Processing of (personal) data by the entity in charge of the online application process

Data privacy statement

Recruitment and Internal Development
Audi Formula Racing GmbH

General information

This data privacy statement applies exclusively to data collected during the online application process and is designed to instruct you on how we handle any personal data we collect from you during the application process.

Data controller

The data controller under data protection laws is:

Audi Formula Racing GmbH

Heinrichsheimstrasse 200

86633 Neuburg a.d. Donau, Germany

Entry in the Commercial Register

No.: HRB 10855

Court of Registry: Ingolstadt

Personal data during the application process

“Personal data” means information concerning the personal or material circumstances of an identified or identifiable natural person. This includes such information as your name, address, telephone number and date of birth, as well as data about your specific educational and career history, etc. that can be used to identify a specific person with reasonable effort. However, information that cannot be used (in)directly to determine your actual identity does not constitute personal data.

Principles and purposes of processing personal data for applications and the application process

If you use an electronic application process, such as e-mail or our web form, we will collect and process your personal data for the purposes of continuing the application process and taking any pre-contractual measures.

By submitting your application on our recruitment page, you are declaring your interest in employment with our company. In this context, you will be asked to send us personal data that we will use and store only for the purposes of your job search/application.

This includes, but is not limited to, the following data:

Master data (such as name, title, academic degree(s), date of birth, place of birth and nationality, personal contact information [address, phone number, e-mail address], marital status, residence and employment permits, copies of identification documents, photos, languages spoken, family members, and their contact information);

 Application details (such as application and CV, results of background checks (if applicable), information from the job interview, transcripts for specific groups (such as vocational training, dual-study program), test results or Assessment Center);

 Health information (such as occupational medical exams, illnesses, medical aids used, disabilities) if you provide this in your application.

 Notices under data privacy laws (such as declaration of consent to the processing of personal data; withdrawal of any consent you have granted; objections to the processing of personal data; exercising your right of access, right of rectification, right to erasure, right to restriction of processing, or right to data portability including the information that you provide when exercising your rights).

 Relevant information under tax laws regarding your religious affiliation that could identify your religious and philosophical beliefs, if you provide this in your application.

 Information about your marital status (marriage or civil partnership) which could identify your sexual orientation, if you provide this in your application.

You can also upload supporting documents such as a cover letter, your CV, and transcripts/references. These may contain additional personal data.

Only authorized employees from HR or employees involved in the application process will have access to your data.

 The outcome of the application process will determine our retention period for your personal data.

 If you enter into an employment relationship with us, we will process and store your personal data for the term of your employment relationship, which includes dissolving the employment relationship. In this event, you will receive a separate notice about further processing.

 If we reject your application, the application documents will be deleted automatically no later than six months after we notify you of our decision. This will serve to provide evidence in the event of proceedings under AGG (Germany’s General Equal Treatment Act) or other legal disputes. In the event of disputes in court or out-of-court, we will store your personal data for the duration of the proceedings and thereafter in order to meet various retention and documentation obligations pursuant to such laws as the German Commercial Code (HGB) and the German Fiscal Code (AO). These laws require periods of retention or documentation for up to ten years.

 If we store your personal data on the basis of your consent, in order to contact you regarding any new job openings, we will store your data until you withdraw consent or until we no longer deem it necessary to store this data. In the latter case, we will advise you of the deletion.

 Deletion time frames for background checks

 When deciding on external hires or appointments, the basic data from the background check (date, type and whether there are negative findings) is entered for your personal file in the HR administration system and will remain there in accordance with the deletion time frame for relevant HR documents and data (see above). For external applications that do not result in a hire, the basic data will be stored for a six-month period. The full reports of the background check are deleted after six months for external candidates who were not hired; for all other cases they are deleted after three years of retention.

We are then obligated to delete your data or anonymize it. In the latter case, we will have access to the data only as “meta data” without direct personal identification for the purposes of statistical analysis (such as percentage of female vs. male applicants, number of applications each period, etc.)

 General handling of applicant data: 

 We process your personal data for the primary purpose of the application process and to make a decision on whether to enter into an employment relationship with you in accordance with Section 26 para. 1 sentence 1 German Federal Data Protection Act (BDSG). If necessary, we will process your personal data to assess your capacity for work on the basis of Section 22 para. 1 no. 1 c) BDSG. If necessary, we will process additional special categories of personal data (such as data that could identify racial and ethnic origin, political opinions, religious or philosophical beliefs and data that could identify health information or sexual orientation) for the exercise of rights or to fulfill legal obligations under employment law (e.g. the employer’s right of inquiry) under Section 26 para. 3 BDSG. We will also process your contact information in order to send you a link to a survey about the application process. This will help us further improve the application process. The results of the survey will be stored in anonymous form only.

 Sanction list screening:

 At the end of the application process, we will compare your personal data in-house with existing sanction lists (e.g. financial sanctions and terrorism lists) before entering into a pay-scale employment relationship with you.

 Background check: 

 For hires and (internal) appointments to management, hires and (internal) appointments to upper management and for hires and (internal) appointments to the pay-scale group (hereinafter “employment groups”), we will perform a background check in order to uphold the highest compliance and integrity standards for business activities and transactions. It must be ensured that candidates for positions of responsibility at Audi Formula Racing GmbH perform their duties without conflicts of interest and in compliance with high ethical standards, and undertake in good faith to follow the company’s principles in order to minimize legal risks and damage to its reputation.

 The background check and its results help decide whether to enter into an employment relationship or to promote an existing employee. Audi Formula Racing GmbH performs the background check shortly before it decides on a shortlist of candidates for employment.

 Your data collected for this purpose will not be stored, processed or transmitted for any other use.

 Processing personal data in a background check on the aforementioned employee groups is permitted under Section 26 (1) of the German Federal Data Protection Act (BDSG). Section 26 BDSG governs the processing of personal data in the employment relationship and bestows a privilege on data processing of this kind for the relevant purpose, if processing is needed to decide on whether to enter into an employment relationship, etc. Applicants are thus equated with an employment relationship as per Section 26 (8) p. 2 BDSG (employees). Your personal data must be processed for the purposes of entering into an employment relationship in accordance with Section 26 (1) sentence 1 BDSG because Audi Formula Racing GmbH has a legitimate interest in hiring persons who are honest and comply with the applicable laws for the aforementioned management positions. This is ensured by the background check that is performed before you are appointed or hired.

 Scope of background check for pay-scale employees, hires and internal appointments to management as well as internal appointments to upper management: 

 The personal data checks include your master data (name, date of birth, address), qualifications or degrees, your professional experience and, in the event of an existing employment relationship, any regulatory violations of legal or official requirements or any violations of (Group) standards, if not previously investigated. We will also review your prior employment if you were not previously employed with a VW Group company for more than three years. For this purpose, personal data will be queried from the HR file, the whistleblower system and the audit and security database. In order to review any conflicts of interest, you will also be asked to complete a self-assessment questionnaire concerning equity interests or directorships – if relevant to the activity – and PEP lists (politically exposed person).

 Scope of background check for hires to upper management and management:

 Previous employers and other references can also be contacted. To investigate security-related incidents such as violations of criminal law

 (e.g. hiring fraud, white collar crimes, organized crime, violations of fair competition or antitrust laws, violations of other legal requirements or ordinances, insolvency cases and existing conflicts of interest, your master data will also be compared with sanction lists and other public lists and registries, including terrorist and embargo lists as well as PEP (politically exposed persons) lists, along with national and international press and media. Internet searches – including social media (limited to professional networks) – and publicly accessible proprietary databases can also be used for the checks. Audi Formula Racing GmbH uses an external provider for the further investigation of these employee groups.

 The background check is performed by the responsible HR unit, the

 (Corporate) Investigation Office, (Corporate) Security and (Internal) Audit, as well as any providers hired for this purpose. Therefore, your personal master data (name, date of birth, address) will first be sent to the provider. During the background check on you, the provider will compile an information source based on the aforementioned content, without making a final evaluation about you. There is no automated individual-decision making based on this data. The provider will forward the information gathered to a central office at Audi Formula Racing GmbH in Germany.

 For all background checks, only a limited group of persons – those involved in the background check process – in-house will have access to this information collected on you. This group will ensure compliance with the deletion time frame set forth below.

 On request, we will provide you with a copy of the regulations that specifically apply and/or were agreed upon to ensure an adequate level of data protection. Please use the information from the “Contact” section for this purpose.

 If we reject your specific application but wish to retain your application documents to contact you in future regarding other job openings, we will first obtain your consent.

 In the event of any disputes in court or out-of-court with rejected applicants, we will also process personal data to protect our legitimate interests pursuant to Art. 6 (1) (1) (f) of the General Data Protection Regulation (GDPR). In this context, we have a legitimate interest in asserting, exercising or defending against legal claims. If special categories of personal data must be processed, we will do so in accordance with Art. 9 (2) (f) GDPR.

Transmitting data to third parties

The data sent in relation to your application will be transmitted via TLS encryption and stored in a database. This database is operated by Personio GmbH, a provider of HR and applicant management software (https://www.personio.com/legal-notice/). In this context, Personio processes data on our behalf under Art. 28 GDPR. The basis for processing is a contract for data processing on our behalf (as data controller) and Personio.

Data subject rights

If we process personal data as the data controller, as data subject (depending on the legal basis and purpose of processing), you have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), in particular the right of access (Art.15 GDPR), right to rectification (Art.16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to object (Art. 21 GDPR). If personal data is processed on the basis of your consent, under Art. 7 III GDPR you have the right to withdraw this consent under data protection laws.

If you wish to assert your rights as a data subject in regard to the data processed for this online application process, please contact our data protection officer (See Section 2).

Miscellaneous provisions