Data Protection - Applicants

1. Name and contact details of the controller

novacare GmbH

Bruchstr. 48

67098 Bad Dürkheim

2. Contact details of the data protection officer

DSBX GmbH

Gablonzer Street 4

76185 Karlsruhe

E-mail: novacare@dsbx.one

3. Purposes and Legal Bases for Data Processing

Applicant Management We process personal data provided to us by email,
By post or via online portals (such as Stepstone or the Federal Employment Agency)
to execute the application process and to decide on
the establishment of an employment relationship. The legal basis is § 26 para.
1 BDSG.

Carrying out the employment relationship Within the scope of the employment relationship, through
in addition to the standard personnel file, performance and conduct data (such as
(Goal achievement and feedback) is processed. The legal basis is § 26 para. 1
BDSG.

Processing of special categories of personal data: So far as within the scope of
Personnel administration Employee health data are processed,
Is this for the exercise of rights or the fulfilment of legal obligations
from labour law, social security and social protection law.
The legal basis is Article 9(2)(b) GDPR in conjunction with Section 26(3) BDSG.

Payroll For the purpose of proper payroll accounting and the
Billing data is processed to fulfil statutory reporting obligations.
The legal basis is Article 6(1)(c) GDPR in conjunction with national
tax and social security regulations.

Internal Communication and Cooperation (Collaboration): Zur Organisation der
We use email and Microsoft Teams for operational processes. Additionally, within
SharePoint, OneDrive, Planner, Power BI from Microsoft 365,
OneNote and, in some cases, Forms and Bookings are used. Copilot will
only used in the version included in Business licenses
is included and in which no AI training is carried out using company data
takes place. The legal basis is § 26 para. 1 BDSG or Art. 6 para. 1 lit. f
GDPR (legitimate interest in efficient and modern internal)
Collaboration)

Video surveillance For the protection of property and the safeguarding of critical
IT infrastructure, video surveillance is taking place that is focused on the server rooms
restricted and indicated by signs. The legal basis is
Article 6(1)(f) GDPR (legitimate interest in building security and
(to protect against unauthorised access).

4. Recipients or categories of recipients of the data

External service providers (contract processors): The payroll runs will be
via an external tax advisor using DATEV. Additionally,
IT service providers and cloud providers for maintenance and hosting purposes.
on data (especially IONOS for hosting and encrypted backups as well as
Microsoft Ireland Operations Ltd.

5. Data transfer to third countries

A data transfer to entities in countries outside the EU
or the EEA may occur in the context of using Microsoft services, whereby
the Microsoft tenant is explicitly set to Europe. Should it
exceptionally occur for transfers to the USA, we rely on the
EU Commission adequacy decision (EU-US Data Privacy Framework) or
standardised EU contract clauses

6. Storage duration

Applicant data: job application are, in the event of rejection, in the case of a rejection
Retained for 6 months and then deleted in compliance with data protection regulations.

Video footage The storage duration of video recordings in the server room is
the rule 72 hours. Only in justified exceptional cases (e.g. in the event of incidents at
On public holidays/weekends, data is stored for a maximum of 7 days.

Employment status Data from the employment relationship are, after its termination,
for the duration of the statutory (in particular tax and commercial law)
Retention periods stored and then deleted.

7. Provision of data and automated decision-making

Obligation to provide The provision of your personal data
is for the execution of the application procedure or the conclusion and the
Employment relationship to be carried out. Without this data
We cannot consider you in the application process, or that
Employment relationship not to be carried out.

Automated Decision-Making Automated decision-making, including
Profiling according to Art. 22 GDPR does not take place.

8. Rights of data subjects

You have the right to access (Article 15 GDPR), rectification
(Art. 16 GDPR), Erasure (Art. 17 GDPR), Restriction of processing (Art.
18 GDPR) and data portability (Art. 20 GDPR).

As far as data processing is based on a legitimate interest (Art.
6(1)(f) GDPR, you have the right to object at any time
to object to the processing (Article 21 GDPR). You also have a
Right to lodge a complaint with a supervisory authority (Article 77 GDPR).