Data protection information for candidates
Preliminary note
This data protection information describes all data processing procedures carried out by DEKRA SE and its group companies regarding recruitment and selection of candidates/new DEKRA-employees. Such recruitment and selection process mainly happens via the DEKRA candidate portal. With the following information, we would like to provide you with an overview of how your personal data is processed by us, as well as your rights under data protection law.
Any data processing described herein will be conducted in accordance with the Regulation (EU) 2016.679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”).
By creating a user profile in our candidate portal and consequently providing us with your personal data, you acknowledge having read and understood this data protection information notice.
Who is responsible for data processing, and whom can I contact?
- If you create a candidate profile independently of an application and do not make your profile visible to other group companies, DEKRA SE remains the sole controller.
- If you apply to a position at one of our group companies, the specific company will receive access to the information you decide to share with them and will act as an independent controller for the next steps in the application process. For more information on how they process your personal data, please refer to the further information in the respective job advertisement and on our website.
- If you make your candidate profile visible to recruiters from participating group companies worldwide or nationally, without applying for a specific position the following group companies acting as joint controllers will have access to your data, depending on your selection:
DEKRA Belgium NV
registered in the Belgian Crossroads Bank of Enterprises under BE0471.948.055,
Leuvensesteenweg 510, box 4.30, 1930 Zaventem, Belgium
DEKRA SE
registered in the commercial register of the Stuttgart District Court under HRB 734316,
Handwerkstr. 15, 70565 Stuttgart, Germany
For any general questions and queries regarding the collection and processing of your personal data, please contact the contact persons mentioned in the respective job advertisement.
Should you have any questions about your rights as a data subject or would like to exercise these rights, please contact the data protection officer of the relevant DEKRA company via the contact address provided above.
What data (sources) do we use?
We process personal data for the purpose of enabling the use of the DEKRA candidate portal, and for carrying out selection procedures to establish an employment relationship:
- which has been received directly from you as part of the candidate process, or the creation of your account and candidate profile, or with your explicit permission.
What do we process your data for (purpose of processing), and on what legal basis?
We process your personal data in accordance with the provisions of all applicable data protection laws.
A. For the purpose of the technical provision of the website
Insofar as you visit our website, it is necessary for the purpose of the website’s technical provision (and ensuring the requisite system security) that we process certain information automatically transmitted by your browser so that our website can be displayed in your browser and you can use the website. This information is automatically collected each time our website is accessed and automatically stored in so-called server log files; this information essentially comprises:
- IP address of the requesting computer
- Host name of the accessing computer
- Recognition data of the browser and operating system used
- Date and time of access
- Website from which the access is made (referrer URL)
Legal basis
In this regard, it is in our legitimate interest that we can make our website and candidate portal available to you (art. 6 (1) lit. f GDPR).
B. For the purpose of creating a user account and candidate profile
In the event that you create a user account in our candidate portal, we process your personal data for the purpose of creating and managing the user account for the DEKRA candidate portal. Insofar as you create a candidate profile within your user account and provide us with information about your career and qualifications, we process your personal data for the purpose of enabling the creation and management of your candidate profile.
This primarily comprises personal information, address data, communication data, access data (e-mail address, password), as well as data pertaining to your professional experience and qualifications.
Legal basis
When we process your personal data for this purpose, we rely on our contract we conclude with you for your access and use to the platform’s services (see terms of use) (Art. 6 (1) lit. b GDPR).
C. For the purpose of communication
For the purpose of communicating with you, we process personal data, in order to respond to your inquiries or to communicate with you in the context of job recruitment procedures, and to send you pre-contractual documents.
This may include, in particular, your first name, last name, home address, e-mail address, telephone number and, if applicable, contract data.
Legal basis
Our legitimate interest here is to be able to stay in touch and communicate with you in the context of inquiries and vacancy procedures (Art. 6 (1) lit. f GDPR). This is to ensure smooth preparation of job placements and support of interested parties.
D. For the purpose of inclusion in a candidate pool
In the event that you provide us with your consent to store your personal data for the purpose of worldwide or nationwide matching with future job profiles in the context of selection procedures for possible employment, we will process your personal data in accordance with your selection for the purpose of notifying you by e-mail about jobs that match the requirements and qualifications you have indicated.
This may include, in particular, your personal information (title, last name, first name), address data (street, house number, postal code, city), contact data (private e-mail address, social media profiles), the preferred language of communication, candidate documents (cover letter, resume, references, salary requirements, notice period, possible start date), individual responses (how did the candidates become aware of the position, is the candidates of legal age, willing to relocate), previous activities, language skills and interests.
Legal basis
We will only process your personal data to include you in our candidate pool if you have given your explicit consent thereto (Art. 6 (1) lit. a GDPR). You can withdraw your consent at any time with effect for the future in any appropriate form. Your withdrawal of consent will not affect any earlier processing of your personal data.
E. For the purpose of conducting a selection process for possible employment
In the event that you apply for a specific position or have given us your consent to store your candidate data in our candidate pool for suitable positions in the future, we process your personal data in the context of job filling procedures for the purpose of assessing your candidacy and conducting a selection and recruitment process for possible employment. For this purpose, your personal data will be transferred to the DEKRA company that has advertised the vacancy.
This may include, in particular, your first name, last name, address, country, e-mail address, telephone number, work experience, qualifications, references and language skills.
Legal basis
We will process your personal data based on the necessity of doing so in order to reach a potential agreement with you (e.g., an employment contract) (Art. 6 (1) lit. b GDPR).
F. For the purpose of sending the newsletter (information about career opportunities) and sending the job newsletter
In the event that you provide us with your consent to send you regular information about career opportunities by e-mail or to inform you about jobs of interest to you via our job newsletter, we will process your personal data for the purpose of informing you by e-mail.
This may include, in particular, your first name, last name, e-mail address and your selection based on the filters set in the candidate profile.
We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will first send you a confirmation e-mail asking you to confirm that you wish to receive future newsletters by clicking on an appropriate link.
When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. We also store your registration to prove that you have registered and agreed.
You may unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter, or by withdrawing your declaration of consent vis-a-vis the data controller.
For the purpose of sending the newsletter, we store your data until you withdraw your consent or until the newsletter is permanently discontinued. For the purpose of proving consent, no longer than by the end of the fourth calendar year following the last advertising e-mail dispatch.
Legal basis
We will only process your personal data for the purpose of sending you our newsletter if you have given your explicit consent thereto (Art. 6 (1) lit. a GDPR). You can withdraw your consent at any time with effect for the future in any appropriate form. Your withdrawal of consent will not affect any earlier processing of your personal data.
Other Circumstances
Apart from the abovementioned circumstances, we may additionally be obligated to process any of your personal data mentioned above when
- we need to comply with legal obligations or to comply with any reasonable request from competent law enforcement agents or representatives, judicial authorities, governmental agencies or bodies, including competent data protection authorities;
- we need to defend ourselves in legal proceedings or against possible legal claims, and when it is in our legitimate interest to use your personal data in these proceedings;
- we need to inform a third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the EU, in which case we rely on our legitimate interest to engage in corporate transactions.
Who receives my data?
In order for us to process your data in accordance with the purposes described above, it may also be necessary to provide other recipients with your data for processing.
Within our group of companies, your data will also be transferred to other companies if they have advertised the vacant position or perform data processing tasks centrally for the companies affiliated in the group (e.g. IT services, HR support, disposal of files, etc.). Information on data protection is available on the website of the respective DEKRA company, or on DEKRA’s data protection portal (Data privacy notice).
With regard to the transfer of data to recipients outside the DEKRA Group, we only pass on information if this is required by law, if the candidate has issued their consent, or if this is necessary, in order to protect our legitimate interests.
Under these conditions, the recipients of personal data may include, for example, service providers and vicarious agents employed by us who receive data for these purposes, provided they observe confidentiality and data protection requirements, in particular. These can be companies operating within HR and IT services, telecommunications and consulting categories, for example. We ensure that your personal data is used in accordance with your instructions by concluding group-internal data processing agreements and with commissioned service providers.
The processing operations described in this data protection notice are processed via the SuccessFactors candidate of SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf. A corresponding data processing agreement has been concluded with SAP to this end, which ensures that your personal data is processed by SAP in accordance with instructions and in compliance with the requirements of data protection law. For more information pertaining to data privacy at SAP, see the SAP Data Protection Declaration and the Data Protection Area of the SAP Trust Center.
Is data transferred to a third country or to an international organization?
We do not transfer your personal data outside the European Economic Area (EEA). If a transfer were to take place, we will take sufficient safeguards to protect your personal data during the transfer (e.g. by entering into an agreement based on standard data protection clauses approved by the European Commission).
How long will my data be stored?
We generally store your personal data for a period of four (4) months after the end of the process. If you have consented to be included in our candidate pool, we will process your data for this purpose for a maximum of two (2) years, or when you withdraw your consent.
Other data processing based on consent shall be carried out at the longest until the time of withdrawal of your consent. We store any consent given to us for a period of four (4) years from the time of its revocation or expiry.
In addition, we store your data for the purpose of complying with statutory retention periods, and for exercising legal claims or defending against legal claims within the scope of the statutory limitation provisions.
What data protection rights do I have?
You are entitled to the following statutory data subject rights, provided that their requirements are met:
- Right of access to information about any data stored by us about you in accordance with Art. 15 GDPR,
- Right to the rectification of inaccurate data pursuant to Art. 16 GDPR,
- Right to erase the data stored by us in accordance with Art. 17 GDPR,
- Right to restrict the processing of data stored by us in accordance with Art. 18 GDPR,
- Right to data portability according to Art. 20 GDPR,
- Right to lodge an objection according to Art. 21 GDPR,
- Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of personal data concerning you violates the provisions of the GDPR.
You can exercise these rights by contacting us as set out below. We reserve the right to refuse multiple requests for access that are clearly submitted for causing nuisance or harm to us or others. An e-mail requesting to exercise a right will not be construed as consent for the processing of your personal data beyond what is required for handling your request. Such requests should clearly state and specify which right you wish to exercise and the reasons for it if such is required. It should also be dated and signed, and – in general – be accompanied by a digitally scanned copy of your valid identity card proving your identity.
We will promptly inform you of having received this request. If the request proves valid, we will notify you as soon as reasonably possible and at the latest thirty (30) days after having received the request.
If you have a complaint about the processing of your personal data by us, you can always contact us as set out below. If you are not satisfied with our response, you may lodge a complaint with the competent data protection authority, being the data protection authority of the country of your habitual place of residence, place of work or the place of an alleged infringement.
For the contact details, please refer to the relevant data controller mentioned above or please contact konzerndatenschutz@dekra.com to receive the necessary information.
Is there an obligation for me to provide data?
You are not obliged to provide us with personal data. In the context of an application procedure, however, you must provide us with the personal data that is required for the procedure itself, in order to participate as a candidate in a selection process.
To what extent is there automated decision making?
In order to carry out a procedure or facilitate the use of a candidate profile in the DEKRA candidate portal, we do not use fully automated decision-making in accordance with Article 22 GDPR.
Information about your right to lodge an objection according to Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) lit. f GDPR (data processing on the basis of a balance of interests). This also applies to profiling based on this provision within the meaning of Art. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
Recipient of an objection
The objection can be made informally with the subject “Objection”, stating your name and any additional authentication features that may become necessary. To do so, please contact the data controller or the data protection officer by e-mail, as set out in this privacy policy.
Version and amendment of this data protection declaration
The version of this data protection declaration is March 2025.
The further development of our company may also have an impact on the handling of personal data. We, therefore, reserve the right to amend this data protection declaration in the future within the framework of the applicable data protection laws and, if necessary, to adapt it to changed data processing realities. We will notify you separately of any significant changes to the content.
