We, the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation), take the protection of your personal data and its confidential treatment extremely seriously. Therefore, we wish to inform you about the processing of your personal data in the course of the application process with us and the rights to which you are entitled. The processing of your personal data takes place exclusively within the framework of the applicable statutory provisions of data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

• I. Who is responsible for the data processing and who is the data protection officer?
• II. What is the subject matter of data protection?
• III. What personal data relating to me will be processed?
• IV. What are the purposes of the processing of my personal data and on what legal basis does this take place?
• V. Am I required to provide my personal data?
• VI. Who has access to my personal data and which recipients obtain it?
• VII. Will my personal data be transferred to third countries?
• VIII. For how long will my data be stored?
• IX. What are my rights as a data subject?
• X. Who can I contact if I have any questions or wish to assert my rights as a data subject?

I. Who is responsible for the data processing and who is the data protection officer?

1. The controller for the processing of your personal data is:

• Deutsche Forschungsgemeinschaft e. V. (DFG)
  Kennedyallee 40
  53175 Bonn
  Germany
  Tel. +49 0228 885-1
  postmaster@dfg.de
  www.dfg.de/en

2. You can contact our data protection officer as follows:

• Attorney-at-law Dr. Philip Lüghausen
  BHO Consulting GmbH
  Vorgebirgstraße 132
  50969 Köln
  Germany
  Tel. +49 (0) 221 204 63 884
  dfg-dsb@bho-consulting.com
  www.bho-consulting.com/en

II. What is the subject matter of data protection?

The subject matter of data protection is personal data. This is all information which relates to an identified or identifiable natural person (so-called data subject). For example, this includes information such as name, postal address, email address or telephone number.

III. What personal data relating to me will be processed?

In the course of the application process, we only process personal data relating to you which is connected to your application and which is necessary to determine your personal and professional capabilities in relation to the vacancy to be filled.

Specifically, this may include:

• Contact information, including your name, address and telephone number
• Your nationality, place and date of birth
• Data concerning your education and qualifications
• Data concerning any further professional development and additional qualifications
• Other data from your CV, should you have provided us with such data
• Gender
• Special categories of personal data, such as, if necessary, information concerning a severe disability, should you have notified us of this

You yourself essentially determine the scope of the personal data by sending us your application documents.

We supplement your application documents in the course of the application process with the following additional data:

• Notes concerning the progress of the application process
• Correspondence with you (for example confirmation of receipt)

IV. What are the purposes of the processing of my personal data and on what legal basis does this take place?

Below, we wish to provide you with an overview of the purposes and legal basis of the processing of your personal data in the course of the application process:

1. Data processing for the purpose of the application process

We process the personal data which we receive from you in order to process your application for a specific job vacancy or your speculative application solely for the purpose of taking a decision as to whether we wish to enter into an employment relationship with you or not.

The legal basis for the processing of your personal data is Article 88 Paragraph 1 GDPR and § 26 Paragraph 1 Sentence 1 and Paragraph 8 Sentence 2 BDSG, according to which personal data of applicants may be processed for the purposes of the employment relationship, should this be necessary when taking a decision as to whether to enter into an employment relationship or not.

Data concerning your person which may represent special categories of personal data in accordance with Article 9 Paragraph 1 GDPR is processed by us exclusively on the basis of § 26 Paragraph 3 Sentence 1 BDSG or Article 9 Paragraph 2 GDPR, i.e. only if legal justification exists for the intended processing.

This includes data concerning any severe disability that you may have. Should you have provided us with this data, we will process it in order to comply with our legal obligation under § 164 of the German Social Code IX (SGB IX). In such a case, the data processing takes place in accordance with Article 88 Paragraph 1 GDPR and § 26 Paragraph 3 Sentence 1 BDSG, as well as § 164 SGB IX.

Should an employment relationship come into existence between us, we will not delete the data from the application process, but enter it into your employee file. We will then process it for the purpose of carrying out the employment relationship in accordance with Article 88 Paragraph 1 GDPR and § 26 Paragraph 1 Sentence 1 BDSG. We will provide you with more precise information about the above in separate form.

Should your application not be successful, we will either continue to store your application documents with your consent in accordance with Number 2 or delete them after a maximum of six months – please refer to the information under Number 4 in this respect.

2. Consent

Under certain circumstances, we will also process your personal data on the basis of a declaration of consent which you have submitted. The purpose of the processing is stated in the content of the declaration of consent.

This may be applicable in the following cases:

• Your application cannot currently be considered for the position for which you have applied. However, you have permitted us to further process your personal data in order to offer you other positions at the DFG for which you may be suitable.

Data processing takes place in accordance with point (a) of Article 6 Paragraph 1 GDPR and § 26 Paragraph 2 BDSG.

You can withdraw your consent at any time. However, in such a case, please bear in mind that this withdrawal is only effective for the future, which means that the lawfulness of the data processing which has taken place with your consent prior to the withdrawal is not affected by the withdrawal.

We will erase your data once it is no longer necessary for the purposes pursued by us, once the storage period specified in the declaration of consent has expired or should you have revoked your consent and no other legal basis is present. Should the latter situation apply, we erase the data once the other legal basis is no longer applicable.

3. Fulfilment of legal obligations

Under certain circumstances, we will also process your personal data in order to comply with legal obligations, for example under commercial, tax, financial or criminal law. In such a case, the purposes of the processing are determined by the legal obligation. As a rule, the processing takes place in order to comply with state monitoring and information obligations.

To this extent, the data is processed in accordance with point (c) of Article 6 Paragraph 1 GDPR.

We will erase the data once the legal obligation no longer applies and provided that no other legal requirements, in particular statutory or contractual retention periods, apply.

4. Processing in order to safeguard legitimate interests

Where necessary, we also process your personal data in order to safeguard our legitimate interests. We only then process your personal data if, following a balancing of our interests in carrying out the processing against any potentially conflicting interests, basic rights and basic freedoms on your part, we come to the conclusion that our interests take priority.

This may be applicable in the following cases:

• Defending legal claims which are brought in connection with the application process. In such a case, our legitimate interest is represented by the burden of proof in legal proceedings under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz).

Here, our legitimate interests consist in pursuing the above-mentioned purposes.

To this extent, data processing takes place in accordance with point (f) of Article 6 Paragraph 1 GDPR.

Should no employment relationship come into existence between us and should you not have consented to the continued storage of your application documents in accordance with Number 2, we will continue to store your personal data for a further six months following the conclusion of the application process.

V. Am I required to provide my personal data?

You are not obliged to provide us with personal data. However, the provision of personal data is necessary in order to carry out the application process and to decide whether to enter into an employment contract with you. Should you not provide us with all of the necessary personal data for the application process at the time of submitting your application documents, we will be unable to consider you for the position.

VI. Who has access to my personal data and which recipients obtain it?

Within the DFG, only those departments and their employees who strictly require access to your personal data in order to carry out their functions or tasks have access to it. These are the employees of the personnel management department, the relevant specialist department and the employee interest representatives or responsible persons (equality officer and severe disability officer).

We only pass your personal data on to external recipients if a legal basis exists for this or if you have given your consent to such. Possible external recipients include:

• Processors: Service providers who are used by us to provide personnel services or who are involved in the maintenance of our IT systems. These processors are carefully selected by us and are regularly audited in order to ensure that your personal data remains protected. The service providers may only process your personal data for the purposes stated by us.
  The application portal is operated by concludis GmbH, Frankfurter Str. 561, 51145 Cologne, Germany on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen and hosted in the data centres in Nuremberg and Falkenstein, Germany. Alongside hosting, concludis also carries out the service and maintenance of the application management software. As parts of its service, it also provides advice by telephone concerning the handling of the software.
• Public bodies: Authorities and state institutions, for example public prosecutor's offices, courts or financial authorities to whom we must provide personal data in individual cases.

VII. Will my personal data be transferred to third countries?

Your personal data is not transferred to third countries in the course of the application process.

VIII. For how long will my data be stored?

Please see the relevant section concerning data processing under Number IV. in order to find out for how long your personal data is stored.

IX. What are my rights as a data subject?

You are entitled to the following rights in connection with the processing of your personal data:

1. Right of access

You have the right to receive confirmation from us as to whether we process personal data relating to you or not. Should this be the case, you have the right to receive information concerning your personal data and to receive further details concerning the processing.

2. Right to rectification

You have the right to request the rectification of incorrect personal data relating to you and to have incomplete personal data completed.

3. Right to erasure (“right to be forgotten”)

Under certain circumstances, you have the right to request that we erase your personal data. For example, this right exists if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed or if the personal data was processed unlawfully.

4. Restriction of processing

Under certain circumstances, you have the right to request that the processing of your personal data be restricted. In such a case, we will only store such personal data in relation to which you have given your consent or processing is permitted by the GDPR. For example, you may have a right to restrict processing if you have disputed the correctness of your personal data.

5. Data portability

Should you have provided us with personal data under a contract or with your consent, then provided that the statutory requirements are met, you can request to receive the data which you have provided in a structured, commonly used and machine-readable format or request that we transfer this data to another controller.

6. Withdrawal of consent

Should you have given us your consent to the processing of your personal data, you can withdraw this at any time with effect for the future. The lawfulness of the processing of your personal data prior to the withdrawal remains unaffected by this.

7. Objection against processing on the basis of a “legitimate interest”

8. Right to complain to the supervisory authority

You also have the right to lodge a complaint with the responsible supervisory authority, should you consider that the processing of your data breaches applicable laws. For this purpose, you can contact the data protection authority which is responsible for your place of residence, place of employment or the location of the alleged breach or the data protection authority which has jurisdiction over us. The supervisory authority of the German Federal State in which you reside or work or where an alleged breach which forms the subject of the complaint has taken place holds jurisdiction.

X. Who can I contact if I have any questions or wish to assert my rights as a data subject?

Should you have any questions concerning the processing of your personal data or should you wish to assert your rights as a data subject which are set out in Number IX. 1-7, you can contact us free of charge. Please use the contact details under Number I. 1. To withdraw your consent, you can also use the contact channel which you selected when submitting the declaration of consent.