Data Privacy Information for Job Applicants
DFL Deutsche Fußball Liga GmbH and the following other companies in the corporate group are required, as so-called controllers within the meaning of the European General Data Protection Regulation (“GDPR“) and the German Data Protection Act (Bundesdatenschutzgesetz, “BDSG“) to comply with provisions in data privacy laws when handling personal data.
In the course of the application process at one of the following companies
- DFL Deutsche Fußball Liga GmbH
- Bundesliga International GmbH
- Bundesliga International Holding GmbH
- Bundesliga International Corporation
- DFL Digital Sports GmbH
- DFL Stiftung
- Sportcast GmbH
- Livecast TV Produktion GmbH
- HD SAT Communication GmbH
(hereinafter individually referred to as a “Company” and collectively as the “Corporate Group“)
The job applicants (hereinafter referred to as “Applicants“) are herbey informed about the collection, storage, processing and use of their personal data (the “Data“) by the respective Company to the extent described below.
Applicants are only required to provide the Data required for the decision to establish an employment relationship or which the Company is legally obliged to collect. Without this information, the Company will usually not be able to consider the application.
Specifically:
I. Controller, data protection officer
1. Controller
The controller is the Company to which the Applicant is applying.
2. Applications to Bundesliga International GmbH, Bundesliga International Holding GmbH, Bundesliga International Corporation, DFL Digital Sports GmbH and DFL Stiftung
As a supplement to Clause I.1, the controller is DFL Deutsche Fußball Liga GmbH which has central responsibility for application management and human resources management for Bundesliga International GmbH, Bundesliga International Holding GmbH, Bundesliga International Corporation, DFL Digital Sports GmbH and DFL Stiftung.
3. Data protection officer
Applicants can contact the data protection officer of the Corporate Group at dataprivacy@dfl.de.
II. Source of Data and Data categories
The Company responsible for receiving and processing the application and the other Companies involved in the application process in accordance with Clause V. process the Data received from the Applicants in the application process.
In addition, these Companies process Data that they have legitimately obtained from publicly accessible sources (e.g. LinkedIn, Xing, Google, Facebook) or other sources and which they are permitted to process.
Relevant Data of the Applicants are master data (first and last name, date and place of birth, nationality, family status), contact data, curriculum vitae, certificates, references, legitimation data (e.g. identification data for proof of identity and nationality).
III. Purpose and legal basis of the processing, Data recipient
The Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. process the Data in accordance with the provisions in the GDPR and the BDSG. This means that the Data will only be processed if there is a legal permission (especially if the Data processing is necessary for the decision on the establishment of an employment relationship or is prescribed by law or is based on the legitimate interests of the Company in the Corporate Group or third parties), or if the respective Applicant has given his or her consent in individual cases.
Within the Company responsible for receiving and processing the Application and the other Companies involved in an application process in accordance with Clause V., those departments which need the Data to fulfil their contractual and legal obligations receive this Data. Processors engaged by the Company (Art. 28 GDPR) and other contractors may also receive Data for these purposes. These are companies in the categories of application management service providers, personnel management service providers and other personnel service providers, legal advice and consulting, as well as IT services.
Information about Applicants will only be disclosed to recipients outside the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V., if permitted or required to do so by law. Under these prequisites, recipients of the Data may be, for example, the recipients mentioned above (including other Companies in the Corporate Group and other third parties).
1. For purposes of employment, Art. 6 para. 1 b) GDSP, § 26 para. 1, para. 3 BDSG
The processing of Data (Art. 4 no. 2 GDPR) is carried out for purposes of deciding on the establishment of an employment relationship between the Company and the respective Applicant (“Application Management“). This applies to applications for concrete job postings, as well as unsolicited applications. Examples:
a) Collection, processing and use of master data, contact data, curriculum vitae, certificates, references and legitimation data for the Application Management.
b) Transmission of the Applicant’s information about the Application in the form of master data, contact data, curriculum vitae, certificates, references and legitimation data by the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. for the purposes of storage in an application management system or personnel management system, as well as processing and use of these Data by these Companies for the Application Management.
c) If the application leads to the establishment of an apprenticeship relationship or employment relationship, master data, contact data, curriculum vitae, certificates, references and legitimation data will then be processed and used for the purposes of establishing and carrying out the apprenticeship relationship or employment relationship. Applicants are then required to complete their Data to establish the apprenticeship relationship or employment relationship (for example, social insurance data). Subsequently, Data is transmitted to social insurance carriers and the responsible tax office.
2. In the course of weighing interests, Art. 6 para. 1 f) GDPR
If necessary, the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. process the Data in addition of the actual purposes of Application Management to protect their legitimate interests or the legitimate interests of third parties. Examples:
a) Assertion and exercise of legal claim, as well as defence in legal disputes
b) Ensuring IT security and IT operations
c) Measures for business management
Applicants have the right to object at any time to the above processing of Data concerning them for reasons arising from their particular situation. If an Applicant files an objection, the Company responsible for receiving and processing the Application and the other Companies involved in an application process in accordance with Clause V. will no longer process his or her Data, unless they can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the respective Applicant or the processing serves to assert and exercise legal claims or to defend legal disputes.
3. Processing due to legal requirements, Art. 6 para. 1 c) GDPR
In addition, the Company responsible for receiving and processing the Application and the other Companies involved in an application process in accordance with Clause V. are subject to various legal obligations, i.e. legal requirements (e.g. tax laws, social security provisions). The purposes of the processing include, among other reasons, the fulfilment of fiscal control and reporting obligations.
4. Processing based on consent, Art. 6 para. 1 a) GDPR
If the Applicant gives his or her consent to the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. to the processing of Data for specific purposes, this processing is lawful on the basis of the consent. A given consent can be withdrawed at any time. The withdrawal is only effective for the future. Processing that took place before the withdrawal is not affected.
IV. Storage period of the Data
If necessary, the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. process and store the Data for the duration of the application process with the Applicant.
The processing, storage and use of the Data by the respective Companies in accordance with Clause III.1 may in individual cases, depending on the purpose of the storage, also extend the duration of the application process.
Examples:
a) Storage of Data collected and processed in accordance with Clause III.1.a) to c) for the purposes of asserting and excersing legal claims, as well as defending legal disputes, whereby the Data will be deleted without unreasonable delay in the event that the apprenticeship relationship or the employment relationship will not be established.
b) If an apprenticeship relationship or employment relationship is established, the Data collected and processed in accordance with Clause III.1.a) to c) will be processed, among other reasons, for the purposes of establishing and carrying out the apprenticeship relationship or employment relationship. In this case, the Applicant will be informed separately about the further processing of his/her Data.
The Data collected and processed within the scope of the weighing of interests pursuant to Clause III.2. will be stored for as long as this is permitted on the basis of legitimate interests.
Futhermore, the Company responsible for receiving and processing the application and the other Companies involved in an application process in accordance with Clause V. are subject to various retention and documentation obligations, which result, among other reasons, from the German Commercial Code (Handelsgesetzbuch, “HGB”) and the German Tax Code (Abgabenordnung, “AO”), as well as from social security obligations.
V. Transmission of Data to a third country or an international organization
1. Applications to Bundesliga International GmbH, Bundesliga International Holding GmbH, Bundesliga International Corporation, DFL Digital Sports GmbH and DFL Stiftung
Applications addressed to Bundesliga International GmbH, Bundesliga International Holding GmbH, Bundesliga International Corporation, DFL Digital Sports GmbH or DFL Stiftung are received by the human resources department at DFL Deutsche Fußball Liga GmbH and are processed there and the Data collected and processed in accordance with Clause III.1.a) to c) are transmitted to the Company to which the Applicant is applying for purposes of deciding about establishing an apprenticeship relationship or employment relationship between that Company and the respective Applicant. In addition, the human resources department at DFL Deutsche Fußball Liga GmbH will transmit applications to Bundesliga International Holding GmbH and Bundesliga International Corporation to Bundesliga International GmbH for the aforementioned purposes.
2. Applications to Bundesliga International Holding GmbH (international offices) and Bundesliga International Corporation
If an Applicant applying for a position at an international office of Bundesliga International Holding GmbH (currently: Singapore and China) or at Bundesliga International Corporation being located in the United States of America, the Data collected and processed in accordance with Clause III.1.a) to c) are transmitted by DFL Deutsche Fußball Liga GmbH in accordance with the purposes set forth in Clause V.1 to the respective third country (countries outside the European Economic Area – EEA) where the international office of Bundesliga International Holding GmbH (currently: Singapore and China) is located or the United States of America in case of Bundesliga International Corporation.
3. Applications to Livecast TV Produktion GmbH and HD SAT Communication GmbH
If an apprenticeship relationship or employment relationship is established with Livecast TV Produktion GmbH or HD SAT Communication GmbH, the Data collected and processed in accordance with Clause III.1.a) to c) are transmitted for processing to Sportcast GmbH, among other reasons, for the purpose of establishing and performing the apprenticeship relationship or employment relationship.
4. Further Data transmission to third countries
Furthermore, Data is transmitted to third countries (countries outside the European Economic Area – EEA) only if permitted by law (especially if the processing of Data is necesssary or required or prescribed by law for conducting the application process, as well as establishing and performing the apprenticeship relationship or employment relationship or due to legitimate interests of the respective Company including other Companies in the Corporate Group or other third parties) and under the prequisites of Artt. 44 to 49 GDPR (e.g. for countries with an appropriate level of data protection in accordance with Art. 45 para. 1 GDPR or if EU Standard Contractual Clauses have been concluded, Art. 46 para. 2 d) in conjunction with Art. 93 para. 2 GDPR).
VI. Data privacy rights of the Applicant
Applicants have the right of access under Art. 15 GDPR in conjunction with §§ 29, 34 BDSG, the right to rectificationunder Art. 16 GDPR, the right to erasure under Art. 17 GDPR in conjunction with § 35 BDSG, the right to restriction of processing under Art. 18 GDPR in conjunction with § 35 BDSG as well as the right to data portability under Art. 20 GDPR. There is also a right to lodge a complaint with a supervisory authority (Art. 77 GDPR).