SPRIND Bundesagentur für Sprunginnovationen DATA PROCESSING INFORMATION FOR CANDIDATES AND STAFF OF SPRIND GMBH AND ITS SUBSIDIARIES DATED 12 APRIL 2022 In order to process your application in the hiring process and any subsequent employment relationship with SPRIND GmbH or one of its subsidiaries, we need to process some of your personal data. Below we explain which of your personal data we process, and how and why we process it. We provide this information to fulfill our information obligations under data protection law. 1. Data controller The data controller as defined by the General Data Protection Regulation (GDPR) is SPRIND GmbH, having its registered office at SPRIND GmbH, Lagerhofstraße 4, 04103 Leipzig. 2. The controller’s data protection officer If you have any questions about data protection, please contact the data protection officer acting for SPRIND GmbH at the business address: SPRIND GmbH, Lagerhofstraße 4, 04103 Leipzig, email: datenschutz@sprind.org. 3. Types of data processed During the hiring process and in a subsequent employment relationship, we process the following categories of your personal data: - Master data (including name, gender and date of birth); - Contact details (including address, email address and telephone number); - Application documents (including covering letters, letters of reference, CV and photograph); - Information about your professional career and skills (including education and training, professional experience, additional qualifications); - For online applications submitted via our homepage, user and usage data (including IP address, name of file accessed, data and time of access, volume of data transferred, access confirmation, web browser). If we subsequently enter into an employment relationship with you, we will also process the following categories of personal data: - Bank details, - Social insurance data, - Disciplinary warnings, - Letters of reference, - Periods of leave, and - Health data/periods of sick leave, - Electronic image data, on the basis of consent or a statutory authorization. 4. Purpose of processing All personal data are processed for the following purposes only: - To initiate, establish, execute and terminate an employment relationship with SPRIND GmbH or one of its subsidiaries, - To submit reports and declarations based on statutory obligations or otherwise permitted by law, - To comply with our obligations under tax and social insurance law, - To protect and enforce our legitimate interests, - To investigate criminal offenses, where necessary, - To direct and organize the entity and provide shared services by SPRIND GmbH for its subsidiaries. 5. Legal basis The basis according to which your data are processed is: – Article 6 (1) Sentence 1 b) GDPR in conjunction with Sec. 26 (1) BDSG (“Bundesdatenschutzgesetz”: German Federal Data Protection Act), – Article 6 (1) Sentence 1 c) GDPR in conjunction with Sec. 26 BDSG, – Article 6 (1) Sentence 1 f) GDPR in conjunction with Sec. 26 (1) Sentence 2 BDSG, – Article 9 (2) b) GDPR in conjunction with Sec. 26 (3) BDSG, where special categories of personal data are processed. 6. Recipients of data Your data will only be shared with the shareholder of SPRIND GmbH (Federal Republic of Germany), with subsidiaries of SPRIND GmbH and – where we use external service providers to process personal data in accordance with Article 28 GDPR – with a processor, except where we are required by law to disclose your data to other bodies. A data transmission to subsidiaries of SPRIND GmbH only takes place, if the purpose of the data processing relates to a subsidiary of SPRIND GmbH. 7. Storage period The data will be erased as and when they are no longer required for the purpose for which they are processed. Your data will be stored for the duration of the employment relationship and as a rule for an additional period of three years after the cessation of employment. After this time, they will be erased. Data will only be stored for a longer period if and where we are required to do so by law in a specific case, or where a longer period of storage is required for the purpose for which they are processed. 8. Data subject rights You have the right at any time to – withdraw your consent in accordance with Article 7 (3) GDPR. If you do so, the data processing for which consent was given may no longer be continued in the future; – obtain access in accordance with Article 15 GDPR to the personal data concerning you which are being processed. This includes, but is not limited to, access to the purposes of processing, the categories of personal data concerned, the categories or recipient to whom the data have been or will be disclosed, the envisaged period of storage, the existence of the right to request rectification, erasure, restriction of processing of personal data or to object to such processing, the existence of a right to lodge a complaint, the source of the data where the personal data were not collected from the data subject, and to the existence of automated decision- making, including profiling and, at least in those cases, meaningful information about the logic involved; – obtain without undue delay in accordance with Article 16 GDPR the rectification of inaccurate personal data or the completion of incomplete personal data stored by the controller; – obtain the erasure of personal data in accordance with Article 17 GDPR, except where processing is not necessary to exercise the right of freedom of expression and information, to comply with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims; – obtain in accordance with Article 18 GDPR restriction of processing of personal data where you contest the accuracy of the personal data, the processing is unlawful but you oppose their erasure, and where the controller no longer needs the personal data but they are required by you for the establishment, exercise or defense of legal claims, or you have objected to processing pursuant to Article 21 GDPR; – receive in accordance with Article 20 GDPR the personal data which you have provided in a structured, commonly used and machine-readable format and to transfer those data to another controller; and – lodge a complaint with a supervisory authority in accordance with Article 77 GDPR. As a rule, you may address complaints to the supervisory authority at your habitual residence, place of work or our registered office. 9. Right to object If personal data are processed on the basis of legitimate interests in accordance with Article 6 (1) Sentence 1 f) GDPR, under Article 21 GDPR you have the right to object to the processing of your personal data on grounds relating to your particular situation. To exercise your right to object, please send an email to datenschutz@sprind.org.