1. Data controllership for the purposes of the EU General Data Protection Regulation (GDPR)

This data protection information applies to the careers.mahle.com job search of the responsible party MAHLE International GmbH and the affiliated companies of the MAHLE Group within the meaning of Section 15 of the German Stock Corporation Act (AktG).

This job search is operated by

MAHLE International GmbH
Pragstraße 26 - 46
70376 Stuttgart
Deutschland

as the data controller within the meaning of Article 4 No. 7 GDPR. If the MAHLE International GmbH collects, processes, or uses data on behalf, the commissioning company is also the data controller. This is the company indicated in the job advertisement. Within their area of responsibility, the affiliated companies are jointly responsible for the protection of personal data (Article 26 GDPR).  Even if there is a joint controllership, the affiliated companies fulfil the data protection obligations according to their responsibilities.

2. Data protection officer

MAHLE GmbH
Corporate Data Protection Officer
Dr. Alexander Deicke
70376 Stuttgart
Germany
e-mail: cdpo@mahle.com
 

3. Legal specifications

MAHLE is committed to strict compliance with the national and international laws and regulations to safeguard the right to informational self-determination.

We observe European regulations on data protection and privacy law and the national provisions that arise from them in collecting, storing, and processing personal data.

4. Collection and processing of your personal data

Your personal data are used only for the purpose for which you have voluntarily provided these data to us and to protect our IT systems against attacks and other unlawful actions. Should you have communicated further personal data to us, for example within the scope of a contact form, a survey, a prize competition, registration, or to perform a contract, we process these data for the purposes mentioned, for purposes of customer management and – to the extent necessary – for purposes of executing and billing for any business transactions, in each case in the scope necessary to that end. We obligate our employees and service providers to observe the strictest confidentiality.

Your personal data will be particularly processed for the following purposes, which will be described in detail below:

a) Visit the job search

b) Creation of a candidate profile; application

c) Registration for the talentpool
 

To:

a) Visit job search

In the case of solely informative use of our career website, we automatically store on an anonymized basis the name of your Internet service provider, the website from which you visit us, the Web pages you visit when you are on our site, websites you visit from our site, and the date and duration of your visit. We may analyze and interpret this information on an anonymized basis. Further personal data are not collected or stored unless you expressly permit us to do so. Our data protection information applies exclusively to the use of our websites, not to your activities on the websites of social networks or other providers that you may be able to reach using the links on our websites. Please consult these providers’ websites for information on their privacy and data protection policies.

Where permissible by law, we disclaim any and all liability for damage and/or losses arising from the use of the linked websites.

We do not store other personal data unless you communicate these data to us, for example within the scope of a contact form, a survey, a prize competition, registration, or to perform a contract, and even in these cases we do so only to the extent that we are permitted to do so based on your consent or pursuant to the applicable legal provisions.

There is no legal or contractual obligation for you to provide your personal data. However, it is possible that certain functions of our website may depend on the provision of personal data. If you do not provide personal data in these cases, this may cause certain functions to be restricted or unavailable.

The legal basis for processing your personal data for this purpose is our legitimate interest. The legal basis is therefore Article 6 (1) f) GDPR.

b) Creation of a candidate profile; application

We process the data that you provide to us as part of your application. This is usually master data (e.g. first and last name), address and contact data as well as education, qualification, and career history.

We process your data as part of the candidate management system to find suitable candidates for vacancies. To use our recruiting platform, you must create a candidate profile. You can use this to apply to specific jobs.

Usually we do not require any special categories of personal data within the meaning of Article 9 GDPR for the application process. We ask you not to provide us with any such information from the outset. If any special categories of personal data should be necessary for a specific vacancy, we explicitly request this data. The legal basis for processing these special categories of personal data is Article 9 (2) b) GDPR.

Your candidate profile including your application documents will be visible to various employees of the MAHLE Group. In particular, employees of the Human Resource department, the managers of the department for which you are applying, and the works council will be able to view your candidate profile.

The provision of your data is neither legally nor contractually required. However, if you would like to apply for a specific position via our careers site, the provision of your data is necessary so that MAHLE can decide on your application – and ultimately on your employment. In the context of a specific application, we process your data to decide on the establishment of an employment relationship. The legal basis for this is Article 6 (1) b) GDPR or specific national law (e.g. Article 88 GDPR in conjunction with Section 26 (1) German Federal Data Protection Act (BDSG).

The legal basis of data processing after a cancellation is Article 6 (1) f) GDPR. Legitimate interest in the case of processing based on Article 6 (1) f) GDPR is the defence against legal claims.

c) Registration for the talentpool

As part of our talentpool, we offer you the option of saving your data beyond your specific application in order to be able to take it into account for future vacancies. If your application is considered for another vacancy at MAHLE, we will forward your application documents to the relevant department and, if necessary, contact you by telephone or e-mail.

The processing of your personal data for this purpose is voluntary. If you do not register for the talent pool, this will not result in any personal disadvantages for you, with the exception that you will not be able to take advantage of the talentpool. The legal basis for this consent is Article 6 (1) a) GDPR or specific national law (e.g. Article 88 GDPR in conjunction with Section 26 (1) of the German Federal Data Protection Act (BDSG)). You can withdraw your consent at any time with the effect for the future. You can send the withdraw of your consent to careers@mahle.com or make the desired settings yourself in the candidate profile.

5. Disclosure of data to third parties; recipients of data  

a) Visit the job search

To operate the website, we rely on contracted third-party companies and external service providers (“processors“). In such cases, personal data are disclosed to these processors to permit them to engage in further processing. We select these processors carefully and review them regularly to ensure that your privacy is maintained. The processors are only permitted to use the data for the purposes stipulated by us and, beyond that, undertake a contractual obligation to us to handle your data exclusively in accordance with this data protection and privacy statement and with national data protection and privacy laws.

Specifically, we may use the following processors:

IT company to operate the website, hoster

b) Creation of a candidate profile; application

To process your application, we rely on contracted third-party companies and external service providers (“processors“). In such cases, personal data are disclosed to these processors in order to permit them to engage in further processing. We select these processors carefully and review them regularly to ensure that your privacy is maintained. The processors are only permitted to use the data for the purposes stipulated by us and, beyond that, undertake a contractual obligation to us to handle your data exclusively in accordance with this data protection and privacy statement and with national data protection and privacy laws.

Specifically, we may use the following processors:

SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Deutschland

Within the application process your personal data is disclosed to companies of the MAHLE Group that are affiliated with the controller within the meaning of Section 15 of the German Stock Corporation Act (AktG). The legal basis in this regard is our legitimate interest pursuant to point (f) of Article 6 (1) GDPR. Basically, we treat your personal data with the utmost care and only parties involved in the application process, such as Human Resources, the works council or the respective manager of the vacant position, have access to the application data provided by you for the purpose of decision-making or for processing your application within the application process.

c) Registration for the talentpool

Within the context of the talent pool, your personal data is disclosed to companies of the MAHLE Group that are affiliated with the controller within the meaning of Section 15 of the German Stock Corporation Act (AktG). The legal basis in this regard is our legitimate interest pursuant to point (f) of Article 6 (1) GDPR.

Except in the cases indicated separately, we share your personal data with third parties only if you have consented pursuant to point (a) of Article 6(1) GDPR, this is necessary for the performance of a contract with you pursuant to point (b) of Article 6(1) GDPR, or in the event that there is a statutory obligation of disclosure pursuant to point (c) of Article 6(1) GDPR, this takes place for the purposes of the legitimate interests pursued by the controller pursuant to point (f) of Article 6(1) GDPR. Examples include:

- Reviewing and optimizing procedures for analyzing demand for purposes of directly approaching customers

- Optimization and demand-driven design of the website

- Advertising or market and opinion research, to the extent that you have not objected to the use of your data

- Safeguarding our company’s IT security and IT operations

- Preventing and investigating criminal acts

- Measures for managing the business and further developing services and products

If personal data are transferred to a third country outside the European Economic Area (EEA) or to an international organization, this is stated separately.

6. Use of cookies

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. The following categories of cookies are used on this website:

a) Technically necessary cookies: „Essential“

These cookies are necessary for the functioning of our website and cannot be disabled in our systems. Typically, these cookies are only set in response to actions you take that correspond to a service request, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to notify you of these cookies. However, some areas of the website may not work if you do so.

The legal basis for the processing of personal data using essential cookies is Article 6 (1) f) GDPR.

• route: counts the number of sessions and assigns an anonymous identifier to each visitor, expiration date: until the end of the session
   
• JSESSIONID: counts the number of sessions and assigns an anonymous identifier to each visitor, expiration date: until the end of the session 
   
• careerSiteCompanyId: assigns the requests to the correct data centre, expiration date: until the end of the session
   
• Load balancer cookie: prevents a visitor from jumping from one instance to another, expiration date: until the end of the session
   

b) „Analysis cookies“

We use „analysis cookies“ to identify your usage interests and particularly popular areas of our websites and to use this information to improve the design of the websites and make them even more user-friendly. You can consent to the use of „analysis cookies“ by clicking on them:

https://careers.mahle.com

You can click to withdraw your consent to the use of analytical cookies at any time with the Cookie Consent Settings:

https://careers.mahle.com

These cookies are:

• _ga: serves to distinguish visitors, expiration date: 2 years
   
• _gat: is used to monitor and throttle the server request rate, expiration date: 1 minute

7. Use of Google Analytics

We use the “Google Analytics” Web analytics service on our website. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses the analysis cookies noted above. The Google Analytics cookies are stored on the basis of point (a) of Article 6(1) GDPR. The data collected are anonymous to us as the operator of this website. We cannot draw any conclusions regarding users’ identity.

We have activated the IP anonymization function on this website. This means that Google truncates (shortens) your IP address within Member States of the European Union or in other states that are signatories to the Agreement on the European Economic Area before transferring it to the United States. Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to analyze your use of the website, compile reports on website activity, and provide the website operator with further services associated with the use of the website and of the Internet.

We have entered into a contract for processing of data with Google.

You can object to the processing of data by Google at any time by using the opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de or via the ad display settings: https://adssettings.google.com/authenticated .

8. SOCIAL MEDIA PLUGINS

Social media plugins connect the website with social networks such as Facebook, Twitter, and Google Plus. Social media plugins are integrated into websites. The content is shared in further social channels. These plugins are small buttons, including the Facebook “Like” button or the “Share” button of Twitter, Google, Instagram, etc. Activities on the part of users who are not logged in or members of these sites can also be tracked in this way. This is because user data are automatically shared with the social network channels that are represented on the page when these pages are accessed.

9. Use of Google Maps

We use maps from the “Google Maps” service on our website. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to process your IP address.
The use of Google Maps takes place in the interest of an appealing presentation of our online offerings and ensuring that the places indicated by us on the website are easy to find. This constitutes a legitimate interest within the meaning of point (f) of Article 6(1) GDPR.
For more information on how user data are handled, please see the Google privacy policy. You can find it at:

https://policies.google.com/privacy?hl=de#intro

10. Visiting our online presence in social media

We maintain an online presence within social networks and on platforms in order to be able to communicate with the customers, potential customers, and users who are active there and inform them there about our services.

Please note that user data may be processed outside the territory of the European Union during the course of these activities. This may give rise to risks for users because it could be more difficult for users to assert their rights, for example.

Furthermore, users’ data are typically processed for market research and advertising purposes. For example, user behavior and the interests of users indicated by that behavior can be used to create use profiles. These use profiles can in turn be used to serve ads that are presumed to match users’ interests on and off these platforms, for example. For these purposes, cookies are typically stored on users’ computers, storing their use behavior and interests. Furthermore, data can also be stored in the use profiles independently of the devices used by the users (especially if the users are members of the platforms in question and are logged in there).

For detailed information on the relevant types of processing and the possibilities of objecting (opting out), please see the information from the providers that is linked below.

In the case of inquiries concerning access to information and the assertion of user rights as well, please note that it is most effective to raise these matters with the providers. Only the specific provider has access to users’ data and can take appropriate action directly and provide access to information. Should you still need help even after contacting the providers, please feel free to contact us.

Facebook, Facebook pages, Facebook groups (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on the basis of an agreement on joint processing of personal data – privacy policy, specifically for pages, opt-out:

https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com

Google/YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – privacy policy, opt out: https://policies.google.com/privacy?hl=de#intro                                           

Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – privacy policy/opt-out: https://help.instagram.com/519522125107875

LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) – privacy policy, opt-out: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) – privacy policy, opt-out: https://privacy.xing.com/de/datenschutzerklaerung

11. Security

We take organizational and technical measures to ensure that those of your data that we process are protected against manipulation, loss, destruction, and access by unauthorized persons. We adjust the security measures we take to this end to reflect the state of the art on an ongoing basis.

12. Erasure of your personal data

We erase your personal data as soon as the purpose for which we have collected and processed them ceases to apply. Storage takes place beyond that point in time only if this is necessary according to the laws, regulations, or other legal provisions of the European Union or a Member State of the European Union to which we are subject.

a) Visit the job search

The log data is stored in server log files in a form that allows identification on the persons concerned for a maximum period of 7 days, provided there is no security-relevant event. In the event of a security- relevant event, the server log files are stored until the security-relevant event has been eliminated and fully remedied.

b) Creation of a candidate profile; application

If your application is successful, the personal data you provided as part of the application process will become part of your personnel file and will be used to implement and terminate the employment relationship and deleted in accordance with the retention periods applicable to personnel files. If we are currently unable to offer you employment, we will process your data in accordance with country-specific requirements (usually six months) after sending the rejection in order to defend ourselves against any legal claims, in particular due to alleged discrimination in the application process. If you do not log in to your candidate profile for a period of 6 months after completing your last application procedure, your data / candidate profile will be automatically deleted. Insofar as we process your data based on consent, your data will be deleted independently of this after withdrawal of your consent within the statutory period.

c) Registration for the talentpool

If you have registered for the talentpool, your personal data will be stored for long as is necessary to fulfil the purpose. As soon as you unsubscribe from the talent pool or withdraw your consent, your data will be deleted. After this point in time, your data will only be stored if this is necessary in accordance with the laws, regulations or other legal provisions of the European Union of a member state of the European Union to which we are subject.

13. Data collection from bodies other than the data subject

This data protection notice also applies if personal data is not collected from the data subject. This is particularly the case when head-hunter, recruitment agencies and personnel service providers create profiles for their clients on our applicant page and send applications on behalf of the applicant.

14. Rights of data subjects

As a data subject within the meaning of the GDPR, you have the rights described below.

14. 1 Right of access
Pursuant to Article 15 GDPR, you can obtain confirmation from us to whether we process personal data concerning you. If this is the case, you can also obtain the further information enumerated in points (a) through (h) of Article 15 (1) and in Article 15 (2) GDPR from us.

14. 2 Right to rectification
Pursuant to Article 16 GDPR, you have a right to rectification and/or completion where the personal data concerning you that are being processed are inaccurate or incomplete.

14.3 Right to restriction of processing
Subject to the conditions set out in Article 18 GDPR, you can request restriction of processing of the personal data concerning you. This right applies in particular, if the accuracy of your personal data is disputed between us, for the period needed to verify the accuracy thereof, and in the event that you have a right to erasure and request restriction of processing instead of erasure; it also applies in the event that we no longer need the data for the purposes pursued by us, but you require them for the establishment, exercise or defence of legal claims, and if the successful exercise of an objection between us and you is still disputed.

14. 4 Right to erasure
Subject to the conditions set out in Article 17 GDPR, you can request that we erase the personal data concerning you without undue delay. These conditions provide in particular for a right of erasure if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed and in cases of unlawful processing, where there has been an objection, or where we are under an obligation of erasure under Union or Member State law to which we are subject.

14.5 Right to data portability
Pursuant to Article 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. Within the bounds of Article 20(1) GDPR, you also have the right to have us transmit these data to a third party designated by you.

14.6 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, in accordance with Article 21 GDPR. We will discontinue the processing of your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise or defense of legal claims.

14.7 Withdrawal of consent
Beyond that, you have the right to withdraw declarations of consent issued by you under data protection law at any time, with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To assert these rights, you can contact us via the contact information provided below.

If you consider that the processing of your personal data violates legal provisions, you have the right to lodge a complaint with a data protection supervisory authority with jurisdiction pursuant to Article 77 GDPR.

15. Automated individual decision making or profiling measures

We do not use any automated processing operations to make decisions, including profiling.

16. Contact person

If you have any questions regarding data protection at MAHLE or wish to exercise your right of access to information or to make declarations as a data subject, please contact our company’s Corporate Data Privacy (CY) department. You can reach this department by e-mail at corporate.data.privacy@mahle.com or use the official address of MAHLE International GmbH, Pragstraße 26-46, 70376 Stuttgart, Germany.

You can also reach our corporate data protection officer at the above address or cdpo@mahle.com.

17. Updates to the privacy notice

This data protection notice is valid with immediate effect (last amended on: 19.07.2021).

Due to technical developments and/or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current data protection declaration can be accessed at careers.mahle.com at any time.