Privacy policy for applicants

1. Responsible Party

The responsible party pursuant to Art. 4 VII GDPR is Vesterling AG, represented by the board members Martin Vesterling (Chairman), Dr. Eva Vesterling and Georg Ruëff, Elsenheimerstrasse 49, 80687 Munich, telephone: 089/4111140, e-mail: Welcome@Vesterling.com

2. Applicant Profile

We intend to create an applicant profile for you and include it in our database. The data will only be passed on to third parties with the applicant’s consent. For this reason, we process your personal data. The categories of personal data processed include, in particular, your master data (such as first name, surname, name affixes), contact data (such as private address, mobile phone number, telephone number, e-mail address), all data resulting from your application documents (including health data, if included) and, if applicable, bank details (to reimburse travel expenses).

As a rule, your personal data is collected directly from you as part of the application process. We also process personal data that we have legitimately obtained from publicly accessible sources (e.g. professional networks). In the event of inconsistencies in your application documents regarding previous employment relationships or other legitimate interests, we may also process references that we obtain from previous employers.

3. Purposes and Legal Basis of Data Processing

We process your personal data in compliance with the provisions of the GDPR, the Federal Data Protection Act (BDSG – new) and all other relevant laws. The data processing serves exclusively to include your applicant profile in our database, to decide on the placement in an employment relationship and the placement itself. The legal basis for this is Art. 6 para. 1 lit. b) GDPR. You are entitled to withdraw this consent at any time.

In addition, your separate consents pursuant to Art. 6 para. 1 lit. a), 7 GDPR may be used as data protection regulations.

If your application documents contain photographs, we consider this to be implied consent to the processing of the photo. The legal basis is therefore Art. 6 para. 1 lit. a) in conjunction with Section 26 para. 2 BDSG 2018. You are entitled to withdraw this consent at any time.

Insofar as special categories of personal data (in particular health data, e.g. a severe disability) are processed in accordance with Art. 9 I GDPR, this serves exclusively to fulfill our obligations under § 164 SGB IX as part of the application process.

If we wish to process your personal data for a purpose not mentioned above, we will inform you of this in advance and of the legal basis for this.

4. Disclosure of Data

Within our company, your personal data will only be disclosed to the persons and departments responsible for this. These are our employees in the recruitment department. Your applicant profile will – if a check shows a match and you consent to the respective transfer – be passed on to suitable customers so that their responsible departments can check your data to see whether you are suitable as an employee for the company of our respective customer. Service providers employed by us and acting on our behalf (so-called processors, cf. Art. 28 GDPR) may also process data for these purposes. We do not transfer any personal data to third parties outside the European Economic Area (EEA).

5. Application for Internal Positions

Vesterling is the personnel consultancy for technology. We would be delighted if you would like to become part of our team and apply for a position in our company. In addition to filling technology positions, our clients regularly ask us to fill comparable positions in the areas of HR, Finance and Office as well as positions for university graduates with our internal positions.

We therefore do not differentiate between internal and external positions when processing your application. We match your application with all possible positions in order to provide you with the best possible support in achieving your career goals.

6. Disclosure of Pseudonymized Data

We provide potential employers with applicant data in pseudonymized form. The data includes job types (e.g. software development), leadership (yes/no), skills (e.g. JAVA), professional experience in years, zip code area (e.g. DE-80), language skills (e.g. DE, EN), highest educational qualification (e.g. A-levels) and salary bracket (e.g. > €100,000). The aim is to provide you with suitable job offers after comparing the requirements of potential employers.

Your contact details will only be passed on to potential employers in an identifying manner if you have given your express consent again following a specific inquiry. Your non-pseudonymized contact data and your complete profile will therefore only be passed on to the potential employer if you give your consent again after we have asked you to do so.

7. Storage Period

If there is no statutory retention period, the data will be deleted as soon as storage is no longer necessary or the legitimate interest in storage has expired. In individual cases, individual data may be stored for a longer period (e.g. travel expense reports, proof of successful placements). The duration of storage may then depend on the statutory retention obligations, e.g. from the German Fiscal Code (6 years) or the German Commercial Code (10 years), if applicable.

If you have given us your permission to store your personal data beyond the application process for a specified period, this retention period applies.

8. Recommendation Campaign

In the online application form, you can indicate who recommended Vesterling to you. The referrer will then receive a monetary bonus under certain conditions (including your referral by Vesterling). We would like to point out that the person recommending you will become aware of the fact that you have been referred when they receive the bonus. 9. Data Protection Rights

9. Data Protection Rights

You have the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure.

10. Right of Appeal

There is a right of appeal to the Bavarian State Office for Data Protection Supervision, Promenade 27 (Schloss), 91522 Ansbach, telephone: +49 (981) 53 1300, fax: +49 (981) 53 98 1300, e-mail: poststelle@lda.bayern.de as the competent data protection supervisory authority (Art. 77 DS-GVO in conjunction with § 19 BDSG).

11. Automated Individual Case Decisions or Profiling

We do not use purely automated processing to make a decision – including profiling – on the establishment of an employment relationship.

Vesterling draws the applicant’s attention to the fact that he/she can revoke the consent to data processing hereby granted at any time. The revocation can be made in text form. Data processing shall remain permissible until Vesterling receives the revocation. The same applies to data processing on the basis of other permissions after receipt of the revocation.

Validity

The current privacy policy is valid from June 25, 2025.