Data Information

The following information is intended to give you an overview of the processing of your personal data by the ALS Group and the rights to which you are entitled under data protection law. In order to fulfil our duty to provide information in accordance with Article 13 GDPR, we would be pleased to provide you with our data protection information below:

The identity and the contact details of the controller:

ALS Holding GmbH

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-Mail: info@als-cs.com

Website: www.als-cs.com

The contact details of the data protection officer:

Montaser Tawalbeh

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-mail: GDPR@als-cs.com

Website: www.als-cs.com

Purpose of processing and legal basis    

We collect, process and use your data for the purpose of information security of ALS Holding GmbH and its subsidiaries. This applies to data that is processed on the occasion of visitor registration, your safety instruction or within the scope of our video surveillance. Your data will be processed on the basis of a legitimate interest (Article 6 Para. 1 f) GDPR).

Categories of personal data

The following data about you may be processed by us: date, surname, first name, company with address, contact person at ALS, number of the visitorpass, time, registration plate, signature, picture or video recording.

Recipients of the personal data

Your data will remain with ALS Holding GmbH and its subsidiaries. However, your data could be processed by trusted third parties.

Your data which is processed by third parties is kept confidential and used for the intended purposes.

Duration of storage

We keep your data, which is collected within the scope of the safety instruction, for two years. We will then delete them or make them anonymous.

Data recorded within the framework of video surveillance is deleted 14 days after recording. They are only stored for a longer period of time if they are still needed for clarification or to prove a specific incident. In this case, the data will be blocked and deleted immediately after the complete completion of the clarification measures or after the requirement for proof has ceased to apply.

The data from the visitor registration will be deleted after eight weeks or, if they are in paper form, will be destroyed in accordance with data protection regulations.

Your rights as a data subject

Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to object 
You have the right to object at any time, for reasons related to your particular situation, to the processing of your personal data carried out on the basis of processing carried out in the public interest and processing carried out on the basis of a balance of interests, including profiling based on this provision.

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
If you are of the opinion that the processing of your personal data is unlawful, you can complain to a supervisory authority.

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Provision of personal data
You are neither legally nor contractually obliged to make your data available to ALS Holding GmbH for the above-mentioned purpose. However, if you refuse to make your data available, ALS Holding GmbH cannot grant you access to its buildings and premises for reasons of information security.

Automated individual decision-making/profiling
An automated decision making (including profiling) does not take place with your data.

Our data protection information on the applicant management system Workday can be found here.

You have come to this page via a link in order to find out about our handling of personal data. In order to fulfil our duty to provide information in accordance with Article 13 GDPR, we would be pleased to provide you with our data protection information below:

The identity and the contact details of the controller:

ALS Holding GmbH

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-Mail: info@als-cs.com

Website: www.als-cs.com

The contact details of the data protection officer:

Montaser Tawalbeh

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-mail: GDPR@als-cs.com

Website: www.als-cs.com

Purpose of processing and legal basis

The data received from you is processed by us only for the purposes for which we received or collected it. In particular, this can be done for the following purposes:

• Communication
• Answers to inquiries
• Initiation and provision of services
• Initiation and execution of contracts

Processing for other purposes can only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR have been met. Information obligations pursuant to Article 13 para. 3 and Article 14 para. 4 GDPR are of course observed.

The legal basis for the processing of personal data is in principle Article 6 GDPR, unless there are specific legal provisions. If personal data is processed on the basis of your consent, you have the right to revoke this consent at any time with effect for the future.

In particular, the following options may be considered:

• Article 6 para. 1 a) GDPR
• Article 6 para. 1 b) GDPR
• Article 6 para. 1 c) GDPR
• Article 6 para. 1 f) GDPR

If processing is carried out on the basis of Article 6 para. 1 f) GDPR, the controller shall pursue the following legitimate interests of himself or third parties: communication if the person concerned is not a direct party to the contract to be initiated or existing. If we process data on the basis of a weighing of interests, you as the data subject have the right to object to the processing of personal data in accordance with Article 21 GDPR.

Categories of personal data

If the controller does not collect your data directly from communication with you and you therefore know what data is involved, please note that the controller regularly processes the following categories of personal data:

• Master data, such as first and last name, professional qualification
• Contact data, such as address, telephone and fax number, e-mail address
• Contents of communication
• Information on the participants, including information on legal representatives and beneficial owners
• Information on the facts of the case, including information on the personal and economic circumstances of the parties involved

Recipients of the personal data

• Controller, in particular the employees of the specialist department
• Processor, i.e. companies which, due to contractual obligations, treat your data exclusively in accordance with the instructions of the responsible party
• Your data could be processed by trusted third parties. However, your data will be kept confidential and used for the intended purposes.

Transfer of data to third countries and to an international organisation

Your personal data will only be passed on to third parties if this is necessary for the execution of the contract with you, if this is permissible on the basis of a weighing of interests pursuant to Article 6 Para. 1 f) GDPR, if we are legally obliged to pass it on or if you have given your consent to this.

Where data is transferred to a third country outside the EU, an adequate level of data protection is ensured by the conclusion of EU standard contractual clauses and/or the recipient's participation in the so-called "Privacy Shield" and the technical and organisational measures taken by the third party with regard to data protection and data security.

Duration of storage

Personal data will only be stored by controller as long it is necessary to pursue the purpose for which it was processed. If the storage of the data is no longer necessary for the fulfilment of contractual or legal obligations and for the pursuit of legitimate interests, i.e. for the preservation of evidence or proof within the scope of the statutory limitation provisions, these will be deleted regularly.

Your rights as a data subject

Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
There is a right of appeal to a data protection supervisory authority. A list of the Germany supervisory authorities and their contact details can be found in the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Right to object
You have the right to object to the processing of your data in connection with direct advertising pursuant to Article 21 para. 1 and para. 2 GDPR if this is done on the basis of a weighing of interests.

If you file an objection, we will no longer process your personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

The following information is intended to give you an overview of the processing of your personal data by the ALS Group and the rights to which you are entitled under data protection law. In order to fulfil our duty to provide information in accordance with Article 13 GDPR, we would be pleased to provide you with our data protection information below:

The identity and the contact details of the controller:

ALS Holding GmbH

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-Mail: info@als-cs.com

Website: www.als-cs.com

The contact details of the data protection officer:

Montaser Tawalbeh

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-mail: GDPR@als-cs.com

Website: www.als-cs.com

Purpose of processing and legal basis

We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR):

a.) Based on your consent (Article 6 Para. 1 a) of the GDPR)
If you have given us your consent to process personal data for certain purposes (e.g. passing on data within the group), the lawfulness of this processing is given on the basis of your consent. Your consent can be revoked at any time. This also applies to the revocation of declarations of consent given to us prior to the application of the General Data Protection Regulation, before 25 May 2018. Please note that the revocation will only take effect in the future. Processing that took place before the revocation is not affected by this.

b.) For the fulfilment of contractual obligations (Article 6 Para. 1 b) of the GDPR)
The processing of personal data is carried out to provide disposal and cleaning services within the framework of the execution of our contracts with our customers or to carry out pre-contractual measures, which are carried out at your request. The purposes of data processing are primarily based on the requirements of the service and may include, but are not limited to, needs assessments and advice. Further details on the purpose of data processing can be found in the respective contract documents and terms and conditions.

c.) As part of the balancing of interests (Article 6 Para. 1 f) of the GDPR)  
If necessary, we process your data beyond the actual fulfilment of the contract to protect the legitimate interests of us or third parties. Examples:

• Review and optimization of procedures for needs analysis and direct customer contact
• Advertising or market and opinion research, insofar as you have not objected to the use of your data
• Assertion of legal claims and defence in legal disputes
• Prevention of criminal offences
• Measures for business management and further development of services and products

d.) Due to legal requirements (Article 6 Para. 1 c) of the GDPR) or in the public interest (Article 6 Para. 1 e) of the GDPR)
As a company, we are also subject to various legal obligations, i.e. legal requirements (e.g. tax law, waste law). The purposes of the processing include, among other things, the fulfilment of control and reporting obligations under tax law as well as the fulfilment of the waste documentation system under waste law, the guarantee of IT security and IT operation, measures for building and plant security (e.g. access controls).

Categories of personal data

We process personal data which we receive from our customers within the scope of our business relationship. If you are our customer as a natural person, this refers to your personal data. If you have been named to us by our customer as a contact person within the framework of the business relationship, we process the personal data that our customer or you have provided to us personally for this purpose (usually name, address and other contact data such as e-mail address, telephone number and function). In addition, we process - to the extent necessary for the provision of our services - personal data which we have received from other companies of the ALS Group or from other third parties (e.g. for the execution of orders, for the fulfilment of contracts or on the basis of your consent).

On the other hand, we process personal data that we have obtained and are permitted to process from publicly accessible sources (e.g. land registers, commercial and association registers, press, media, Internet). Relevant personal data in the interested party process when opening master data are name, address/other contact data (telephone, e-mail address), bank details and function.

Recipients of the personal data

The service providers and vicarious agents employed by us may have access to your data, which they need to fulfil our contractual and legal obligations. These are the companies from the categories listed below:

• Public bodies and institutions (e.g. regional council as waste authority) in the event of a legal or official obligation.
• Subcontractors for disposal and cleaning services.

Under these conditions, recipients of personal data may be: Processors to whom we transfer personal data in order to carry out the business relationship with you. In detail: Processing of subcontractor services, support/maintenance of EDP/IT applications, archiving, document processing, call centre services, compliance services, controlling, data destruction, purchasing/procurement, customer administration, letter shops, marketing, media technology, reporting, spear accounting, telephony, video identification, website management, auditing services, payment transactions.

Other data recipients may be those for whom you have given your consent for data transfer.

Your data could be processed by trusted third parties. Such data processed by third parties is kept confidential and used for the intended purposes.

Transfer of data to third countries and to an international organisation

Data will only be transferred to third countries (countries outside the European Economic Area - EEA) if this is necessary to carry out the internal business process, is required by law or if you have given us your consent.

Duration of storage

We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations. If the data are no longer required for the fulfilment of contractual or legal obligations, they are regularly deleted, unless their - temporary - further processing is necessary for the following purposes:

• Compliance with commercial and tax retention periods: The German Commercial Code (Handelsgesetzbuch) and the German Fiscal Code (Abgabenverordnung) must be mentioned. The periods specified there for storage or documentation amount to up to ten years.
• Preservation of evidence within the framework of the statute of limitations. According to Article 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.

Your rights as a data subject

Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
There is a right of appeal to a data protection supervisory authority. A list of the Germany supervisory authorities and their contact details can be found in the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Provision of personal data
As part of our business relationship, you must provide the personal information necessary to establish and conduct a business relationship and to fulfil the contractual obligations associated therewith, or which we are required by law to collect. Without this data we will normally have to refuse the conclusion of the contract or the execution of the order or will no longer be able to execute an existing contract and may have to terminate it.

Automated individual decision-making/profiling
An automated decision making (including profiling) does not take place with your data.

Information about your right of objection

1. Right of objection in individual cases

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you on the basis of Article 6 para. 1 e) GDPR (data processing in the public interest) and Article 6 para. 1 f) GDPR (data processing on the basis of a weighing of interests); this also applies to profiling based on this provision within the meaning of Article 4 para. 4 GDPR.

If you file an objection, we will no longer process your personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

2. Right to object to the processing of data for advertising purposes

In individual cases we process your personal data in order to operate direct advertising. You have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling in so far as it is connected with such direct advertising.

The following information is intended to give you an overview of the processing of your personal data by the ALS Group and the rights to which you are entitled under data protection law. In order to fulfil our duty to provide information in accordance with Article 13 GDPR, we would be pleased to provide you with our data protection information below:

The identity and the contact details of the controller:

ALS Holding GmbH

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-Mail: info@als-cs.com

Website: www.als-cs.com

The contact details of the data protection officer:

Montaser Tawalbeh

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-mail: GDPR@als-cs.com

Website: www.als-cs.com

Purpose of processing and legal basis

The data received from you is processed by us only for the purposes for which we received or collected it. In particular, this can be done for the following purposes:

• Communication
• Answers to inquiries
• Initiation and provision of services
• Initiation and execution of contracts

Processing for other purposes can only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR have been met. Information obligations pursuant to Article 13 para. 3 and Article 14 para. 4 GDPR are of course observed.

The legal basis for the processing of personal data is in principle Article 6 GDPR, unless there are specific legal provisions. If personal data is processed on the basis of your consent, you have the right to revoke this consent at any time with effect for the future.

In particular, the following options may be considered:

• Article 6 para. 1 a) GDPR
• Article 6 para. 1 b) GDPR
• Article 6 para. 1 c) GDPR
• Article 6 para. 1 f) GDPR

If processing is carried out on the basis of Article 6 para. 1 f) GDPR, the controller shall pursue the following legitimate interests of himself or third parties: Communication if the person concerned is not a direct party to the contract to be initiated or existing. If we process data on the basis of a weighing of interests, you as the data subject have the right to object to the processing of personal data in accordance with Article 21 GDPR.

Categories of personal data

If the controller does not collect your data directly from communication with you and you therefore know what data is involved, please note that the controller regularly processes the following categories of personal data:

• Master data, such as first and last name, professional qualification
• Contact data, such as address, telephone and fax number, e-mail address
• Contents of communication
• Information on the participants, including information on legal representatives and beneficial owners
• Information on the facts of the case, including information on the personal and economic circumstances of the parties involved

Recipients of the personal data

• Controller, in particular the employees of the specialist department
• Processor, i.e. companies which, due to contractual obligations, treat your data exclusively in accordance with the instructions of the responsible party
• Your data could be processed by trusted third parties. Such data processed by third parties is kept confidential and used for the intended purposes.

Transfer of data to third countries and to an international organisation

Your personal data will only be passed on to third parties if this is necessary for the execution of the contract with you, if this is permissible on the basis of a weighing of interests pursuant to Article 6 Para. 1 f) GDPR, if we are legally obliged to pass it on or if you have given your consent to this.

Where data is transferred to a third country outside the EU, an adequate level of data protection is ensured by the conclusion of EU standard contractual clauses and/or the recipient's participation in the so-called "Privacy Shield" and the technical and organisational measures taken by the third party with regard to data protection and data security.

Duration of storage

Personal data will only be stored by controller as long it is necessary to pursue the purpose for which it was processed. If the storage of the data is no longer necessary for the fulfilment of contractual or legal obligations and for the pursuit of legitimate interests, i.e. for the preservation of evidence or proof within the scope of the statutory limitation provisions, these will be deleted regularly.

Your rights as a data subject

Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
There is a right of appeal to a data protection supervisory authority. A list of the Germany supervisory authorities and their contact details can be found in the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Provision of personal data
As part of our business relationship, you must provide the personal information necessary to establish and conduct a business relationship and to fulfil the contractual obligations associated therewith, or which we are required by law to collect. Without this data we will normally have to refuse the conclusion of the contract or the execution of the order or will no longer be able to execute an existing contract and may have to terminate it.

Automated individual decision-making/profiling
An automated decision making (including profiling) does not take place with your data.

Information about your right of objection

1. Right of objection in individual cases

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you on the basis of Article 6 para. 1 e) GDPR (data processing in the public interest) and Article 6 para. 1 f) GDPR (data processing on the basis of a weighing of interests); this also applies to profiling based on this provision within the meaning of Article 4 para. 4 GDPR. If you file an objection, we will no longer process your personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims

2. Right to object to the processing of data for advertising purposes

In individual cases we process your personal data in order to operate direct advertising. You have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling in so far as it is connected with such direct advertising.

The following information is intended to give you an overview of the processing of your personal data by the ALS Group and the rights to which you are entitled under data protection law. Which data are processed in detail and in which way they are used depends decisively on the concrete employment relationship.

The identity and the contact details of the controller:

ALS Holding GmbH

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-Mail: info@als-cs.com

Website: www.als-cs.com

The contact details of the data protection officer:

Montaser Tawalbeh

Nikolaus-Otto-Straße 2

40721 Hilden

Germany

E-mail: GDPR@als-cs.com

Website: www.als-cs.com 

Purpose of processing and legal basis

We process your personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act and all other relevant laws.

First and foremost, the processing of personal data serves to establish, execute and terminate a contractual or quasi-contractual obligation with the data subject (e.g. employment relationship). The primary legal basis for this is Article 88 GDPR. In addition, collective agreements (group, collective and works agreements as well as collective bargaining agreements) may be concluded pursuant to Article 6 para. 1 b) in conjunction with Article 26 para. 4 of the Federal Data Protection Act and, if applicable, your separate consents pursuant to Article 6 para. 1 a) and Article 7 GDPR in conjunction with Article 26 para. 2 of the Federal Data Protection Act (e.g. in the case of video recordings) may be used as a data protection permission provision.

We also process your data in order to be able to fulfil our legal obligations as an employer, in particular in the area of tax and social security law. This is done on the basis of Article 6 para. 1 c) GDPR in conjunction with Article 26 of the Federal Data Protection Act. Due to these legal regulations, the ALS Group is subject to various control and reporting obligations.

If special categories of personal data pursuant to Article 9 para. 1 GDPR are processed, this serves the exercise of rights or the fulfilment of legal obligations under labour law, social security law and social protection within the scope of the employment relationship, e.g. disclosure of health data to the health insurance fund, recording of severely disabled persons due to additional leave and determination of the severely disabled persons levy. This is done on the basis of Article 9 para. 2 b) GDPR in conjunction with Article 26 para. 3 of the Federal Data Protection Act. In addition, the processing of health data may be necessary for the assessment of your ability to work in accordance with Article 9 para. 2 h) GDPR in conjunction with Article 22 para. 1 b) of the Federal Data Protection Act.

If necessary, we also process your data on the basis of Article 6 para. 1 f) GDPR in order to protect legitimate interests of ourselves or third parties (e.g. authorities). This applies in particular to the investigation of criminal offences (legal basis Article 26 para. 1 sentence 2 of the Federal Data Protection Act) or within the group for purposes of group control, internal communication and other administrative purposes. For example:

• Ensure effective manpower allocation, review and optimisation of needs analysis procedures to address clients directly,
• Assertion of legal claims and defence in legal disputes,
• Ensuring IT security and IT operations,
• Prevention and clarification of criminal offences,
• Video surveillance for the protection of the house right, for the collection of evidence in case of robberies and fraud,
• Measures for building and plant security (e.g. access controls),
• Measures to secure the right of domicile,
• Business management and development measures,
• Risk control within the company.

In addition, the processing of special categories of personal data may be based on consent in accordance with Article 9 Para. 2 a) GDPR in conjunction with Article 26 Para. 2 of the Federal Data Protection Act (e.g. company health management).

Should we wish to process your personal data for a purpose not mentioned above, we will inform you of this beforehand and, if necessary, obtain your consent beforehand.

Categories of personal data

We collect personal data from you in order to establish, carry out and terminate your employment relationship. Data is personal if it is clearly assigned to a specific person or if this identification can at least take place indirectly.

The processed categories of personal data include in particular your master data (such as first name, surname, name supplements and titles, date of birth, gender, nationality, marital status, denomination and personnel number), contact data (e.g. private address, (mobile) telephone number, e-mail address), the log data generated when using the IT systems, as well as data from any company video surveillance and other data from the employment relationship (e.g. personnel questionnaire, social data, size of shoe, health insurance number and name of health insurance fund, bank details, social insurance number, pension insurance number, salary data as well as tax status information and tax identification number, place of employment or workplace, time recording data, absence and holiday periods, business trips, periods of incapacity for work, training and work experience, criminal record and application documents incl. certificates/references and photograph as well as employment documents (such as job title, functions, work history, working hours, remuneration and remuneration components as well as remuneration history, performance information, disciplinary and complaint data, severe disability, pregnancy incl. notification of supervisory authorities, anniversary, pension claims, notices of termination and notice periods).

This may also include special categories of personal data: health data, health conditions, health and illness data, certificate of incapacity for work.

As a rule, your personal data is collected directly from you as part of the recruitment process or during the employment relationship. In certain constellations, your personal data will also be collected from other offices due to legal regulations. This includes, in particular, occasion-related queries of tax-relevant information at the relevant tax office and information on periods of incapacity to work at the respective health insurance fund. In addition, we may have received data from third parties (e.g. employment agencies).

Human resources development

Within your employment relationship, employee appraisals with superiors take place again and again. These are an integral part of personnel development. The subject of such discussions can be performance appraisals by superiors, salary adjustments, perspective discussions, target agreements for the future, but also agreements on training and further education. The results of employee appraisals are usually documented - electronically or in paper form - and are then part of your personnel file. The same applies to information about your salary adjustment, etc. based on this information. In addition, information about your participation in training measures or the qualification measures you have carried out is stored there. Among other things, we store the following information about you: performance appraisals, salary adjustments, short CVs, objectives, information on further training, training courses and qualifications, and certificates, if applicable.

Recipients of the personal data

Within our company, only those persons and bodies (e.g. specialist departments, works councils, representatives for severely handicapped persons) receive your personal data that they require to fulfil our contractual and legal obligations.

In addition, your data will be transferred to certain companies within our group of companies if these companies centrally perform data processing tasks for the companies affiliated in the group, such as payroll accounting, disposal of files, internal administrative purposes, IT administration, controlling and financial accounting, and information for managers.

Furthermore, we transfer your data to our subsidiaries (also abroad) as far as this is necessary due to your employment relationship.

In addition, we make use of various service providers to fulfil our contractual and statutory obligations, including in particular

• Service provider for applicant data management
• Personnel service provider
• Lawyers, tax consultants, insurance companies
• Travel agency

Compliance with data protection regulations in the event of the processing of personal data on a contractual basis is ensured by corresponding contracts pursuant to Article 28 GDPR with the service providers.

In addition, we may transfer your personal data to other recipients outside the company to the extent necessary to fulfil your contractual and statutory obligations as an employer. This could be for example:

• Authorities (e.g. pension insurance institutions, professional pension institutions, social insurance institutions, employers' liability insurance associations, tax authorities, courts)
• Employee's bank (SEPA payment carrier)
• Health insurance company acceptance offices
• Posts in order to be able to guarantee entitlements from occupational pension schemes
• Jobs in order to be able to pay out the benefits affecting assets
• Third party debtors in the event of wage and salary garnishments
• Insolvency administrator in the event of a private insolvency

Your data could be processed by trusted third parties. Such data processed by third parties is kept confidential and used for the intended purposes.

Transfer of data to third countries and to an international organisation

If we transfer personal data to service providers or group companies outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the European Commission to have an appropriate level of data protection or if other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place. You can request information about this at the above contact information.

Duration of storage

We will delete your personal data as soon as it is no longer required for the above-mentioned purposes. After termination of the employment relationship, your personal data will be stored as long as we are legally obliged to do so. This regularly results from legal obligations to provide evidence and to retain data, which are regulated in the German Commercial Code (Handelsgesetzbuch) and the German Tax Code (Abgabenordnung). The storage periods can then be up to ten years. Personal data may also be retained for the period during which the claims can be asserted against the ALS Group (statutory limitation period of three or up to thirty years).

Your rights as a data subject

Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to object
You have the right to object at any time, for reasons related to your particular situation, to the processing of your personal data carried out on the basis of processing carried out in the public interest and processing carried out on the basis of a balance of interests, including profiling based on this provision.

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
There is a right of appeal to a data protection supervisory authority. A list of the Germany supervisory authorities and their contact details can be found in the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Provision of personal data
As part of your employment relationship, you will only be required to provide the personal information that is necessary to enter into and perform the employment relationship or that we are required by law to collect. Without this information, we will not be able to perform the employment contract with you.

Profiling
We partly process your data automatically with the aim of evaluating certain personal aspects (profiling). For example, we use profiling in the following cases: Due to legal and regulatory requirements, we are obliged to combat money laundering, terrorist financing and crimes that pose a threat to property. Data analysis (e.g. comparison with legally prescribed lists) is also carried out.