Privacy Policy & Terms of Use

jobsearch.createyourowncareer.com

Data protection notice for online applications

This application portal allows you to submit your application online and to apply for one or more vacant positions at a company in the Bertelsmann Group (hereinafter referred to as “group company”) or a foundation in the Bertelsmann Foundation Group (hereinafter referred to as the “Bertelsmann foundation”), or a selected partner company that uses our application portal (hereinafter referred to as “partner company”). Your application via the portal will include personal data (hereinafter referred to as "data"), and, for this reason, data protection provisions and in particular the EU General Data Protection Regulation (hereinafter referred to as the "GDPR") apply.
The principles of fair and transparent processing of your data require that you be informed of the existence of the individual processing operations and their purposes in connection with your online application. Technical and organizational security measures protect your data against accidental or intentional manipulation, loss, destruction or against unauthorized access.
The following data protection notice applies to the application portal worldwide (EU and non-EU) and fulfills the information requirements set out in Articles 12 to 14 GDPR. It is supplemented by the data protection notice in the specific job opening (hereinafter referred to as "1st level information"). Local regulations on the processing of applicant data from individual EU and non-EU countries, if applicable, will be referred to at the appropriate point.

We reserve the right to amend this notice at any time and will provide any notices required in connection with such amendments. We will publish the revised notice on this portal. At the end of this notice, you can see when it was last revised. All changes will become effective upon publication of the revised notice. By continuing to use the portal after such changes, you agree to these changes. If you do not agree with the terms and conditions of this notice, in whole or in part, you can decide to stop using the portal and to delete your account at any time.

1. Who is responsible for processing my data?

Bertelsmann SE & Co. KGaA (hereinafter referred to as the “Company”)
Carl-Bertelsmann-Straße 270
33311 Gütersloh
Email: datenschutz@bertelsmann.de

operates the application portal and is responsible for processing your data if and when you apply for a specific position at Bertelsmann SE & Co. KGaA or agree to be included in the candidate pool or pool of interested candidates.

Furthermore, the Bertelsmann group companies or the Bertelsmann foundations or the partner companies using the application portal for online applications are responsible for data processing in relation to the specific application process. Generally, the group company, the Bertelsmann foundation, or the partner company whose job opening you are responding to is responsible (hereinafter “hiring company” or “affiliated third party”).

With the exception of the entities specified in Item 4 and Item 6, which process personal data in relation to job openings as processors under the instructions of the hiring entity, other group companies, the Bertelsmann foundations, and other partner companies generally do not have access to your data.

However, if you are applying for a trainee program or for a position advertised across multiple companies within the Group, foundations, or partner companies, or agree to be included in the candidate pool or to receive a newsletter, in exceptional cases several group companies or several Bertelsmann foundations may be responsible and have access to your data.

The company name and address of the respective responsible group company or the respective responsible Bertelsmann foundation or the respective responsible partner company can be found in the 1st level information described in the corresponding job opening.

You can contact the Data Protection Officer of Bertelsmann SE & Co. KGaA at the above postal address or via datenschutz@bertelsmann.de. To ensure that your privacy request can be handled promptly and appropriately, please contact the Data Protection Officer of the respective Group company, Bertelsmann Foundation, or partner company responsible for processing your request directly. You can also obtain this information from the 1st level information in the corresponding job opening.

2. Personal data
Personal data is any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an email address, a postal address, or an online identifier such as an IP address or a cookie identifier.

The processing of personal data is permitted only on a legal basis. Your personal data will be processed in connection with your visit to and use of the website and the services offered on it only if the company has a legal basis for doing so.

3. What data is collected?
When you use our website, information is automatically collected from the computer or mobile device you are using (hereinafter referred to as “access data”). The access data may contain information about the browser type, browser version, operating system, Internet service provider, date and time of use of the application portal, previously visited websites, recently viewed websites, and the IP address of the computer.

This data is stored for data security reasons and to ensure the stability and operational security of our website. The legal basis for this is Art. 6(1)(c) GDPR, or alternatively Art. 6(1)(f) GDPR. Ensuring functionality, carrying out security analyses and preventing risks are legitimate interests. After the application portal is accessed, the server log files will be stored on the connected web server and the IP address contained therein will be deleted after 7 days at the latest. Analysis during this storage period only takes place in the event of an attack.

If we process data other than that mentioned here as a result of your visit to our website, the relevant data categories as well as the purposes of the data processing, the legal basis for the data processing, the storage duration and criteria, potential data recipients, as well as your rights in connection with the data processing affecting you are described in detail in Item 4 of this data protection notice.

4. What purposes is my data collected for?
The purposes for processing personal data through our application portal may arise from technical, contractual, or legal requirements, or, where applicable, from your consent.
The company uses the data specified in Item 3 and the data specified in the following sub-items, for purposes including the following:

to make the website available and to ensure technical security, in particular to fix technical errors and to ensure that unauthorized persons do not gain access to the website's systems;
to initiate pre-contractual relationships (e.g., the application process, talent pool);
to fulfill legal obligations (e.g., presentation of the legal notice, data protection notices);
to improve the website;
for web tracking and the analysis of user behavior.

Further information on the listed purposes of data processing can be found in the following sections of this data protection notice.

4.1 Use of cookies
Cookies are small text files used by websites, among other things to improve the user experience. We use cookies to technically provide the services offered, to personalize content and openings, and to analyze traffic to our website.

According to applicable law, we may store cookies on your device provided they are strictly necessary for the operation of the website. For all other cookie types, we require your permission, which we will request using our cookie consent manager when you access the website. Your consent to the use of cookies can be changed or withdrawn at any time using our cookie consent manager.

Details on which cookies are used and their scope can be checked at any time using our cookie consent manager.
If we rely on third-party services in connection with cookies or provide them with information from the cookies, we will only do so under the terms of a data processing agreement with the corresponding service provider. This will ensure purpose limitation and that the processing is performed as instructed so that your data cannot be used for other purposes that deviate from this data protection notice.

If these service providers are established outside the European Union or the European Economic Area (hereinafter referred to as the "EU or EEA"), what is known as a third-country transfer takes place. This is permissible if you have consented to it, we have put appropriate safeguards in place to ensure a level of data protection equivalent to European standards, or the EU Commission has recognized the relevant third country as providing an adequate level of data protection. If the use of our cookies results in a transfer of data to a third country, we will provide you with appropriate notice. You can find further information about the recipients of your data and the topic of third-country transfers in Item 6 and Item 7 of this data protection notice.

4.1.1 Legal basis for data processing
The legal basis for setting technically necessary cookies and the associated data processing is Art. 6(1)(f) GDPR in conjunction with Section 25(2)(2) TDDDG Necessary cookies are set to ensure the proper functioning and usability of the website. The legal basis for setting optional cookies and using your data for these purposes is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. This means that the data is processed on the basis of consent to data processing provided by you using our cookie consent manager.

4.1.2 Retention period or criteria used to determine that period
The data collected and analyzed via the use of optional cookies are generally stored until you object to their use. However, the storage duration for analytics cookies is a maximum of 24 months. On the other hand, technically necessary cookies are generally deleted after the end of the corresponding session. Further details on this can be found in the cookie consent manager.

4.1.3 Objection and deletion options
You have the right to object, in accordance with Art. 21 GDPR, to the processing of your personal data through the use of necessary cookies, where you have grounds for doing so relating to your particular situation. If you would like to exercise your right to object, please use the contact information provided in Item 1. If you object to this data processing, your use of the website may be limited or you may not be able to use it at all.
Furthermore, you may withdraw your consent to the processing of your data in connection with the use of optional cookies at any time, with effect going forward. Consent may be withdrawn by opting out through our cookie consent manager on this website or by deleting cookies using your browser. You can access the settings interface of our cookie consent manager via the following link: Click

4.2 Use of analytics & tracking mechanisms and integration of external content
We use various security technologies as well as analytics and tracking mechanisms on our website to make it more secure. In addition, these technologies help us improve the services offered. All analytics and tracking mechanisms will only be used if and to the extent that we have received your consent to do so via our cookie consent manager. With regard to the use of security technologies (e.g., Web Application Firewalls), the legal basis may be our legitimate interest (Art. 6(1)(f) GDPR) in processing the data or your consent (Art. 6(1)(a) GDPR). We may also be required to process your personal data on the basis of a legal obligation to which we are subject (Art. 6(1)(c) GDPR).
Further details regarding the analytics and tracking mechanisms used (e.g., descriptions, information on retention periods, cookie names) can be found in our cookie consent manager.
Settings for the integration of external content can be managed via the following button. You can find further information about this content in Item 4.9 of this data protection notice.

Integration of external content
We sometimes embed content from external websites on our website. However, this external content is only loaded if and to the extent that you have given us your consent to do so. Loading external content may result in personal data being transmitted to these websites and third-party providers, and cookies being set by them. We have no influence in any way over how these external websites use and process your data.
Therefore, please inquire about this directly on the respective external websites and use the options available there to adjust your privacy settings.

You can stop the loading of external content at any time using the following button:
Disable loading of external content

Legal basis: Art. 6(1)(a) GDPR

4.2.1 Legal basis for data processing
The legal basis for the processing of your data in relation to the use of our analytics and tracking mechanisms is Art. 6(1)(a) GDPR. This means that your data is processed on the basis of consent to the data processing that you provided via our cookie consent manager. The use of our consent management platform, on the other hand, is based on Art. 6(1)(c) GDPR in conjunction with Section 25(2)(2) TDDDG

4.2.2 Retention period or criteria used to determine that period
We retain data processed in connection with our security, analytics, and tracking mechanisms until you object to the use of the data for the purposes listed above, with effect going forward (see below). The same applies to the processing operations described here based on legitimate interests and to data that we process based on Art. 6(1)(c) GDPR.

4.2.3 Objection and deletion options
You have the right to withdraw your consent at any time with effect going forward; where we process data on the basis of legitimate interests, you may also object pursuant to Art. 21 GDPR.

Consent may be withdrawn by opting out through our cookie consent manager on this website or by deleting cookies using your browser. You can access the settings interface of our cookie consent manager via the following link: Click

4.3 Applicant profile
Registration of an applicant profile is required for online applications for job offers. This allows you to apply for jobs, manage documents centrally, and view the status of your applications.

For your registration, we require your first and last name, place of residence, and email address. Uploading documents or providing information about your career history, qualifications, language skills, or willingness to travel is voluntary and not mandatory for account creation. Your applicant profile can be used for all online applications across the portal.
For a specific online application, we will also collect job-specific information, which is used exclusively for the respective process (see Item 4.4). Under certain circumstances, we may ask you to voluntarily provide information regarding equal opportunity (e.g., gender, ethnic origin, socioeconomic background); such information will be processed only with your consent. Mandatory fields are marked with *, all other information is optional.

You also have the option during registration and via your profile settings to sign up for our newsletter and to receive optional notifications about career opportunities. Further information on this can be found under Item 4.6.

4.3.1 Legal basis for data processing
We will process your data to enable registration on and use of the application portal, to manage applications, and to communicate with you during the selection process; this is done for the purpose of implementing pre-contractual measures with regard to a potential employment relationship (Art. 6(1)(b) GDPR). We will process voluntary information and convenience features (e.g., profile photo, talent pool, job alerts) on the basis of your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect going forward. To ensure stability, availability, and security, we will process technical log data to a limited extent (e.g., IP address, timestamps, log files) based on our legitimate interest (Art. 6(1)(f) GDPR).

4.3.2 Personal data categories
Within the scope of the processing activity described herein, we will process the following data categories:

Personal master data (surname, first name, address)
Email address
Username
Technical log data (e.g., IP address, timestamp, log files)
Voluntary information (e.g., profile photo, talent pool, job alerts)
Application documents (resume, cover letter, certificates, etc.)
Job-specific information and application status

4.3.3 Recipients of personal data
For the processing of your data within the scope of the processing activity described herein, we will use, among other services, the services of various data recipients.

They will be contracted by us through data processing agreements for instruction-based data processing or through agreements governing joint data processing. Further information on the data recipients used by us can be found in Item 6 of this data protection notice.

Internally, only the entities involved in the selection process (HR/Recruitment, hiring departments, if applicable the works council/representative body for severely disabled persons – where appropriate) will have access. If transfers to third countries are performed, the safeguards described in Item 7 will apply.

4.3.4 Retention period or criteria used to determine that period
We will process your data for as long as necessary for the establishment of an employment relationship. Once the hiring decision has been made, the respective online application process ends (see Item 4.4), and the purpose of the processing no longer applies. We will then retain the documents and logs stored in connection with the application process only for the duration of the applicable statutory retention periods and will delete or anonymize them upon expiration of those periods. The length of these periods depends on the local legislation governing respective responsible company. You can find the specific applicable periods in the Overview of retention periods available here.

Your application profile is maintained – regardless of the outcome of individual processes – so that you can easily apply for other jobs and use additional features (e.g., candidate pool). We will only store and use your general profile information (e.g., master data, contact details, standard documents uploaded by you) for this purpose. Job-specific information that we also collect during a specific online application (e.g., information on equal opportunities) is tied to individual job openings and, after the jobs have been filled, will be retained exclusively within the framework of the above-mentioned statutory periods and then deleted or anonymized.

If you would like to be included in the candidate or talent pool (see Item 4.5), we will process the necessary profile data based on your consent for the period specified there or until you withdraw such consent, after which we will delete or anonymize the data.
Your applicant profile will be automatically deleted if you do not use it for a certain period of time after the end of your (last) online application. The specific inactivity period depends on the home country selected during profile creation and is explained in the Overview of retention periods. We will notify you via email in good time before your profile is deleted; you can extend the retention period at any time by using your profile again.

If additional information regarding equal opportunity (e.g., regarding gender, ethnic origin, or socioeconomic background) is requested as part of an online application, providing such information is voluntary and is based solely on your consent. This data is processed separately, retained only for as long as strictly necessary, in accordance with the applicable local requirements and for the period specific to the position. it will subsequently be deleted or – to the extent permitted – aggregated and/or anonymized.

4.3.5 Objection and deletion options
You can delete your application profile yourself at any time (account/profile settings). This removes your general profile information as well as any voluntary information (e.g., profile photo, job alerts). We will delete or anonymize job-specific information from concluded application processes after the end of the statutory retention periods; until then, they will be restricted and will not be used for other purposes.

You may withdraw consent (e.g. for participation in the talent pool, job alerts, or voluntary equal opportunity information) at any time with effect going forward – in the portal or via the contact channels mentioned in Item 1. Where we process data on the basis of a legitimate interest (e.g., security logs), you may object in accordance with Art. 21 GDPR; we will review your objection and cease processing unless there are compelling legitimate grounds that override it.

In the event you are hired, the required data will be transferred – to the extent required – to the personnel master data system of the hiring (group) company in order to complete the administrative steps necessary to establish your employment relationship; from this point on, the separate data protection policy for employees that you will receive with the documents regarding your employment (including your employment contract) applies.

We will delete or block any application-related data remaining in the application portal in accordance with the local retention periods. Your rights (access, erasure, withdrawal/objection) remain unaffected (see Item 8).

4.4 Online application process
Upon receipt of your online application for a specific job opening, we will process your data for the purpose of the hiring decision. This will include verifying your professional and personal suitability, the organization and documentation of the selection process (e.g., phone/video interview, assessment, specialist interview) as well as communicating with you. The specific process and scope of processing will depend on the requirements of the position.

Access is granted only to the entities involved in the process, in particular Recruitment/HR, hiring departments/supervisors, as well as – depending on the country and position – the works council and, where appropriate, the representative body for severely disabled persons. Where external service providers (e.g., IT/assessment/recruitment services) are involved, these services will be provided on a contractual basis (data processing agreement pursuant to Art. 28 GDPR). See also Item 6.

If an offer is made and accepted, the required data will be transferred to the personnel master data system of the hiring (group) company in order to complete the administrative steps necessary to establish your employment relationship; from this point on, the separate data protection policy for employees that you will receive with the documents regarding your employment (including your employment contract) applies.

4.4.1 Legal basis for data processing
We will process your personal data in order to decide on whether to establish an employment relationship and to conduct the selection process correctly. The basis is the need to initiate or establish an employment agreement pursuant to Art. 6(1)(b) GDPR; where specific job application regulations exist under applicable local law (e.g., provisions within the scope of Art. 88 GDPR), we will also base the processing on these regulations. We only process voluntary information, such as job-specific questions or equal opportunity data, with your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect going forward.

To comply with legal and sanction-related requirements, sanction list screening may be conducted depending on the country of application; the legal basis is determined by the respective relevant national requirements (typically legal obligation in accordance with Art. 6(1)(c) GDPR or – where permissible – legitimate interest in accordance with Art. 6(1)(f) GDPR).

4.4.2 Personal data categories
Within the scope of the processing activity described herein, we will process the following data categories:

Identification and contact data: name, title, address, email, telephone, where applicable date of birth.
Application documents: resume, cover letter, certificates/qualifications, work samples.
Job-specific information/suitability data: answers to job-related questions, results of tests/assessments, interview notes, availability and compensation information, work/residency status.
Process and communication data: correspondence, appointment scheduling, minutes, application status and decision.
IT/security/usage data: log data (IP address, timestamp, technical identifiers) to ensure the stability and security of the processes.
Equal opportunity information (voluntary): e. g. gender, where appropriate ethnic origin or socioeconomic background – only with your consent, processed separately.
Sanctions list/compliance data (only if required): for conducting legally/locally mandated sanctions list screening (e.g., check of names, if necessary date of birth/nationality with official lists), including the screening result (match/no match) and audit data (time, source, responsible entity).

4.4.3 Recipients of personal data
For the processing of your data within the scope of the processing activity described herein, we will use, among other services, the services of various data recipients.

4.4.4 Retention period or criteria used to determine that period
We will process your application data for as long as is necessary for decision-making in relation to the specific process. The purpose of application-related processing ends when the hiring decision is made. We will then retain the documents and logs only for the duration of the statutory retention periods and, after the end of these periods, we will delete or anonymize them. The lengths of these periods are governed by the applicable local law of the responsible company; in many jurisdictions (e.g., Germany), the usual period is around six months, provided that there are no longer-lasting obligations.

Your applicant profile (general profile information) remains unaffected by this so that you can apply for other jobs (see Item 4.3); job-specific information is tied to the respective process and will be deleted/anonymized in compliance with the retention periods. Your profile will be automatically deleted if you do not use it for a country-specific period of inactivity after the end of your (last) online application; please refer to the Overview of retention periods provided in the portal for the applicable periods. Before deleting your profile, we will notify you in good time via email with the option to extend.

We will only retain data from sanctions list screening as well as associated audit records for as long as is necessary for the fulfillment of the relevant legal obligations or for the documentation of proper screening; they will then be deleted or – where permitted – anonymized.

4.4.5 Objection and deletion options
The processing of your data is necessary for the recruitment decision. Therefore, objection to the processing required for this will generally lead to the end of the selection process and to the rejection of your application. Your rights of access, rectification, erasure/restriction, as well as – where applicable – the withdrawal of consent already given (e.g., regarding voluntary/sensitive information) will not be affected.

4.5 Candidate or talent pool
Independent of an individual online application, you can voluntarily have your applicant profile included in our candidate/talent pool. With your consent, your profile will be visible to authorized recruiters at the Bertelsmann companies, the Bertelsmann foundations, and selected partner companies so that they can match your general profile details with open positions.

Job-specific information from ongoing or previous individual applications will not be included in the pool. Suitable profiles are reviewed manually; no automated individual decision-making and no profiling in accordance with Art. 22 GDPR is performed.

If there is interest in a position, the responsible unit may contact you (provided that you have also activated email notifications for career opportunities; cf. Item 4.6). Whether you subsequently apply will be up to you alone; until an application is submitted, only the information provided here regarding the processing of your data will apply.

4.5.1 Legal basis for data processing
Your inclusion in the talent pool and the associated visibility of your profile will be based on your consent pursuant to Art. 6(1)(a) GDPR; we will process optional special categories of personal data (e.g., information on equal opportunities) only on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. Consent will be voluntary; refusal or withdrawal will not have any negative effect on ongoing individual applications.

Since recruiters from countries outside the EU/EEA can access pool profiles, transfers to third countries may occur. Where possible, we base these transfers on an adequacy decision (Art. 45 GDPR) or appropriate safeguards (e.g., EU standard contractual clauses, Art. 46 GDPR). In exceptional cases, where an equivalent level of protection cannot be ensured, your consent will also extend to the transfer of data to third countries pursuant to Art. 49(1)(a) GDPR; we will specifically inform you of this before consent is given.

4.5.2 Personal data categories
Within the scope of the processing activity described herein, we will process the following data categories:

General profile information: master data and contact details, professional/academic background, qualifications, skills/languages, desired areas of employment, location/relocation/travel willingness, availability, standard documents uploaded by you (e.g., resume, certificates).
Pool metadata: profile/candidate ID, visibility/consent status, timestamp of entry/exit.
Job-specific details from individual online applications are not included in the talent pool (cf. Item 4.4).

4.5.3 Recipients of personal data
For the processing of your data within the scope of the processing activity described herein, we will use, among other services, the services of various data recipients.

In addition, access to pool profiles is granted exclusively to authorized recruiters at Bertelsmann companies, the Bertelsmann foundations, and partner companies, in each case within the scope of the purpose described above.

4.5.4 Retention period or criteria used to determine that period
We will process your pool data as long as your inclusion is active. Your inclusion will end when you withdraw your consent or delete your applicant profile; from this time on, your profile will no longer be visible to recruiters, and we will remove your pool status. Legal retention obligations from ongoing individual applications will remain unaffected (cf. Item 4.4); these periods are governed by the applicable local law. If your profile is not used for a country-specific period after the completion of your last online application, your profile will be automatically deleted; you can find the respective applicable periods in the Overview of retention periods on the portal. Before any automatic deletion, we will notify you in good time via email and give you the opportunity to extend its retention by using your profile again.

4.5.5 Objection and deletion options
You may withdraw your consent to participation in the talent pool at any time with effect going forward – e. g. via the profile settings (disable visibility/leave) or via the contact channels provided in Item 1. Withdrawal of consent ends your participation; ongoing individual applications are unaffected and will continue to be processed in accordance with Item 4.4. Your general data subject rights (access, rectification, erasure/restriction, data portability) will remain in effect at all times.

4.6 Newsletter and email notifications (pool of interested candidates)
You will have the option of subscribing to a newsletter when registering and via your profile settings. Via the newsletter, you will receive weekly information on current job openings by email, the content of which is initially geared to the subject area of your (first) online application. The content of the newsletter, i.e. fields of interest to you, can be optionally extended or changed via your profile settings. You can also unsubscribe from the newsletter at any time via your profile settings.

In addition to the newsletter, you will also have the option of being informed about career opportunities. If you select this option during registration or via your profile settings, the recruiter may contact you personally by email and suggest current job openings to you. In principle, this will only be the recruiter who has access to your applicant profile due to your online application (cf. Item 4.4). If you have also agreed to participate in the candidate pool/talent pool, you can in principle contact all recruiters with access rights. In this case, the descriptions in Item 4.5 will apply. You can turn off this notification option at any time via your profile settings.

Both notification features can be used independently of each other. Both the registration for the newsletter as well as the contact for career opportunities is voluntary and will have no influence on the registration or your ongoing application procedures.

To optimize our website and improve user-friendliness, we will also conduct surveys and ask you for your feedback. No personal data will be collected in the survey. Participation is voluntary and will have no influence on your ongoing application processes.

4.6.1 Legal basis for data processing
In the context of subscription to the newsletter, we will obtain your consent in a single, clearly formulated step to
(a) receiving the newsletter (Art. 6(1)(a) GDPR, in consideration of Section 7 UWG (Gesetz gegen den unlauteren Wettbewerb [Act against Unfair Competition])),
(b) the storing/reading of information on your device (insofar as is necessary for reach analysis; e.g., web beacons, comparable technologies) in accordance with Section 25(1) TDDDG, and
(c) the analysis of open and click events for reach analysis in accordance with Art. 6(1)(a) GDPR.

We do not provide the newsletter without such consent, as reach analysis and the device access required for this are integral components of our newsletter service. You can withdraw your consent at any time with effect going forward; the lawfulness of the processing carried out up until the withdrawal will remain unaffected.

Regardless of these notifications, job-related communication regarding your specific online application (e.g., queries, appointment scheduling, status/decision notifications) for the purpose of initiating an employment contract takes place on the basis of Art. 6(1)(b) GDPR. No tracking is performed in this context.

To document the double opt-in procedure, we will process the IP address as well as the date/time of the registration and confirmation based on our legitimate interest in keeping records (Art. 6(1)(f) GDPR), or, alternatively, for the fulfillment of accountability/record-keeping obligations (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) and Art. 5(2) GDPR).

We conduct anonymous surveys to improve our services based on our legitimate interest in product/service optimization (Art. 6(1)(f) GDPR). If personal data is collected in exceptional cases, we will process it only with your consent (Art. 6(1)(a) GDPR) or collect it in aggregated form/without reference to any persons.

4.6.2 Personal data categories
Within the scope of the processing activity described herein, we will process the following data categories:

Email address
Notification and interest settings
Location/job function preferences
Log data for email delivery (e.g., timestamps)
Communication content
Tracking data: opening time (web beacon), click events incl. timestamps, newsletter version/ID, pseudonymous recipient ID; if applicable, cookie/storage IDs and technical parameters (e.g., email client), insofar as this is required for the analysis

4.6.3 Recipients of personal data
For the processing of your data within the scope of the processing activity described herein, we will use, among other services, the services of various data recipients.
They will be contracted by us through data processing agreements for instruction-based data processing or through agreements governing joint data processing. Further information on the data recipients used by us can be found in Item 6 of this data protection notice.

4.6.4 Retention period or criteria used to determine that period
We will store the settings and contact details required for the newsletter and proactive career notifications for as long as your consent is active. If we receive your withdrawal of consent or you disable the feature in your profile, we will stop sending notifications and promptly delete the personal data stored for this purpose. Legal retention obligations from ongoing online applications will remain unaffected. Your applicant profile may continue to exist independently (cf. Item 4.3); automatic profile deletion due to inactivity is subject to the country-specific periods outlined in the Overview of retention periods and will be notified to you in advance via email.

For anonymized surveys, we will only store non-personal, aggregated results; personal data (if collected in exceptional cases) will be immediately anonymized or deleted as soon as it is no longer required for the corresponding purpose.

4.6.5 Objection and deletion options
You may withdraw your consent to receiving the newsletter and proactive career notifications at any time with effect going forward either via the unsubscribe link in the email or in your profile settings. Upon receipt, we will stop sending notifications and delete the personal data stored for this purpose in accordance with our deletion cycles. You may decline/skip anonymized surveys at any time; doing so does not generate any link to your person.

Communication regarding your submitted application (e.g., inquiries, appointments, decisions) will be conducted independent of the notification settings and on the basis of Art. 6(1)(b) GDPR and will remain unaffected by the withdrawal of your notification consent.

4.7 Logins via single sign-in service providers
We offer several registration options for the initial applicant profile setup (cf. Item 4.3) and subsequent logins via single sign-in service. You can register on the application portal using your credentials from the following providers:

4.7.1 Legal basis for data processing
The legal basis for the use of the services is Art. 6(1)(f) GDPR. Using single sign-in service providers allows us to offer you the ability to register or log in to our application portal more easily and quickly. The legitimate interest is the improvement of user-friendliness. Alternatively, you can also register with an email address and one-time token (cf. Item 4.3).

4.7.2 Personal data categories and storage duration
No personal data of yours will be stored in the application portal in this regard. Please refer to the respective providers’ data protection notices for further information on how long your data will be stored for (see below).

4.7.3 Objection and deletion options
The use of single sign-in service providers is voluntary and occurs only when you select the respective provider and thus enable access to data transmission and authentication.
Please refer to the respective providers’ data protection notices for further information on the objection and deletion options:

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA https://policies.google.com/privacy
Apple Inc., One Apple Park Way, Cupertino, California, USA, 95014 https://www.apple.com/legal/privacy
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland https://www.linkedin.com/legal/privacy-policy
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA https://www.microsoft.com/en-us/privacy/privacystatement

4.8 Contracting of recruitment agencies
Group companies, the Bertelsmann foundations, or partner companies may contract recruitment agencies to find suitable candidates. Until your application data is transmitted to the respective responsible entity (group company/foundation/partner company), the recruitment agency is an independent data controller. The data is usually transmitted electronically (e.g., by creating/updating an applicant profile in the portal).
Upon receipt by the responsible entity, your data will be processed for the hiring decision and the creation of an employment contract in accordance with the information on the online application procedure (cf. Item 4.4).

If you are hired on the recommendation of a recruitment agency, we will process additional information to a strictly limited extent for the billing of the commission (e.g., job title, start date, contractual basis of the commission) and to pay the recruitment agency.

4.8.1 Legal basis for data processing
As a general rule, your data will be transferred to us – by the recruitment agency – on the basis of your consent or a contract between you and the recruitment agency. Upon receipt by us, we will process your data for the evaluation of your suitability and for communications related to the selection process on the basis of Art. 6(1)(f) GDPR (legitimate interest in filling open positions) and – as soon as you are actively included in the specific process – on the basis of Art. 6(1)(b) GDPR (initiation of an employment contract).

The processing of commission-relevant information for the purpose of verification, billing, and payment vis-à-vis the recruitment agency will be based on Art. 6(1)(f) GDPR (legitimate interest in contract fulfillment/vendor management); where legal retention or evidence obligations exist (in particular in relation to commercial/tax law), it will also be based on Art. 6(1)(c) GDPR.

Where recruitment agencies or commissioned service providers are located outside the EU/EEA and if transfers are necessary, we will ensure an adequate level of protection via adequacy decisions (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR, e.g., EU standard contractual clauses). In exceptional cases, a transfer may be based on your express consent pursuant to Art. 49(1)(a) GDPR; you will be informed of this separately in advance. Further information on this can be found in Item 7 of this data protection notice.

4.8.2 Personal data categories
Within the scope of the processing activity described herein, we will process the following data categories:

Identification and contact data: name, title, address, email, telephone, where applicable date of birth.
Application documents: resume, cover letter, certificates/qualifications, work samples.
Job-specific information/suitability data: answers to job-related questions, results of tests/assessments, interview notes, availability and compensation information, work/residency status.
Process and communication data: correspondence, appointment scheduling, minutes, application status and decision.
IT/security/usage data: log data (IP address, timestamp, technical identifiers) to ensure the stability and security of the processes.
Equal opportunity information (voluntary): e. g. gender, where appropriate ethnic origin or socioeconomic background – only with your consent, processed separately.
Sanctions list/compliance data (only if required): for conducting legally/locally mandated sanctions list screening (e.g., check of names, if necessary date of birth/nationality with official lists), including the screening result (match/no match) and audit data (time, source, responsible entity).
Commission/billing data: (only in case of success, minimum requirement: position/start date/fee parameters, invoicing/payment details of the recruitment agency).

4.8.3 Recipients of personal data
For the processing of your data within the scope of the processing activity described herein, we will use, among other services, the services of various data recipients.

4.8.4 Retention period or criteria used to determine that period
We will process application-related data that we receive from recruitment agencies for as long as is necessary for decision-making in relation to the specific process. The purpose of application-related processing ends when the hiring decision is made. We will then only retain documents for the statutory retention periods and will delete or anonymize them after the end of this period (for details, see Item 4.4 and the Overview of retention periods).

4.8.5 Objection and deletion options
You can object to processing that we perform on the basis of legitimate interests (Art. 6(1)(f) GDPR) at any time; we will then no longer process your data for these purposes, unless there are compelling legitimate grounds to do so. You may withdraw any consent you have given to a recruitment agency via said agency; we will then only process the data already transmitted to us to the extent necessary (e.g., to complete the process, to comply with retention obligations). Your rights of access, rectification, erasure/restriction, and data portability remain unaffected.

4.9 Integration of third-party content
We integrate third-party content into our website, in particular media, streaming, and interactive content (e.g., audio, video, or map content) provided by external providers. To do this, we use what are known as widgets or embeddings, which establish a direct connection between your device and the respective provider’s servers.
The integration of this content only takes place if and to the extent that you have given us your consent for it.

Description of data processing
When you visit a page with embedded third-party content and activate it, your browser establishes a direct connection to the servers of the respective provider.

In the process, data is transmitted to the respective provider in order to technically provide and display the content.

Depending on the provider, the processing will include in particular:

Provision and playback of media content
Establishing and maintaining the technical connection
Recording of usage interactions (e.g. starting of content)
Creation of statistical analyses (e.g. view counts)
We have no influence on the further processing of your data by the respective providers.

Providers used and specific features

YouTube
Content from the platform YouTube (YouTube LLC, a subsidiary of Google LLC) is integrated into our website.
A connection to YouTube servers will be established when you play a video. If you are logged into your YouTube account, YouTube can associate your usage behavior with your profile.
Further information:
https://policies.google.com/privacy

RTL (Social Wall)
We have integrated a “Social Wall,” which bundles and displays posts from RTL's social media channels (specifically career and company content) into our website. The provider is RTL interactive GmbH, Picassoplatz 1, 50679 Cologne, Germany. The Social Wall is technically provided by the service walls.io; the provider of this service is Walls.io GmbH, Schönbrunner Straße 213/215, 1120 Vienna, Austria.
When the social wall is loaded, your browser establishes a direct connection to the servers of the aforementioned providers. In the process, your IP address as well as technical connection and usage information (e.g., time of access, browser type, posts viewed) will be processed, in particular, to retrieve and display the content. Cookies or comparable technologies may be used in the process, and statistical analyses regarding access to the content may be created.
If you interact with individual posts (e.g., by clicking on a post or starting an embedded video), additional usage information will be processed; you may be redirected to the pages of the respective social media network as a result. For processing on these pages, the data protection notice of the respective network operator applies exclusively.
Further information: https://plus.rtl.de/datenschutz

Riverty (content from the career blog)
On our website, we embed posts from Riverty’s career blog (the “People Blog”). The provider is Riverty Group GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany.
When you access or activate this content, your browser establishes a direct connection to the provider’s servers or to the delivery services used by the provider. In particular, your IP address, technical connection data (e.g. browser type, operating system, time of access and previously visited page), and information about the posts you access are collected and processed. This data is necessary to provide and display the blog content in your browser.
In this context, the provider may use cookies or similar technologies and may compile statistical analyses of access to the content.
If you follow a link to an external website, you will leave our website. Riverty’s privacy policies apply to data processing on those websites.
Further information: https://www.riverty.com/de/datenschutz/

4.9.1 Legal basis for data processing
Third-party content is integrated and used on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

When your device accesses information during use of the portal (e.g., through cookies or similar technologies), this is done on the basis of consent according to Section 25(1) TDDDG.

We use a consent management tool (CMP) to obtain and manage your consent. In this way, we will obtain – as far as possible – your consent for the inclusion of third-party content in a separate consent area (“bucket”) as soon as you visit our website, in order to enable you to use our content as conveniently as possible.

Unless you have provided the appropriate consent, third-party content will not be loaded straight away. In this case, a separate request for your consent will only be issued when you actively access corresponding content on a subpage.

Without your consent, the content will not be loaded.

4.9.2 Personal data categories
Within the scope of the processing activity described, we will process the following data categories in particular:

IP address
Technical data (e.g., browser type, operating system, device type)
Usage data (e.g. retrieval of content, interactions)
Connection data (e.g. time of access)

The specific scope of the data processing will depend on the respective provider used.

4.9.3 Retention period or criteria used to determine that period
The storage duration of the data processed in the context of the use of third-party content will be determined by technical conditions and the information provided by the respective providers.
You can find further information on this in the data protection notice of the respective providers.

4.9.4 Recipients of personal data
The recipients of the personal data are the respective providers of the embedded content:

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / Google Ireland Limited (Google Maps, YouTube), Gordon House, Barrow Street, Dublin 4, Ireland
RTL interactive GmbH, Picassoplatz 1, 50679 Cologne, Germany
Walls.io GmbH, Schönbrunner Straße 213/215, 1120 Vienna, Austria (technical provision of the social wall)
Riverty Group GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany

These providers will be individually responsible under data protection law for their own processing of your data.

During use, personal data may be transferred to countries outside the European Union or the European Economic Area, in particular to the USA.

You can find further information regarding the recipients of your data and third-country transfers in Item 6 and Item 7 of this data protection notice.

4.9.5 Objection and deletion options
You may withdraw your consent to the integration of third-party content at any time with effect going forward.

The consent may be withdrawn, in particular, through the settings of our cookie consent manager or by using the button to disable external content under Item 4.2 of this data protection notice.

Please note that without your consent, playback of corresponding content is not possible.

5. Processing of special categories of personal data
In principle, no special categories of personal data are collected during the data processing related to your online application. In this respect, when uploading documents such as a cover letter or resume, please ensure that these documents do not contain any special categories of personal data.
Special categories of personal data include information from which racial and ethnic origin, political opinion, religious or ideological beliefs or trade union affiliation can be derived, as well as genetic data, biometric data for the unambiguous identification of a natural person, health data or data on the sexual life or sexual orientation of a natural person.

Due to a legal obligation under labor law, it is necessary to grant participation rights to the representative body for severely disabled persons in the application process, if the employer has established one. Therefore, during the application procedure you may be asked whether you wish to have the participation of the representative body for severely disabled persons or not. The same applies to certain abilities such as vision or physical fitness or agility, if required for filling a position. However, this data will not be collected online in the application portal but by other means, such as in paper form, and will be stored and destroyed in accordance with data protection regulations.

The legal basis for the processing of special categories of personal data is Art. 9(2)(b) GDPR, provided that the processing is necessary for the exercise of rights or for the fulfillment of legal obligations under labor law, social security law and social protection law, and there is no reason to believe that your legitimate interest in the exclusion of the processing prevails.

In exceptional cases, the collection and further processing of special categories of personal data may occur, e. g., to check compliance with equal opportunities regulations. We will obtain your express consent to the data processing, where this is required under Art. 9(2)(a) GDPR.

6. Who will receive my data?
Within the company, the departments that require access to your data to fulfill the purposes set out in Item 4 will receive access to your data. Service providers used by the company may also be granted access to your data (known as "processors," e.g., data centers, hosting services, IT infrastructure support, or web design). Processing agreements are used to ensure that the service providers follow the instructions provided and maintain the data security and confidentiality of your data.

We will only share your data with third parties to the extent that this is necessary for the fulfillment of the agreement, we or the third party have a legitimate interest in the transfer, or you have provided your consent for it. Data may also be sent to third parties where we are required to do so due to legal provisions or enforceable official or judicial orders.

An overview of the specific recipients can be viewed at any time by accessing the following link to an overview: Click

Please note that we will not sell your personal data to third parties. Furthermore, we will not share your data with third parties for direct advertising or other forms of direct marketing, opinion polls, or market research, unless you have given us your consent to do so.
Further information on the specific data recipients can be found in the processing descriptions in Item 4 of this data protection notice.

7. Will my data be processed outside the EU or the EEA (third-country transfer)?
Where the service providers and/or third parties named in Item 4 process your data outside the EU or the EEA for the purposes stated in Item 4, this may result in your data being transferred to a country where a level of data protection equivalent to the level in the EU or the EEA cannot be guaranteed. However, such a level of data protection can be ensured with an appropriate guarantee. For example, standard contractual clauses provided by the EU Commission may qualify as a suitable guarantee. In accordance with the judgment of the European Court of Justice of July 16, 2020 (Case C-311/18), service providers contracted by us in a third country may be required to disclose to us what additional appropriate technical and organizational measures have been implemented to prevent government surveillance mechanisms. If there are any doubts regarding the lawfulness of such data processing, the relevant service providers will be required to adapt their technical and organizational measures.

You can request a copy of these safeguards using the contact details provided in Item 1.

In exceptional cases, safeguards may be not implemented if, for example, you provide consent or if the third-country transfer is necessary for the performance of a contract with the company. The EU Commission has also recognized certain third countries as secure third countries or agreed corresponding certification mechanisms so that, in these cases, the company may also decide not to provide the appropriate safeguards as described above.

A third-country transfer occurs in the following cases, among others:

For the use of web tracking services (see Item 4.2), service providers whose data centers are located in a third country or who have access to data centers within the European Union or the EEA from a branch office in a third country are used. The Company has agreed compliance with the European level of data protection with these service providers through standard contractual clauses in accordance with Art. 46(2)(c) GDPR. If no standard contractual clauses have been agreed with the corresponding service providers, data will be transferred only if you have consented to the processing in accordance with Art. 49(1)(a) GDPR or a corresponding certification mechanism ensures the security of the data transfer.

In the context of the candidate/talent pool (see Item 4.5): Authorized recruiters at the Bertelsmann companies, the Bertelsmann foundations, as well as selected partner companies can – depending on their location – access your general profile from third countries (e.g., master data, contact details, career history, qualifications, preferences/availability). Position-specific information from ongoing applications is not part of the pool; we will only process special categories with explicit consent. Where there is access from/transfer to a third country, this will primarily be based on Art. 45 GDPR (adequacy decision) or Art. 46 GDPR (standard contractual clauses incl. supplementary measures, access and need-to-know restrictions). If, due to exceptional circumstances, an adequate level of protection cannot be ensured, the data will be transferred only on the basis of your explicit consent pursuant to Art. 49(1)(a) GDPR. If you withdraw your participation in the talent pool, future access will be blocked; transfers that have already taken place will remain unaffected and will be subject to the regulations of the respective recipients.

In the context of the application process (see Item 4.4): The application may – particularly in the case of recruiting structures organized internationally or by business, service, or product areas – be processed by responsible employees or recruiters from affiliated companies or organizational units located outside the EU or the EEA. This may, for example, be the case if a position is advertised within the EU or EEA, but the recruiting department responsible for the application process is located in a third country. In these cases, the data required for the application process can be viewed from the relevant third country or transmitted thereto. Access is limited to the respective responsible persons and the data required for the application process. Where a transfer to a third country takes place, this will primarily be based on an adequacy decision by the EU Commission pursuant to Art. 45 GDPR or on appropriate safeguards pursuant to Art. 46 GDPR, in particular standard contractual clauses including necessary supplementary measures.

8. What data protection rights do I have?
You have the right to access information the personal data we have stored about your person at any time. If your personal data is incorrect or no longer up to date, you have the right to request that it be corrected. You also have the right to request the erasure of your data or the restriction of its processing in accordance with Art. 17 or Art. 18 GDPR. You may also have the right to receive the data provided by you published in a commonly used and machine-readable format ("right to data portability"). If you have given consent to the processing of personal data for specific purposes, you may withdraw your consent at any time with effect going forward. Withdrawal of consent should be addressed to the company at the contact address provided in Item 1. In accordance with Art. 21 GDPR, you also have the right to object, on grounds relating to your particular situation, at any time to the processing of your data on the basis of Art. 6(1)(f) GDPR.

You also have the option of contacting a data protection authority and lodging a complaint there. The authority responsible for the company is the

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia

Kavalleriestraße 2 – 4
40213 Düsseldorf
0211 38424 0
poststelle@ldi.nrw.de
However, you can also contact the data protection authority responsible for your place of residence.

9. How do we ensure the security of processing?
The company takes all the necessary technical and organizational measures to protect your data against unauthorized access, disclosure, destruction, or other unauthorized processing. The security measures include firewalls, encryption, the use of secure IT environments, access controls, training for employees who work with your data, and the careful selection of processors who process personal data for us in accordance with our instructions. Furthermore, access to your data is restricted to persons who need your data to fulfill their tasks.

10. To what extent does automated decision-making take place?
We do not use automated decision-making within the scope of Art. 22 GDPR for the purposes specified in Item 4.

11. Is profiling performed?
For the purposes specified in Item 4, no profiling within the scope of Art. 22 GDPR is performed.

12. Updating of the data protection notice
Should this data protection notice be changed, notice of the change will be provided in this Notice, on the website, and in other appropriate places.

Provider	Description	Enabled
Google Tag Manager	Google Tag Manager is a tag management system for conversion tracking, website analytics, remarketing and more. The following tracking providers are integrated via the Google Tag Manager: Instagram https://privacycenter.instagram.com/policy/ Google https://policies.google.com/privacy?hl=en-US LinkedIn https://www.linkedin.com/legal/privacy-policy Performance Advertising https://www.adition.com/datenschutz/ Pinterest https://policy.pinterest.com/en/privacy-policy Twitter https://twitter.com/de/privacy	Consent to cookies from provider GoogleTagManager
LinkedIn	LinkedIn is an employment-oriented social networking service. We use the Apply with LinkedIn feature to allow you to apply for jobs using your LinkedIn profile. Opting out of LinkedIn cookies will disable your ability to use Apply with LinkedIn. Cookie Policy Cookie Table Privacy Policy Terms and Conditions	Consent to cookies from provider LinkedIn
Google	Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Cookie Information Privacy Policy Terms and Conditions	Consent to cookies from provider Google