Information on Data Processing for Applicants and Permanent Staff of Common Codes GmbH

Dated: 01.07.2026

Conducting the selection process following receipt of your application, as well as any employment relationship subsequently established, requires us to process some of your personal data. Below, we inform you which of your personal data we process, in what manner, and for what purpose.

This information is provided in fulfilment of the disclosure obligations arising for us from data protection law.

1. CONTROLLER

Common Codes GmbH Zionskirchstraße 73a 10119 Berlin

2. DATA PROTECTION CONTACT

If you have any questions regarding data protection, please contact us at the business address stated above or by email: privacy@common.codes

3. PERSONAL DATA

In the context of initiating an employment relationship or during an employment relationship, we process the following categories of your personal data:

  • Basic data (this includes e.g.: name, gender, date of birth);
  • Contact data (this includes e.g.: address, email address, telephone number);
  • Application documents (this includes e.g.: letters, references/certificates, CV, photo);
  • Data on professional development and acquired knowledge (this includes e.g.: education and training, professional experience, additional qualifications);
  • Following implementation of the company's own website, in the case of online applications, usage and inventory data (this includes e.g.: IP address, name of the file retrieved, date and time of retrieval, volume of data transferred, notification of successful retrieval, web browser).

In the event that an employment relationship is established with you, we additionally process the following categories of personal data:

  • Bank account details,
  • Social data,
  • Warnings/reprimands,
  • References/certificates,
  • Holiday periods and health data/periods of incapacity for work,
  • Electronic image data, insofar as consent has been granted for this or a statutory authorisation exists.

4. PURPOSES OF PROCESSING

All personal data is processed exclusively for the following purposes:

  • Initiation, establishment, performance, and termination of the employment relationship,
  • Submission of notifications and declarations that are based on a statutory obligation or are otherwise permitted by law,
  • Fulfilment of the obligations arising for us from tax and social security law,
  • Safeguarding and enforcement of our legitimate interests,
  • Investigation of criminal offences, insofar as this is necessary,
  • Management and organisation within the company.

5. LEGAL BASIS

The legal bases for the processing of your data are:

  • Art. 6 I 1 b) GDPR in conjunction with § 26 I BDSG,
  • Art. 6 I 1 c) GDPR in conjunction with § 26 BDSG,
  • Art. 6 I 1 f) GDPR, where applicable in conjunction with § 26 I 2 BDSG,
  • Art. 9 II b) GDPR in conjunction with § 26 III BDSG, insofar as special categories of personal data are processed.

6. DATA RECIPIENTS

Your data is passed on exclusively to Common Codes GmbH and – insofar as we make use of external service providers for the processing of personal data pursuant to Art. 28 GDPR – to a so-called processor, unless we are legally obliged to pass on your data to other bodies.

7. STORAGE PERIOD

The data is deleted as soon as it is no longer required for the purpose of its processing. In most cases, we retain your application for 6 months.

Your data is stored for the duration of the employment relationship and beyond, generally for a period of three years from the termination of the employment relationship, and is then deleted. Longer storage occurs only if and insofar as we are legally obliged to do so in an individual case, or insofar as longer storage continues to be necessary for the purpose of its processing.

8. DATA SUBJECT RIGHTS

In accordance with the statutory provisions, you have the right at any time

  • of access to the personal data and to obtaining a copy of the personal data undergoing processing (Art. 15 GDPR)
  • to rectification of inaccurate personal data and to have incomplete personal data completed (Art. 16 GDPR)
  • to erasure of personal data, as well as, where the personal data has been made public, to informing other controllers of the request for erasure (Art. 17 GDPR)
  • to restriction of processing (Art. 18 GDPR)
  • to data portability, i.e. to receive the personal data provided in a structured, commonly used and machine-readable format (Art. 20 GDPR)
  • to withdraw consent at any time, insofar as you have granted us your consent (Art. 7 III GDPR)
  • pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority of your habitual residence, place of work, or the place of our company's registered office.

9. RIGHT TO OBJECT

Insofar as personal data is processed on the basis of legitimate interests pursuant to Art. 6 I GDPR, you have the right, on grounds relating to your particular situation, to object at any time pursuant to Art. 21 GDPR to the processing of your personal data. In that case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.