Data privacy statement | Career-Portal | MHP Management- und IT-Beratung GmbH

Privacy Policy for personnel marketing, the application process at Porsche AG and the electronic application system of the Porsche Group

We, Dr. Ing. h.c. F. Porsche AG (hereinafter referred to as "we" or "Porsche AG"), are pleased that you are interested in our online offer (hereinafter referred to as the "Online Offer"). We take the protection of your personal data very seriously. The processing of your personal data is carried out exclusively within the framework of the legal provisions of data protection law, particularly the General Data Protection Regulation (hereinafter referred to as "GDPR"). With this privacy policy, we inform you about the processing of your personal data and about your data protection rights in the context of personnel marketing, when applying for jobs at Porsche AG and in relation to the use of the eRecruiter and the Job Locator under https://jobs.porsche.com/ (hereinafter referred to as the "electronic application system"). For information on the processing of personal data in other areas, please refer to the respective specific privacy statement.

If we refer to this data protection declaration from external social media profiles, the following explanations only apply to the extent that the processing takes place in our area of responsibility and unless more specific and therefore priority information on data protection is provided in the context of such social media profiles.

1. Controller and Data Protection Officer

The person responsible for data processing within the meaning of the data protection laws is:

Dr. Ing. h.c. F. Porsche AG

Porscheplatz 1

70435 Stuttgart

Germany

Phone: (+49) 711 911-22911

If you have any questions or suggestions about data protection, please feel free to contact us. You can contact our data protection officer as follows:

Dr. Ing. h.c. F. Porsche

Data Protection Officer

Porscheplatz 1

70435 Stuttgart

Germany

Contact: https://www.porsche.com/privacy-contact/

The electronic application system is a central portal for the Porsche Group. In this respect, we are jointly responsible with the following other Porsche AG Group companies:

Porsche Logistik GmbH
Porsche Leipzig GmbH
Porsche Dienstleistungs GmbH
Porsche Deutschland GmbH
Porsche Engineering Services GmbH
Porsche Engineering Group GmbH
Porsche Consulting GmbH
Porsche Lifestyle GmbH & Co. KG
Porsche Financial Services GmbH
Porsche Werkzeugbau GmbH
Porsche Niederlassung Stuttgart GmbH
Porsche Niederlassung Berlin GmbH
Porsche Niederlassung Berlin-Potsdam GmbH
Porsche Niederlassung Hamburg GmbH
MHP Management- und IT-Beratung GmbH
MHP Consulting Romania SRL
MHP Consulting UK Ltd.

With regard to the common processes for the electronic application system, we determine the purposes and means of the processing of personal data together with the respective group companies.

In an agreement on joint responsibility pursuant to Article 26 GDPR with the relevant Group companies, we have defined the structure of the respective tasks and responsibilities in the processing of personal data and who fulfils which obligations under data protection law. In particular, we have determined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with data protection information obligations and how we can monitor potential data protection incidents. This also includes ensuring that we can ensure that we comply with our reporting and notification obligations.

In the role of technical operator, Porsche AG is available to you as a central point of contact with regard to the electronic application system (e.g. for questions regarding the management of your application account). You can exercise your rights in relation to the processing under joint control, but also against a group company with joint controllership. If you contact us, we will coordinate with the relevant group companies in accordance with Article 26 GDPR in accordance with the aforementioned agreement in order to answer your enquiry and guarantee your rights as a data subject.

If you submit your application using the electronic application system, the content of the application will only be available to the company to which you have specifically applied. You can view the specific data protection notice of the respective company for the application process by clicking on the company listed above. Accordingly, the respective company to which you have applied is available as a contact person with regard to the processing of your specific application. In this sense, with regard to the specific application process, the company to which you have applied is the sole controller. This is us if you have applied to Porsche AG.

2. Subject of data protection

The subject of data protection is the protection of personal data. This is any information relating to an identified or identifiable natural person (so-called data subject). This includes information such as name, postal address, e-mail address or telephone number, but also other information that arises in the course of the application process, such as information about your qualifications, education or professional stations.

3. Purposes and legal bases of data processing

Below you will find an overview of the purposes and legal bases of data processing in the context of personnel marketing and in the context of the application process at Porsche AG. In any case, we process personal data in accordance with the legal requirements, even if a different legal basis is relevant in individual cases than stated below.

If an employment relationship is established with you, further data processing is based on the data protection declaration for the employment relationship.

The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and what possible consequences the non-provision would have (e.g. loss of claims or our indication that you will not provide the requested service without providing certain information). The use of the online offer is generally possible without registration. The use of individual services and functions may require prior registration. Even if you use our online offer without registration, personal data may still be processed.

3.1 Fulfilment of contractual and pre-contractual obligations

We process your personal data if this is necessary for the implementation of the application process and, if necessary, for the preparation of an employment relationship with you. Data processing is carried out on the basis of Article 6 (1) (b) GDPR.

We process personal data as far as this is necessary for the implementation of the application process and, if applicable, the preparation of an employment relationship with you. The purposes include in particular:

Registration and review of the application

Application management and implementation of the selection process (forwarding to the responsible internal functions, organization and implementation of job interviews, administration and administration of the filling of vacancies)

Organization and implementation of selection days and tests for specific application procedures, such as the trainee program, vocational training or general application days

For internal applicants for internal programs: application management and implementation of the selection process

If an employment relationship is not established, your data will be anonymized by us after four months, unless another legal basis applies. If the latter applies, we anonymize the data after the other legal basis ceases to apply. A conclusion about your person can then no longer be drawn. The data processing after anonymization takes place only for statistical evaluation purposes.

3.2 Fact check

We conduct a review of your personal data to ensure that prospective employees perform their duties without conflicts of interest, in compliance with high ethical standards, and that they are committed to the company's principles.

The verification of personal data includes your personal data (surname, first name, date of birth, address) and the presentation of your identity card in the original or a comparable document proving identity, the submission of your certificates in the original (in particular the last graduation certificate of the highest level of education) or an officially certified copy thereof in paper form. In addition, it will be checked whether you have already been employed by Porsche AG and - limited to this case and in compliance with data protection regulations - whether written disciplinary measures have been imposed on you in the last three calendar years. For this purpose, personal data is requested in the existing personnel file for the past three calendar years. In addition, a comparison with publicly available EU sanctions lists is carried out in accordance with Regulations (EC) No. 2580/2001 and 881/2002 as well as the amendments issued and issued thereto by the European Commission. Only if necessary, will you be asked to present an original residence permit, severely disabled person's ID card or certificate of good conduct (background check).

The fact check is carried out by the responsible HR department and, if necessary, by the HR Compliance & Employment Law department. Only a limited group of people has access to your data internally. In the event of conspicuous findings as part of the fact check, the results are discussed in a committee (department, human resources department, works council). The result of the consultation is documented and stored in the personnel file. In the case of new hires in the collective bargaining agreement, the completed checklist for fact checking is stored in the personnel file and remains there in accordance with the deletion period for relevant personnel documents and data. No other data storage or processing takes place. The fact-checking checklist is deleted from the personnel file after four months for external candidates who have not been hired, and after three years of storage for all other cases.

The processing of your personal data for the purpose of establishing an employment relationship is necessary within the meaning of Art. 6 para. 1 lit. b) of the General Data Protection Regulation (GDPR), as we have a legitimate interest in employing persons who have integrity and act in accordance with the applicable law. The contents of the fact check are also regulated in a general works agreement.

The provision of the data is necessary for the conclusion of a contract.

3.3 Job Subscription

To subscribe to the "Job Subscription" newsletter, it is sufficient to enter your e-mail address and indicate how often you would like to receive the "Job Subscription" newsletter. Newsletters will only be sent after registration, i.e. with your consent based on Article 6 (1) (a) GDPR. If the contents of the "Job Abo" newsletter are specifically described in the context of a registration, these are decisive for the scope of the consent. In addition, the "Job Abo" newsletter contains information about your entry opportunities at Porsche AG and other Group companies.

Registration is carried out by means of the so-called double opt-in procedure, i.e. After your registration, you will receive an e-mail asking you to confirm your registration to prevent misuse of your e-mail address. The registrations are logged by us to be able to prove the registration process and the consent contained therein in accordance with the legal requirements. The logging of the registration and the necessary processing of the data entered by you during registration is accordingly carried out based on legitimate interests in accordance with Article 6 (1) (f) GDPR. You can withdraw your consent to receive the "Job Abo" newsletter at any time, e.g. by unsubscribing from the newsletter. An unsubscribe link to exercise this right can be found at the end of each newsletter.

3.4 Application account

The purpose of the application account is to enable you to send and manage your application to us or other Group companies via the electronic application system or to monitor job offers. We recommend that you use the application account, as the internal processes and the implementation of the application process at Porsche AG as well as at the other Group companies are tailored to this. Even if you send us your application by another means, the application will be scanned as part of our internal processes and the information will be processed electronically (see section 3). You will then receive your paper documents back by post.

If you want to set up an application account, registration is required. During registration and login, your registration details (username and password) will be collected and processed.

You have the option of setting up an applicant profile as part of the application account. You can use an online questionnaire to enter or upload your personal data (e.g. title, title, surname, first name, date of birth, place of birth, country of birth, nationality, address, telephone number, e-mail address), your qualifications (e.g. educational background, professional experience if applicable, language skills, IT skills), your application documents (e.g. letter of motivation, application documents) and other application information (e.g. salary expectations, availability, if applicable). Corresponding mandatory fields are marked in the online questionnaire.

This data is processed on the basis of Art. 6 (1) (b) of the General Data Protection Regulation (GDPR) in order to create your application account with your applicant profile for the purpose of carrying out the respective application process and – if your consent has been obtained – as part of the review of your application in the Porsche Group or the Talent Pool on the basis of Article 6 (1) (a) GDPR.

If you delete your application account, your user profile will also be deleted. Regarding the deletion of data relating to specific applications to Porsche AG, the provisions under Section 3 apply. About the deletion of the data of specific applications to other Group companies, the provisions of the corresponding data protection notice apply (see Section 1).

3.5 Fulfilment of legal obligations

We also process your personal data to comply with legal obligations to which we are subject. The obligations can arise, for example, from commercial, tax, money laundering or financial law. Measures in the area of health management and aptitude tests can also result from legal obligations. The purposes of the processing result from the respective legal obligation; the processing usually serves the purpose of complying with government control and information obligations.

Data processing is carried out based on Article 6 (1) (c) GDPR. In this respect, we process the personal data that is necessary for the fulfilment of the legal obligation.

We delete the data after the legal obligation ceases to apply and if no other legal basis applies. If the latter applies, we will delete the data after the other legal basis no longer applies.

3.6 Safeguarding legitimate interests

We also process your personal data to protect the legitimate interests of us or third parties, unless your interests, which require the protection of your personal data, outweigh them. Data processing is carried out on the basis of Article 6 (1) (f) GDPR. The processing for the purpose of safeguarding legitimate interests is carried out for the following purposes or for the protection of the following interests.

Operational reportings

Implementation and optimization of personnel marketing and the recruitment process (implementation of consulting in personnel marketing, applicant surveys and statistical evaluations)

When you access the online offer, data relating to your device and your use of the online offer will be processed and stored in a so-called log file. This applies to technical data such as date and time of access, duration of the visit, type of device, operating system used, functions used, amount of data sent, IP address and referrer URL. We process this data to ensure technical operation and to identify and eliminate faults. In doing so, we pursue the interest of ensuring the technical functionality in the long term. We do not use this data for the purpose of drawing conclusions about your person.

3.7 Consent

We process your personal data because of appropriate consent. Data processing is carried out on the basis of Article 6 (1) (a) GDPR. If you give your consent, it is always for a specific purpose; the purposes of the processing result in each case from the content of your declaration of consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on your consent before its revocation.

If you have given your consent for certain purposes, such as reviewing your application in other Group companies, being accepted into a talent pool or receiving the "Job Abo" newsletter, the purposes result from the content of this consent given in each case.

We use the so-called "double opt-in procedure" to prevent cases of abuse to send the newsletter.

Data processing is carried out on the basis of Article 6 (1) (a) GDPR. You can withdraw your consent at any time without giving reasons, without affecting the lawfulness of the processing carried out because of your consent before its withdrawal.

We will delete the data if you have withdrawn your consent and no other legal basis applies. If the latter applies, we will delete the data after the other legal basis no longer applies.

3.8 Change of purpose

To the extent that we process your personal data for a purpose other than that for which the data was collected beyond a corresponding consent or a mandatory legal basis, we take into account the compatibility of the original purpose and the purpose now being pursued, the type of personal data, the possible consequences of further processing for you and the guarantees for the protection of the personal data in accordance with Article 6 (4) GDPR.

3.9 Profiling

We do not carry out automated decision-making or profiling in accordance with Article 22 GDPR. A profile is only created to protect our legitimate interests as described above.

4. Access permissions in the end device

Some functions of our online offer require the granting of authorization to access your device (e.g. access to location data). The granting of authorizations is voluntary. However, if you want to use the corresponding functions, the granting of the appropriate permissions is required, otherwise you will not be able to use these functions. The permissions remain active as long as you have not reset them in your device by deactivating the respective setting.

5. Cookies and similar technologies

In the context of the online offer, we use cookies and comparable technologies that serve to communicate with your device and exchange stored information (hereinafter collectively referred to as "cookies"). These cookies are primarily used to make the functions of the online offer usable. General examples in which the use of cookies in this sense is technically necessary are the storage of a language selection, login data or a shopping or watch list. Accordingly, we may use technically necessary cookies to enable the processing described in Section 3.1 and to ensure the proper and secure operation of the online offer. The data processing is then carried out on the basis of Article 6 (1) (b) and (f) GDPR, as it is necessary to implement the functions you have selected or to safeguard our legitimate interest in the functionality of the online offer.

Insofar as we should also use cookies to analyze the use of the online offer and to be able to target your interests and, if necessary, also to be able to provide you with interest-based content and advertisements, this is done exclusively on the basis of your voluntary consent in accordance with Article 6 (1) (a) GDPR. You then have the option of making your corresponding settings via consent management as part of the online offer. You can withdraw your consent at any time with effect for the future. Further information on cookies and their function in detail, as well as on setting and revocation options, can be found directly in the corresponding areas of consent management. Please note that we only provide consent management as part of the online offer if consent-based cookies are to be used in addition to the technically necessary cookies mentioned above.

If you do not want the use of cookies altogether, you can also prevent their storage by making the appropriate settings on your device. You can delete stored cookies at any time in the system settings of your device. Please note that blocking certain types of cookies may lead to impaired use of our online offer.

In addition, we use other technologies that, similar to cookies, serve to ensure the secure and user-friendly usability of the website (e.g. by protecting against misuse or evaluating usage). Technically, these other technologies differ from cookies because they do not store any information on your device or access information that has already been stored there. Insofar as data that is subject to data protection law (e.g. IP addresses) is processed by these other technologies, we process this data on the basis of Article 6 (1) (b) and (f) GDPR for the provision of the website, to ensure technical operation and for the purpose of identifying and eliminating faults. We also pursue the interest of ensuring the technical functionality of the website in the long term, improving performance and optimizing the user experience. When our website is accessed, this data is automatically processed. Without providing the data, you will not be able to use our website. We do not use this data for the purpose of drawing conclusions about your person or your identity.

6. Integrated third-party services

As far as we integrate services from other providers as part of our online offer to offer you certain content or functions (e.g. playing videos or route planning) and we process personal data in the process, this is done on the basis of Article 6 (1) (b) and (f) GDPR. This is because the data processing is then necessary to implement the functions you have selected or to safeguard our legitimate interest in an optimal range of functions of the online offer. As far as cookies may be used in the context of these third-party services, the explanations under section 5 apply. Regarding third-party services, please also refer to the privacy policy of the respective provider.

Services of other providers that we integrate or refer to are provided by the corresponding third parties. In principle, third-party services also include offers from other Porsche AG Group companies and Porsche Centers. In principle, we have no influence on the content and function of the third-party services and are generally not responsible for the processing of your personal data by their providers, unless the third-party services are designed entirely on our behalf and then integrated by us under our own responsibility. Insofar as the integration of a third-party service leads to us establishing joint processes with its provider, we determine with this provider in an agreement on joint responsibility in accordance with Article 26 GDPR how the respective tasks and responsibilities in the processing of personal data are structured and who fulfils which obligations under data protection law. If cookies are also to be set based on your consent, you can also find further information on the responsibility for the setting of these cookies or any associated third-party services in the corresponding areas of consent management.

Unless otherwise stated, profiles on social media are generally only integrated into our online offer as a link to the corresponding third-party services. After clicking on the embedded text/image link, you will be redirected to the offer of the respective social media provider. After the transfer, personal data may be collected directly by the third-party provider. If you are logged into your user account of the respective social media provider during this time, they may be able to assign the information collected from the specific visit to the personal user account. If you interact via a "share" button of the respective social media provider, this information can be stored in the personal user account and published if necessary. If you want to prevent the collected information from being directly assigned to your user account, you must log out before clicking on the embedded text/image link.

7. Recipients of personal data

Within our company, only those persons have access to your personal data who need it for the purposes stated in each case. We only pass on your personal data to external recipients if there is a legal permission to do so or if we have your consent. Below you will find an overview of the corresponding recipients:

Processors: Group companies or external service providers, in particular the companies DAG Engineering GmbH (support with application administration and staffing of the applicant hotline), Randstad Sourceright GmbH (support with personnel recruiting and recruitment processes) and MHP - Management- und IT-Beratung GmbH (support of the electronic application system). These processors are carefully selected by us and regularly audited to ensure that your privacy is respected. The service providers may only use the data for the purposes specified by us.

Public bodies: Authorities and state institutions, such as tax authorities, public prosecutor's offices or courts, to which we (have to) transmit personal data, e.g. to comply with legal obligations or to protect legitimate interests.

Private entities: Group companies, Porsche dealers and service companies, cooperation partners, service providers (not bound by instructions) or commissioned persons such as Porsche Centers and Porsche Service Centers, financing banks, credit agencies or transport service providers.

8. Data processing in third countries

If a data transfer takes place to bodies whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we ensure before the transfer that the data transfer is covered by either a legal permission there are guarantees for an adequate level of data protection with regard to the data transfer (e.g. through the agreement of contractual guarantees, officially recognized regulations or binding internal data protection regulations at the recipient) or you have given your consent to the data transfer.

As far as the data transfer is carried out on the basis of Article 46, 47 or 49 (1) subparagraph 2 GDPR, you can obtain a copy of the guarantees for the existence of an adequate level of data protection with regard to the data transfer from us. Please use the information under section 1 for this purpose.

9. Storage period, deletion

If there is legal permission to do so, we will only store your personal data for as long as is necessary to achieve the purposes pursued or as long as you have not withdrawn your consent. In the event of an objection to the processing, we will delete your personal data, unless further processing is still permitted by law. We also delete your personal data if we are obliged to do so for other legal reasons. Using these general principles, we will usually delete your personal data without undue delay

after the legal basis has ceased to exist and unless another legal basis (e.g. retention periods under commercial and tax law) applies. If the latter applies, we will delete the data after the other legal basis no longer applies;

if your personal data is no longer required for the purposes pursued by us and no other legal basis (e.g. retention periods under commercial and tax law) applies. If the latter applies, we will delete the data after the other legal basis no longer applies.

10. Rights of data subjects

Right of access: You have the right to obtain information about the data we have stored about you.

Right to rectification and deletion: You can demand that we correct incorrect data and - provided that the legal requirements are met - delete your data.

Restriction of processing: You can request that we restrict the processing of your data - provided that the legal requirements are met.

Data portability: If you have provided us with data based on a contract or consent, you can request that you receive the data you have provided in a structured, commonly used and machine-readable format or that we transmit it to another controller.

Objection: You have the right to object to data processing by us at any time for reasons arising from your particular situation, insofar as this is based on the protection of legitimate interests. If you make use of your right to object, we will stop processing unless we can prove compelling legitimate grounds for further processing that outweigh your rights and interests.

Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the data processing by us for this purpose. If you make use of your right to object, we will stop processing for this purpose.

Withdraw of consent: If you have given us your consent to the processing of your personal data, you can withdraw your consent at any time with effect for the future. The lawfulness of the processing of your data until the withdraw of your consent remains unaffected.

Right to lodge a complaint with the supervisory authority: You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. To do this, you can contact the supervisory authority responsible for your place of residence or your country or to the supervisory authority responsible for us.

Your contact with us and the exercise of your rights: Furthermore, you can contact us free of charge if you have any questions about the processing of your personal data and your rights as a data subject. Please contact https://www.porsche.com/privacy-contact/ or post to the address given above under number 1. Please make sure that we are able to uniquely identify you. When revoking your consent, you can alternatively choose the contact method you used when giving your consent.

11. State

The most current version of this Privacy Policy applies. As of 01.03.2024

***

Data Protection Declaration