. These include, among other things, cookies that a load balancing server sets for the respective session. The website cannot function properly without these cookies. The legal basis for the processing of the data is Art. 6 para 1 lit. c GDPR in conjunction with Section 25 (2) TTDSG (legal obligation).

Advertising cookies

Advertising cookies allow us to provide you with optimized and personalized content on our website. These cookies are only active if you have given us your prior consent. The legal basis for the data processing is Art. 6 para. 1 lit. a GDPR (consent).

 

What data is processed when registering for the job newsletter and for contacting you about career opportunities?

If you are interested in our job newsletter, you have the option of creating a candidate profile and registering for the newsletter. Only candidates with a candidate profile can register for the newsletter. When you create a candidate profile, your email address, first name, last name and country/region of residence are stored.

When you register for the newsletter, we store your email address as well as the date and time of registration.

When the newsletter is sent, your email address as well as the date and time of sending are also stored.

You can unsubscribe from the newsletter at any time by clicking on the unsubscribe link contained in the emails and in your candidate profile by clicking on “Options- Job Notification”. By unsubscribing, you revoke your consent and thus your email address will no longer be used.

The legal basis for the processing of the data is Art. 6 Para. 1 lit. a GDPR (consent).

 

For what purposes and on what legal basis do we process your data?

We will only process your data as part of the application process to the extent permitted by applicable law. In doing so, we will base the processing of your personal data on the following legal principles, among others:

For the decision on the establishment of the employment relationship: We process your data primarily for the purpose of establishing or initiating an employment relationship on the basis of Art. 6 para 1 lit. b in conjunction with  Art. 88 para. 1 GDPR and § 26 para. 1 BDSG.

To fulfill legal obligations: We process your data to fulfill legal obligations. In this context, we therefore process data for fraud prevention, to fulfill social security and tax control, reporting or documentation obligations.

On the basis of your consent: If you voluntarily provide us with special categories of personal data, we will only process these on the basis of your consent. The legal basis for this is Art. 9 para 2 lit. a in conjunction with Art. 88 para 1 GDPR and Section 26 (2) BDSG.

To protect legitimate interests: In individual cases, we process your data to protect the legitimate interests of grenke or third parties. A legitimate interest exists, for example, if your data is required to assert, exercise, or defend legal claims as part of the application process (e.g. claims under the German General Equal Treatment Act). In these cases, data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

 

To whom is my data transmitted?

Within the company, only those departments that are involved in the preparation and execution of the application process receive your data. These include employees from the human resources department and the departments in which open positions are to be filled.  During the application process, you can choose from three options for the extent to which we can use your data:

  • Consider your application only for the position for which you have applied;
  • Consider your application for open positions in the entire country of your residence;
  • Consider your application for open positions worldwide.

In addition, we will use service providers in individual cases who may process data on our behalf and in accordance with our instructions for the aforementioned purposes.

For job interviews with candidates via video conference or online meeting, we use WebEx, Microsoft Teams, Zoom.

We process your applicant information in the applicant portal SuccessFactors of the service provider SAP.

Whenever your personal data is transferred to external recipients who process this data on our behalf, we will ensure by contract that your data is transferred, protected and processed in accordance with all applicable data protection regulations.

You can find the data protection information of our service providers here:

Link Microsoft Corporation: https://www.microsoft.com/en-gb/privacy/privacystatement

Link WebEx by Cisco Systems, Inc.: https://www.cisco.com/c/en/us/about/legal/privacy-full.html

Link SAP: https://www.sap.com/about/legal/privacy.html

Link Zoom Communications, Inc.: https://www.zoom.com/de/trust/privacy/privacy-statement/

 

How long will we store your data?

We will store your personal data in accordance with the legal requirements.

Storage during the application process: If necessary, we will store your data for the duration of the application process. The specific storage period is based on the applicable legal requirements.

If an employment relationship is established: If we establish an employment relationship with you following the application process, we will transfer your data to the personnel file and delete it after taking into account the applicable statutory retention periods.

If your application is rejected: If no employment relationship is established between us, the application process ends with the receipt of a rejection. We store your data for a limited period of time after completion of the application process (in particular for legal defense purposes). The specific storage period depends on the applicable legal requirements.

Maintaining your candidate profile: Your applicant profile will be deleted if there has been no activity for a defined period of time. The duration of this period is based on the applicable legal requirements.

 

Is data transferred to a third country or an international organization?

Generally, the transfer of your data to third countries is not intended as part of the application process.

If we transfer your data to third countries outside the European Union (EU) or the European Economic Area (EEA) in accordance with the explanations above, we ensure before the transfer that, except for legally permitted exceptions, the recipient either has an adequate level of data protection or you have consented to the data transfer. An adequate level of data protection can be ensured, for example, by concluding EU standard contractual clauses, the existence of an adequacy decision by the EU Commission, or so-called Binding Corporate Rules (BCR).

It cannot be excluded that your data may be transmitted to a server in the USA and stored there. The US parent company of Microsoft Corporation, Cisco Systems, Inc. and Zoom Communications, Inc. are certified under the EU-U.S. Data Privacy Framework, the relevant certificate can be found here: https://www.dataprivacyframework.gov/list.

 

What rights do I have?

As a data subject, you have a wide range of rights under the GDPR. Specifically, these are:

Information: You have the right to receive information regarding your saved personal data.

Rectification and deletion: You can request that we rectify incorrect personal data and that we delete your personal data.

Restriction of processing: You can request that we restrict the processing of your personal data.

Data portability: If you have provided personal data to us based on a contract or consent, you can request to receive the personal data you have provided in a structured, commonly used, and machine-readable format, or request that we transmit it to another controller.

Objection to data processing based on the legal grounds of “legitimate interest”: You have the right to object to our data processing at any time for reasons related to your specific situation, if the processing is based on “legitimate interest” as the legal grounds. If you make use of your right to object, we will halt processing of your personal data unless we have mandatory, protected reasons to continue processing the data that outweigh your rights.

Objection to cookies: You can also object to the use of cookies at any time.

Revocation of consent: If you have granted us consent to process your personal data, you can revoke this consent at any time with future effect. The legality of processing of your personal data carried out up to the time of consent will remain unaffected.

Submission of complaints to a supervisory authority: You can also submit a complaint to the responsible supervisory authority if you believe that your personal data has been processed in an illegal manner. To do so, please contact the Data Protection Authority responsible for your place of residence or state, or the Data Protection Authority for the state of Baden-Württemberg, which is responsible for our company:

State Officer for Data Protection and Freedom of Information

Heilbronner Straße 35

70191 Stuttgart

Phone.: +49 (0) 711 / 615541-0

Fax: +49 (0) 711 / 615541-15

Mail: poststelle@lfdi.bwl.de

 

Am I obliged to provide data?

We require the above personal data in order to decide whether we wish to establish an employment relationship with you. Without this data, we cannot carry out the application process. However, there is no legal obligation to provide this data as part of the application process.

 

To what extent does automated decision-making take place in individual cases?

We do not use any purely automated processing for decision-making as part of the application process.

 

Status: October 2026 | This declaration may be subject to change in the future. Please ensure that you stay regularly informed of the current version.