Data protection

We process and store your data for as long as required for our processing purposes, for the statutory retention periods, for documentation and evidence purposes in line with our legitimate interests, or when technical constraints necessitate storage. Technical constraints might require storage if specific personal data cannot be separated from other data and must be retained together (e.g. in the case of backups or document management systems).

The statutory retention period is usually 10 years. Shorter retention periods may apply for some types of data, such as telephone or video surveillance recordings, for example, or automated data processing logs.

In the case of job applications, this Privacy Statement will be deemed accepted by the applicant and authorises us to retain all data even after a rejection for future reference in the case of a new application. Data from job applications will be retained for no more than one year, after which time it will be destroyed.

Longer retention periods may apply in the case of accidents or certificates of loss. Documentation and evidence purposes include our interest in documenting processes, interactions and other facts relating to legal claims, discrepancies, IT and infrastructure security purposes, and evidence of good corporate governance and compliance. 

Once your data is no longer required for the above purposes, it will be deleted or anonymised.

To make it easier for you to control the processing of your personal data, you have the following rights in connection with our data processing, provided that the relevant legal requirements are met and there are no reasons for a restriction or deferral: 

The right to request confirmation of whether we process personal data concerning you and information about this data 

• The right to request rectification of incorrect data 
• The right to request that your data be erased 
• The right to obtain from us the personal data concerning you in a commonly used electronic format or to transmit this data to another controller 
• The right to withdraw your consent with effect for the future, where our processing is based on your consent 
• The right to receive, on request, further information necessary for the exercise of these rights. 

Please note that we may need to process and store your personal data in order to fulfil a contract with you, to protect our own legitimate interests, such as the exercise or defence of legal claims, or to comply with legal obligations. To the extent permitted by law, in particular to protect the rights and freedoms of other data subjects and to protect legitimate interests, we may therefore also reject a data subject’s request in whole or in part (e.g. by redacting certain content that concerns third parties or our business secrets). 

To exercise any of the above rights, please contact the persons named in 2 of the privacy statement. To enable us to rule out misuse, we must identify you (e.g. with a copy of an official identification document, e.g. ID or passport, on which unnecessary information can be redacted).