We, Dr. Ing. h.c. F. Porsche AG (hereafter "we" or "Porsche AG") are delighted at your interest in our company.
We take the protection of your personal details very seriously, and treat them in strictest confidence. Your personal data is processed only within the scope of statutory data protection provisions, in particular the General Data Protection Regulation (hereafter "GDPR") and the German Federal Data Protection Act ("BDSG").
1. Controller and data protection officer for data processing; contact
Controller for data processing in accordance with the data protection legislation is:
Dr. Ing. h.c. F. Porsche AG
Tel.: (+49) 0711 911-22911
Please do not hesitate to contact us if you have questions or suggestions relating to data protection.
You can contact our data protection officer at the following address:
Dr. Ing. h.c. F. Porsche AG
Data protection officer
The electronic application system is a central portal for Porsche group (see Item 5). In this respect, we are jointly responsible with the following other group companies of Porsche AG as joint controllers:
- Porsche Logistik GmbH
- Porsche Dienstleistungs GmbH
- Porsche Leipzig GmbH
- Porsche Deutschland GmbH
- Porsche Engineering Services GmbH
- Porsche Engineering Group GmbH
- Porsche Consulting GmbH
- Porsche Lizenz- und Handels GmbH
- Porsche Financial Services GmbH
- Porsche Digital GmbH
- Porsche Werkzeugbau GmbH
- Porsche Niederlassung Stuttgart GmbH
- Porsche Niederlassung Berlin GmbH
- Porsche Niederlassung Potsdam GmbH
- Porsche Niederlassung Hamburg GmbH
- Porsche Niederlassung Leipzig GmbH
- MHP GmbH
- MHP Consulting Romania SRL
With respect to the joint processes for the electronic application system, we and the respective group companies of Porsche AG jointly determine the purposes and means of processing.
In an agreement on joint controllership pursuant to Article 26 GDPR, we and the respective group companies of Porsche AG have determined how the respective tasks and responsibilities in the processing of personal data are structured and who fulfills which data protection obligations. In particular, it was determined how an appropriate level of security and your rights as a data subject can be ensured, how the information duties under data protection law can be fulfilled jointly and how potential data protection incidents can be monitored. This also includes ensuring that reporting and notification obligations are fulfilled.
Porsche AG is at your disposal as your central contact point in relation to the electronic application system in the role of technical operator (e.g. for questions regarding the management of your application account). You can also assert your rights with regard to the processing of personal data in joint controllership vis-à-vis any jointly responsible group company of Porsche AG. In case you contact us, we and the relevant group company of Porsche AG will coordinate in accordance with the aforementioned agreement pursuant to Article 26 GDPR in order to respond to your inquiry and to guarantee your rights as a data subject.
2. Subject matter of data protection
The subject matter of data protection is personal data. This is all the information that relates to an identified or identifiable natural person (known in legislation as the data subject). For example, it covers information such as name, mailing address, e-mail address, and telephone number, as well as information that originates during the application procedure and during use of the electronic application system, such as details of your qualifications, education and training, and previous jobs.
3. Purposes of and legal grounds for data processing in personnel marketing and the application procedure
Below you will find an overview of the purposes of and legal grounds for data processing in personnel marketing and during the application procedure at Porsche AG.
3.1 The application procedure and its preparations
We process personal data insofar as this is necessary for the application procedure and, if applicable, to prepare an employment contract with you. The main purposes of data processing are:
- Recording and checking your application
- Application management and the selection process (forwarding to the responsible persons in-house, organizing and conducting interviews, recruitment management and administration)
- Organizing and holding selection days and tests for certain application procedures, such as the trainee program, apprenticeships, and general application days
- In the case of internal applications for inhouse programs: application management and the selection process
Further details on the purposes of data processing may be found in the documents you receive during the application procedure.
Data is processed on the basis of Section 26 (1) (1) BDSG. We process the personal data that is required to conduct the application procedure and, if applica-ble, to prepare an employment contract.
If no employment contract arises, we will anonymize your data after six months, unless legal grounds apply for not doing so. If the latter is the case, we anonymize the data once the other legal grounds cease to apply. You can then no longer be identified. Data is processed after anonymization only for the purpose of statistical analysis.
3.2 Fact check
We conduct a review of your personal information to ensure that potential employees perform their duties without conflicting interests and in compliance with high ethical standards while they commit to the company’s principles.
Personal data verification includes your personal data (surname, first name, date of birth, address), your original identity document (or an equivalent document) and your certificates (in particular the last certificate of secondary education) either in the original or in the form of a certified paper copy. In addition, it is checked whether you already have been employed by Porsche and if so - limited to this case and in compliance with the data protection regulations - whether written disciplinary measures have been issued to you in the past three calendar years. For this purpose, personal data in the existing personal file for the past three calendar years are queried. Your personal data will also be compared with publicly available EU sanction lists under Regulations (EC) No. 2580/2001 and 881/2002, as well as with the additions made and received by the European Commission. Only in case of need, you will be asked to provide further documents such as your original residence permit, severely disabled person's card or certificate of good conduct (reliability test).
The fact check is carried out by the respective HR department and, if necessary, additionally by the HR Compliance department (MAC). Only a limited group of people internally has access to your data. In the case of conspicuous findings within the framework of the fact check, the results are discussed in a committee (department, personnel area, works council). The result of the consultation is documented and stored in the personnel file. For new hires, the completed checklist for the fact check will be deposited in the personnel file and will remain there according to the deletion period for relevant personnel documents and data. Other data storage or processing does not take place.
For not hired external candidates, the checklist for the fact check will be deleted after four months while for all other candidates, it will be deleted after three years of storage in their personal file.
The processing of your personal data for the purpose of establishing an employment relationship is required in the sense of Section 26 (1) (1) BDSG, since we have a legitimate interest in people who are integer and acting in accordance with applicable law. The contents of the fact check are also regulated in a collective agreement.
The provision of personal data is required for a contract.
3.3 Fulfilment of statutory obligations
We also process your personal data to comply with statutory obligations to which we are subject. These obligations may be due to laws on commerce, taxation, money laundering or finance. Measures relating to health management and aptitude tests may also be necessary due to statutory obligations. The purpose of data processing is based on the respective statutory obligation; processing is generally performed in order to comply with inspection and disclosure obligations imposed by government.
Data is processed on the basis of Article 6 (1) (c) GDPR. We process the personal data that is required in order to comply with the respective statutory obligation.
We delete the data once the statutory obligation ceases to apply, unless other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
3.4 Safeguarding of legitimate interests
We also process your personal data for the purposes of safeguarding our legitimate interests or the legitimate interests of third parties. We pursue the following interests, which at the same time are the respective purposes:
- Operational reporting
- Performing and optimizing personnel marketing and the recruitment process (performing consultations in personnel marketing, applicant surveys and statistical analyses)
Data is processed on the basis of Article 6 (1) (f) GDPR. We process the personal data that is required to safeguard legitimate interests, unless this is outweighed by your interest in the protection of your personal data.
We anonymize or delete the data when the purposes for which the data was required no longer apply, unless other legal grounds apply. If the latter is the case, we anonymize or delete the data once the other legal grounds cease to apply. After anonymization, you can no longer be identified.
If you have given consent for certain purposes, such as the checking of your application in other companies of Porsche group, for inclusion in a Talent Pool, or in order to receive the newsletter "Job Abo", for example, the purposes are evident in the wording of this granted consent.
To prevent misuse, we use the so-called double opt-in process for sending the newsletter.
Data is processed on the basis of Article 6 (1) (a) GDPR. You may withdraw your consent at any time without stating a reason. This withdrawal will not affect the lawfulness of processing based on consent given before it is withdrawn.
We delete the data when you have withdrawn your consent, unless other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply
5. Nature, scope and purposes of and legal grounds for data processing in relation to the electronic application system
Certain features of the electronic application system require you to register (see Item 5.2). This applies, in particular, to the application account, which you use to send your application via the electronic application system to us or other group companies of Porsche AG and to manage and keep an eye on job offers. However, the electronic application system can also be opened without registering – but its range of functions is then considerably limited. Personal data may still be processed even if you use the electronic application system without registering.
Below you will find an overview of the nature, scope and purposes of and legal grounds for data processing in the electronic application system.
5.1 Availability of the electronic application system
When you access our website using your device, the following data are processed:
- Date and time of access
- Duration of your visit
- Type of device
- Operating system used
- Features that you use
- Volume of data sent
- Type of event
- Referrer URL
- IP address
- Domain name
This data is processed on the basis of Article 6 (1) (f) GDPR in order to make the electronic application system available, to ensure it functions technically, and to identify and rectify faults. The aim pursued by us and the other group companies of Porsche AG (see Item 1) is to enable the use of the website and to ensure a constantly good technical performance. This data is processed automatically when you open the electronic application system. You cannot use the electronic application system unless this data is provided. This data is not used to gain personal information about you or to reveal your identity.
5.2 Application account
You can use the application account to send your application to us or other group companies of Porsche AG via the electronic application system, and to manage and keep an eye on job offers. We recommend that you use the application account, because the internal processes and the application procedure itself at Porsche AG and other group companies of Porsche AG are adapted to work with this account. Even if you send us your application via another channel, your application will be scanned in as part of our internal processes, and the data will be further processed electronically (see Item 3). Your paper documents will then be returned to you by post.
If you wish to create an application account, you will need to register. Your registration details (username and password) during registration and login are then collected and processed.
Your application account gives you the option of creating an applicant profile. You can enter or upload your personal data (e.g., title, first name, surname, date of birth, place of birth, birth country, nationality, address, telephone number, e-mail address), your qualifications (e.g., education and training, any professional experience, language skills, IT skills), your application documents (e.g., cover letter, résumé, etc.), and other relevant information (e.g., desired salary, availability). Required fields in the online form are marked.
This data is processed on the basis of Section 26 (1) (1) BDSG in order to create your application account and applicant profile for conducting the respective application procedure(s) and – if you have given your consent – to check your application in the Porsche group or Talent Pool on the basis of Article 6 (1) (a) GDPR.
If you delete your application account, your user profile will also be deleted. For the deletion of actual applications, please see Item 3. With regard to the deletion of data relating to specific applications at other group companies of Porsche AG, the provisions of the corresponding Privay Policies shall apply (see Item 1).
5.3 Job Abo
In order to subscribe to the newsletter “Job Abo”, you only need to enter your e-mail address and how often you would like to receive the newsletter. The newsletter is only sent to individuals who have subscribed, i.e. given their consent based on Article 6 (1) (a) GDPR. The contents of the newsletter “Job Abo” are relevant for the scope of the consent, provided they are actually described during the subscription process. In addition, the newsletter contains information about your career opportunities at Porsche AG and at other group companies of Porsche AG.
Subscription is carried out using the so-called double opt-in process, i.e. after subscribing, you receive an e-mail prompting you to confirm your subscription to prevent misuse of your e-mail address. We make a record of all subscriptions so that we can provide evidence of the subscription process and associated consent in line with legal requirements. Subscriptions are always logged and the mandatory processing of data you entered during the subscription process is performed accordingly on the basis of legitimate interests according to Article 6 (1) f) GDPR. You can withdraw your consent to receive our Job Abo at any time by unsubscribing, for example. You can exercise this right using the unsubscribe link at the end of each Job Abo.
6. Recipients of personal data
Internal recipients: Within Porsche AG, the only persons who have access are those who need it for the purposes named above.
External recipients: We forward your personal data to external recipients outside Porsche AG only if this is necessary for processing your application, if another legal authorization exists or if we have your consent to do so.
External recipients can be:
Companies of the Porsche AG Group or external service providers that are used within the scope of the application procedure, in particular the companies JobAmbition GmbH (for digitizing applications that are not submitted via the electronic application system, and for answering queries), and commma Unternehmensberatung GmbH (for support with the selection process). We carefully select and regularly inspect these processors, to make sure that your privacy is maintained. Service providers may use the data only for the purposes we have specified.
b) Public bodies
Authorities and public institutions, such as courts and financial authorities, to which we must transfer personal data for legal reasons. The data is transferred on the basis of Article 6 (1) (c) GDPR.
c) Companies of the Group
Companies of the Porsche AG Group, to which data is transferred based on consent in order to carry out the application procedure or to safeguard legitimate interests. The data is transferred on the basis of Article 6 (1) (a) and/or (f) GDPR or Section 26 (1) (1) BDSG. You can find a list of Group companies at: http://www.porsche.com/germany/aboutporsche/service/.
7. Storage duration
For the storage duration of personal data, please refer to the relevant section on data processing. In addition, as a general rule, we store your personal data only for the length of time necessary to fulfil the intended purposes, or – if consent has been granted – until you withdraw your consent (and no other legal grounds apply). If you object, we delete your personal data unless its further processing is permitted by the relevant legal provisions. We also delete your personal data if we are obliged to do so for legal reasons.
8. Rights of data subjects
As the data subject affected by the data processing, you have numerous rights. Specifically:
Managing the application account: If you have registered as a user of the application account, you can view, change, or delete your data yourself.
Withdrawing an application: If you are no longer interested in job offers, you can withdraw your application. In this case, going forward you will no longer be considered in the application and recruitment process. Your personal data will then be deleted in accordance with the legal provisions.
Right of access: You have the right to obtain information from us about the data that we have stored about you.
Right of rectification and erasure: You have the right to demand that we rectify incorrect data and – provided the legal requirements are met – that we delete your data.
Restriction of processing: You have the right – provided the legal requirements are met – to demand that we restrict the processing of your data.
Data portability: If you have provided us with data on the basis of a contract or consent, you have the right, in accordance with the legal requirements, to obtain the data you have provided in a structured, standard and machine-readable format or you can demand that we transfer this data to another responsible person.
Objection to the processing of data on the legal grounds of "legitimate interests": You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on "legitimate interests". If you exercise your right to object, we will cease the processing of your data unless we can – pursuant to the legal requirements – prove compelling legitimate reasons for further processing, which override your rights.
Withdrawal of consent: If you have given us consent to process your data, you may withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data remains unaffected up until withdrawal of consent.
Right to lodge a complaint with a supervisory authority: You can also submit a complaint to the competent supervisory authority if you believe that processing your data is in breach of the legislation. To do so, you can apply to the supervisory authority that is responsible for your town/city or country or the supervisory authority that is responsible for us.
Contacting us and exercising your rights: Please do not hesitate to contact us free of charge if you have any questions regarding the processing of your personal data, your rights as a data subject and any consent that you may have given. To exercise all of these aforementioned rights, please use the contact data given above under Item 1. Or contact us via http://por.sc/privacycontact. In doing so, please ensure that it is possible for us to identify you uniquely. If you wish to withdraw your consent, you can use the method of contact that you used when you gave your consent.
9. Links to third-party sites
Websites and services from other providers that are linked to the electronic application system are and have been designed and made available by third parties. We do not have any influence over the design, content, or function of these third-party services. We explicitly distance ourselves from all content on all linked third-party sites. Please note that third-party sites linked to the electronic application system may install their own cookies on your device or collect personal data. We have no influence over this. If you are concerned, please contact the providers of these third-party sites for the relevant information.
Version dated 2020-01-23