Privacy policy for employees

P-D Glasseiden GmbH Oschatz, Wellerswalder Weg 17, 04758 Oschatz, e-mail: glasseiden.oschatz@pd-group.com, attaches great importance to the protection of your personal data when processing it in the employment relationship.

In the following, we therefore explain which of your personal data we process and how, based on our privacy policy.

Please contact us or our external data protection officer if you have any further questions. You will find the contact details at the end of this privacy policy.

Personal data

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This includes information such as your name, your address, your telephone number, your location, your e-mail address, your bank details and your date of birth.

Processing of personal data

When processing data, we handle your personal data responsibly and confidentially. Therefore, your personal data will of course be processed in compliance with the applicable national (in particular BDSG) and European data protection regulations (EU General Data Protection Regulation, hereinafter also referred to as “GDPR”).

Processing of personal data in this regard is any operation or set of operations which is performed on personal data, whether or not by automated means. Data processing includes, in particular, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

Purpose of the processing of personal data

We process personal data in accordance with the specifications and requirements set out below as part of automated processing.

The primary legal basis for the processing of personal data in the employment relationship is Section 26 BDSG.

Applicants are considered employees in accordance with Section 26 (8) sentence 2 BDSG.

Under the following conditions, data processing may be carried out in the employment relationship based on the legal authorization basis of § 26 BDSG:

The data processing is necessary with regard to the establishment, performance or termination of an employment relationship or the necessity with regard to the exercise or fulfillment of the rights and obligations of the employee’s representation of interests arising from a law or a collective agreement (purposes under works constitution law) is given.

In addition, data may be processed in the employment relationship to detect criminal offenses in the employment relationship.

It should also be noted that works agreements between the works council and the employer pursuant to Section 26 (4) BDSG are to be regarded as an authorization basis, so that data protection conformity of data processing operations in the employment relationship can also be established by such a works agreement.

All data collected from you is required for the establishment and performance of the employment relationship with you. You are therefore obliged to provide this personal data upon our request when concluding the contract and during the employment relationship, otherwise we will not be able to establish an employment relationship with you.

Automated decision-making in individual cases, including profiling in accordance with Art. 22 GDPR, does not take place.

The scope of the processing of your personal data is limited by the respective purposes described above.

General data processing in the context of the employment relationship

The data is processed and transmitted for wage and salary calculation and compliance with recording, information and reporting obligations, insofar as this is required by law or employment contract obligations. Without this data, we cannot conclude or execute the contract with you. This also applies to all voluntary social benefits provided by the employer and to external education and training programs.

Data processing for the purposes of system administration and security

Due to the applicable legal data security regulations, a range of your data is processed for the administration and security of the system, such as for the administration of user IDs. This includes automatically created and archived text documents (such as correspondence) in these matters. Without this data processing, secure operation of the system and therefore employment in our company is not possible.

Data processing in the event of labor disputes

If a legal dispute arises during an ongoing employment relationship or after termination, the data required for appropriate legal action will be transmitted to legal representatives and courts.

Data transmission within the P-D Group

The primary authorization basis for the transfer of employee data within the P-D Group is Art. 6 para. 1 sentence 1 lit. f GDPR (see below: “Recipients of personal data”).

Legal obligations

With regard to the fulfillment of legal obligations, Art. 6 para. 1 sentence 1 lit. c GDPR is the relevant basis for authorization.

Consent

Your personal data will only be processed by us, unless this is based on a legal authorization basis, if you give your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a DS-GVO in conjunction with. Art. 7 GDPR for this purpose. For this purpose, you have the option of giving your consent voluntarily. There are no disadvantages for you if you do not give your consent. You can request to view your consent at any time and revoke it at any time by sending us an email or by post. The withdrawal of consent does not affect the permissibility of the processing carried out up to the time of withdrawal and also has no disadvantages for you. You can find our contact details above and at the end of this privacy policy.

In the opinion of the legislator, such consent can be given by you in accordance with Section 26 (2) BDSG if a legal or economic advantage is achieved for you (e.g. the introduction of a company health management system to promote health, permission for private use of company IT systems) or if the employer and employee pursue similar interests (e.g. the inclusion of name and date of birth in a birthday list or the use of photos of the employee on the Internet/intranet). Only in these cases will we obtain a declaration of consent from you in compliance with the above requirements.

Application

If you apply for a job with us, the data you provide will be processed by us to check whether we wish to establish and implement an employment relationship with you.

The applicant data entered by you will only be processed until the decision on employment is made if an employment relationship does not materialize. The data will be deleted 6 months after the rejection has been sent or after the application documents have been returned to the applicant.

If we enter into an employment relationship with you, the data that you have provided to us will be processed to establish, implement and, if necessary, terminate the employment relationship.

The basis for authorization is § 26 BDSG new.

Duration of data processing

The maximum duration of storage depends on the purpose of the data processing. The duration of storage depends on the period for which the processing is necessary to fulfill the purpose, in particular with regard to the establishment, implementation or termination of the employment relationship with you, or to fulfill legal obligations (e.g. commercial and tax retention obligations according to § 257 HGB and § 147 AO, social security retention obligations).

After you leave the company as an employee, your data will be deleted under data protection law at the end of the year three years after you leave the company, not counting the year in which you left.

A declaration of consent is generally valid until revoked by the data subject. However, an “unused” declaration of consent may lose its validity after a period of 1.5 years. After a period of 1.5 years in which the consent is not used, the data will be deleted.

Statutory retention obligations remain unaffected by the above.

Recipients of the personal data

Data is transferred within the P-D Group (both between the holding company and its subsidiaries and between the subsidiaries).

The primary authorization basis for data transmission in the P-D Group is Art. 6 para. 1 sentence 1 lit. f GDPR.

Accordingly, data processing is lawful if the processing is necessary for the purposes of the legitimate interests pursued by us, except where such interests are overridden by the interests or fundamental rights of the data subject. In the recitals to the GDPR, which serve as interpretation aids for the GDPR, the legitimate interest for the transfer within a group of companies is specified in recital 48. Accordingly, the transfer within the P-D Group for internal administrative purposes with regard to the processing of employee data is to be qualified as a legitimate interest of ours within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR. Internal administrative purposes relating to employee data in this sense may include central personnel planning and development, the provision of personnel services and travel expense accounting.

Furthermore, P-D Group companies may have access to your personal data in the following systems, insofar as this is necessary, which is legally classified as a transfer:

Payroll accounting system
Electronic time recording system
Travel expense accounting system
Training and further education system
System for processing the company pension scheme
Furthermore, transfers may be made to external third parties if necessary.

The data relevant in each individual case is transmitted to the following bodies on the basis of the statutory provisions or contractual agreement:

Tax office
Social insurance providers
Social welfare offices
Employment agency
Financial institutions
Insurance companies as part of an existing group or individual insurance
Company doctor, employers’ liability insurance association
Travel service providers and their respective subcontractors
Service providers for work clothing
Consulates Third countries

Furthermore, transfers may also be made to other specialist departments within P-D Glasseiden GmbH and other P-D Group companies if this is necessary.

Processors used are contractually obliged to comply with the requirements of Art. 28 GDPR. Processors will only process your data in accordance with the legal requirements and only in the context of fulfilling the contract.

Location of the data processing measures

All processing of your personal data takes place either in Germany or in member states of the European Union. We do not transfer your personal data to countries outside the member states of the European Union (so-called third countries) or other international organizations. If, in individual cases, your personal data is transferred by us to companies in countries outside the member states of the European Union (so-called third countries) or other international organizations, all requirements of Art. 44 et seq. GDPR are complied with.

Security / Technical and organizational measures

We take all necessary technical and organizational measures, taking into account the requirements of Art. 24, 25 and 32 GDPR, to protect your personal data from loss, destruction, access, modification or dissemination by unauthorized persons and misuse.

For example, we comply with the legal requirements for the pseudonymization and encryption of personal data, for the confidentiality, integrity, availability and resilience of systems and services in connection with processing, for the availability of personal data and the ability to restore it quickly in the event of a physical or technical incident, and for the establishment of procedures to regularly review, assess and evaluate the effectiveness of technical and organizational measures to ensure the security of processing.

Furthermore, we also observe the requirements of Art. 25 GDPR with regard to the principles of “privacy by design” (data protection through technology design) and “privacy by default” (data protection through data protection-friendly default settings).

Your rights

You have a right to free information about your personal data and, if the legal requirements are met, a right to rectification, blocking and erasure of your data, to restriction of processing, to data portability and a right to object.

You also have the option of lodging a complaint with the competent supervisory authority.

If you have any questions about the processing of your personal data or questions relating to the aforementioned rights or suggestions, please contact the

Data Protection Coordinator of the P-D Group:

P-D Management Industries-Technologies GmbH

Wilsdruffer Street 11

01723 Wilsdruff / Grumbach district

E-mail: frank.goellnitz@pd-group.com

or to our external data protection officer for the

P-D group of companies pursuant to Art. 37 (2) GDPR:

Dornbach GmbH law firm

Anton-Jordan-Strasse 1

56070 Koblenz