Infor­ma­tion about data protec­tion made available to employees

1. Who is the data controller and who can I contact?

The data controller is:
FERCHAU GmbH
Steinmüllerallee 2
51643 Gummersbach
Tel.: +49 2261 5011-0
info@ferchau.com

The contact details of the company's data protection officer are as follows:

Data Protection
FERCHAU GmbH
Steinmüllerallee 2
51643 Gummersbach
Tel.: +49 2261 5011-0
privacy@ferchau.com
 
2. What sources and data do we use?

We process the following categories of personal data:

• Master data (e.g., surname, first/middle name, date of birth, place of birth, contact details, address, bank details, social security information and civil status).
• Information about your training, professional background (e.g., schooling, other qualifications such as training and/or studies, including the relevant certificates) and references of previous employers.
• Information published online, for instance on work-related social media accounts (e.g., Xing, LinkedIn).
• Information about your work for us (for instance previous and current position(s) held, reporting lines, use of corporate infrastructure and IT systems, performance indicators, etc.).
• Information required to formalise, develop and terminate the employment relationship or any that we are legally obliged to process (for instance relevant tax and social security information, attendance and absence record, religious affiliation, etc.). This sub-section may also include information about your health status (for instance periods of incapacity for work, degree of disability, etc.).

We generally collect the aforementioned data directly from you. Some information may also be collected from external third parties with the legal authority to disclose such data (for instance tax or social security offices, or recruitment agencies).

3. Why (purpose of processing) and on what legal basis do we process your data?

We process your data for the purposes of formalising, developing and terminating your employment relationship. This process usually involves disclosing your data, in so far as it is absolutely necessary to do so, to our clients who are verifying your suitability for a particular role or on behalf of whom you are undertaking a project.

We also process your data in fulfilment of our legal obligations, and whenever we have a legitimate interest to do so.

Your data are processed on the legal basis of point (c) and (f) of Article 6(1) of the General Data Protection Regulation (GDPR), and, if applicable, your consent.

4. Who receives my data?

We may pass on your data to the following third parties:

• Our parent company, ABLE Management Services, which provides core services on our behalf to manage the employment relationship (e.g., central personal management, accounting, salary management, legal consultancy, etc.) and to protect our legitimate interest since it efficiently manages the personnel of the entire group.
• Public bodies such as tax or social security authorities.
• Private entities to which we are required to disclose certain data (e.g., health insurance).
• Our clients, in so far as they need to contact you or they are considering your suitability for a particular position or you are undertaking a project on their behalf.
• Other entities belonging to our group, in so far as the disclosure is required to manage your employment relationship, we have a legitimate interest to disclose the data or you have given us your consent. The up-to-date list of these companies is available via the intranet.

Any private entities that we recruit to provide services (for instance to supply and administer our IT systems, to undertake administrative tasks for HR and administration or to provide legal consultancy services).

5. Are data transferred to a third country or any international organisation?

For the aforementioned purposes, we may also transfer data to Switzerland. For Switzerland, the European Commission has determined an appropriate level of protection for the personal data transferred from the EU ("Adequacy Decision"). This decision is accessible at: eur-lex.europa.eu 

6. How long will my data be stored for?

We process and store your personal data for the time it takes to fulfil our contractual and legal obligations.

We regularly delete data that are no longer needed to fulfil our contractual or legal obligations, unless they are to be subsequently processed on a temporary basis for legal reasons.

7. What data protection rights do I have?

All data subjects have a right to access their personal data in accordance with Article 15 of GDPR and Article 13 of LOPDGDD (Protection of Personal Data and Guarantee of Digital Rights Act); a right to rectification in accordance with Article 16 of GDPR and Article 14 of LOPDGDD; a right to erasure in accordance with Article 17 of GDPR and Article 15 of LOPDGDD; a right to restriction of processing in accordance with Article 18 of GDPR and Article 16 of LOPDGDD; a right to object in accordance with Article 21 of GDPR and Article 18 of LOPDGDD; and the right to data portability in accordance with Article 20 of GDPR and Article 17 of LOPDGDD. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 of GDPR, and Articles 63 et seq. of LOPDGDD).

The consent according to which the controller processes your personal data may be withdrawn at any time. This also applies to the withdrawal of any statements of consent issued prior to the entry into force of the EU General Data Protection Regulation, i.e., before 25 May 2018. Please note that as the withdrawal does not apply retroactively, the processing operations previously undertaken will not be affected.

8. Am I obliged to disclose data?

The employment relationship cannot be developed unless the aforementioned data are disclosed. If you do not disclose the data needed to fulfil a contractual (or pre-contractual) or legal obligation, we may not be able to continue the employment relationship.

9. To what extent are decisions automated (including profiling)?

We do not engage in any profiling practices.

Information about your right to object in accordance with Article 21 of the General Data Protection Regulation (GDPR)

1. Right to object in specific cases

For reasons linked to your particular situation, you have the right to object to the processing of your personal data in the cases included in point (e) (processing in the public interest) and (f) (processing on the basis of a balance of interests) of Article 6(1) of GDPR; this also applies to profiling, within the meaning of Article 44 of GDPR, for the aforementioned cases.

If you object, we will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

2. Right to object to the processing of data for advertising purposes

In specific cases, we process your personal data for direct advertising purposes. You have a right to object at any time to the processing of your data for advertising purposes; this also applies to profiling practices to the extent that they are undertaken in connection with said direct advertising purposes.

If you object to the processing of data for direct marketing purposes, we will no longer process your data to this end.

The objection may be submitted without having to complete a particular form.