Privacy Policy for the Applicant Process at PACCOR

Protecting your Personal Data and complying with the General Data Protection Regulation (GDPR) and other relevant data protection legislation, is something we take very seriously.

This Privacy Policy for the Application Process is intended to provide you with information on how we ensure this protection during the entire application process, including in online interviews and your membership in PACCOR candidate communities.

As you are using the PACCOR website, please also take note of the General Privacy Policy, which applies to personal data which we collect and process through the PACCOR website and which explains what "personal data" and other terms mean. It also explains your data protection rights which also apply to this Recruitment Privacy Notice.

1. Data Controller

The data controller (which is also referred to as "we" in this Recruitment Privacy Policy) for processing your application and related personal data is PACCOR Packaging GmbH, Peter-Müller-Straße 16/16a, 40468 Düsseldorf, if you apply for a job located in Germany. When you apply for a job in a different country, the respective PACCOR entity in this country will act as data controller.

2. How we use your personal data

Application portal
If you use the PACCOR online application portal, we must process the personal data you submit through our application portal for the purpose of processing and considering your application. If you are hired, your data will be transferred to your personnel file.

If the controller is a company based in the European Union (EU), it will do so on the legal basis of Art. 6 (1) lit.b of the General Data Protection Regulation (GDPR) § 26 (1) in conjunction with (8) sentence 2 of the BDSG (new).

Insofar as special categories of personal data are processed pursuant to Article 9 (1) GDPR in conjunction with the relevant national regulation for this purpose (e.g. data on health, religious or trade union affiliation), this shall be done on the basis of Article 9 (2) b) GDPR in conjunction with the relevant national regulation for this purpose. In addition, the processing of health data may be necessary for the assessment of your ability to work pursuant to Article 9 (2) h) of the GDPR in conjunction with the relevant national regulation.

If you do not send your application documents directly to PACCOR via the portal, they will be uploaded to our applicant management system. You will receive an e-mail with which you can activate your application. If you do not activate your application within 30 days, your data will be deleted from our applicant management system and you will not be considered further in the selection process.

Participation in a live or question-based video interview.
In the event that you consent to a live video interview or a question-based video interview, we will use the information you provide during the interview to assess your suitability for the position for which you have applied and, if applicable, for other positions that may be offered to you. For Eu controllers, the legal basis for this is Art. 6 (1a) lit. If you have given your consent, we may record your live video interview for these purposes in order to view the interview at a later stage, during the application process. Eu controllers will do this on the basis of Art. 6(1)(a) GDPR. A systematic analysis, e.g. by using speech analysis software, will not take place. You can revoke your consent at any time with effect for the future. To do so, please contact the controller.

Membership in PACCOR Candidate Communities
You may choose to become a member of one of our PACCOR candidate communities. This means that, with your consent, we will retain your application, including your personal data, for a maximum period of three years (four years for jobs in the U.S.) for the purpose of contacting you about future career opportunities and other relevant positions within PACCOR Group. EU data controllers will do this on the legal basis of Art. 6(1)(a) GDPR. Your consent is voluntary and does not affect the status of your application. You can revoke your consent at any time with effect for the future. To do so, please contact the controller.

3. Categories of data processed

The categories of personal data processed include in particular:

Master data (e.g. name, date of birth, nationality, place of residence).
Documents (e.g. certificates, attestations, curriculum vitae)
Education history (e.g. data on (higher) school education, professional qualification)
Billing data, (e.g. bank data for reimbursement of application costs)
Organizational data in the case of internal applications (e.g. personnel number, cost center, department)
Communication data (e.g. e-mail, (mobile) phone)
Image and sound recordings as part of the selection process
Log data arising from the use of IT systems

4. How long we retain your personal data

Application portal
Unless your application leads to employment by PACCOR, we will retain your application and personal data for as long as necessary to complete the application process and to comply with the statutory data retention periods, currently for a maximum of six months after the end of the application process. If you apply for several positions within six months, the retention period begins at the end of the last application process.

Interview data
In the event that you agree to a live video interview or a question-based video interview, video footage or audio files of your remote interview will be deleted six months after recording or receipt. We will also delete this data if you withdraw your consent by that time.

Membership in PACCOR Candidate Communities
If you have chosen to be added to a PACCOR candidate community, we will store your application, including your personal data, for a period of up to three years. If you are applying for a position in the U.S., the maximum period is four years.

5. Disclosure of your personal data

Within the PACCOR Group
If you have chosen to join a PACCOR Candidate Community, we may also consider you for available positions at various PACCOR Group locations. For this purpose, your personal data may be shared and processed by recruitment teams in other PACCOR locations, including those outside the European Union.

This may involve your personal data being transferred or accessed to a country outside the EU that is not subject to a comparable level of data protection. In this case, we will ensure that the receiving PACCOR sites provide appropriate safeguards (e.g., in agreement with EU standard contractual clauses). Copies of the guarantees can be obtained here.

Sharing Personal Data with Service Providers.
When PACCOR officers in the EU involve service providers who may support the processing of personal data and have access to your personal data, they do so only after entering into a data processing agreement in accordance with Article 28 of the GDPR, which requires our service providers to process personal data only in accordance with our instructions and to keep it confidential. PACCOR Packaging GmbH holds all contracts with service providers and acts as a processor for other PACCOR controllers. Currently, we may use the following service providers as data processors/sub-processors:

Who is the service provider and what we use them for:

SmartRecruiters GmbH, Winsstr. 62/63, 10405 Berlin, Germany:

Provision and development of the cloud platform ("Software as a Service") for the above purposes. Processing of the personal data provided.
LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA:

Enables effective sourcing and management of potential candidates from LinkedIn. Synchronization of relevant application, candidate and job data with LinkedIn. Processing of provided personal data and communication.

If your personal data is transferred to a country outside the EU that is not subject to a comparable level of data protection, we will only do so if we ensure the existence of appropriate safeguards (e.g., by agreement on standard EU contractual clauses ). You can obtain copies of the guarantees here.

6. What rights do you have?

As an applicant with us, you have the following data protection rights, for the exercise of which you can contact us or our data protection officer at any time using the data specified in items 1and 2:

a. Information
You have the right to obtain information about your personal data processed by us and to request access to and/or copies of your personal data. This includes information about the purpose of the use, the category of data used, their recipients and authorized persons and, if possible, the planned duration of data storage or, if this is not possible, the criteria for determining this duration (compilation by PDF or in paper form).

b. Correction, deletion or restriction of processing
You have the right to request that we correct any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.

c. Right of objection
Insofar as the processing of personal data concerning you is carried out on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

d. Right of withdrawal
If the processing is based on consent, you have the right to revoke the consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until the revocation. To do so, you can contact us or our data protection officer at any time using the above data.

e. Right to deletion
You have the right to request that we delete personal data relating to you without undue delay, and we are obliged to delete personal data without undue delay if one of the following reasons applies:

The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You object to the processing in accordance with point 8.c above and there are no overriding legitimate grounds for the processing.
The personal data have been processed unlawfully.

The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which we are subject. This does not apply insofar as the processing is necessary:

For compliance with a legal obligation that requires processing under Union or Member State law to which we are subject.
For the assertion, exercise or defense of legal claims.

f. Right of complaint to the competent supervisory authority
In the event of violations of data protection law, the data subject has a right of appeal to the competent supervisory authority. The competent supervisory authority in matters of data protection law is:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Tel.: 0211/38424-0
Fax: 0211/38424-10
E-Mail: poststelle@ldi.nrw.de