Responsibility for your application and the processing of your personal data rests with the company in the FMG Group for which the position is posted. FMG also processes some personal data on its responsibility.
4.16.1 Purposes of data processing
We and the service providers acting on our behalf process personal data for the following purposes:
- filling posted positions and vacancies
- filling future vacancies (unsolicited applications)
- reviewing or identifying previous applications (multiple applications by the same candidate)
- protecting children (applicants under 16 years of age)
- ensuring the consent of legal guardians (applicants under 16 years of age). Without the declarations of consent from the legal guardians, applications from applicants under 16 years of age cannot be accepted or can only be partially processed. This also applies when consent is revoked.
- safeguarding and protecting our rights
Changes in purpose:
- In case you are hired, some of your personal data will also be used for purposes related to your employment relationship (e.g. to prepare your contract). The processing is carried out on the basis of the following legal provisions: Art. 6 Par. 1 b) GDPR in conjunction with Art. 88 GDPR in conjunction with Section 26 Par. 1 of the German Data Protection Act (BDSG).
- If you consent to the inclusion of your data in the applicant pool (in particular the data pool for unsolicited applications), we reserve the right to consider your application for other current or future vacancies and to forward your data to the Group units in question to be utilized for related purposes. For information on the storage and deletion of data, refer to the section "Duration of storage and possibilities to have data erased" below.
4.16.2 Legal basis
- Your consent (Art. 6 Par. 1 a) GDPR in conjunction with Section 26 Par. 2 BDSG)
- Consent of your parents for the processing of your application data (Art. 6 Par. 1 a) GDPR in conjunction with Art. 8 GDPR in conjunction with Art. 88 GDPR in conjunction with Section 26 BDSG)
- Implementing precontractual measures resulting from your enquiry (Art. 6 Par. 1 b) GDPR)
- Decision on the establishment of an employment relationship (Art. 88 GDPR in conjunction with Section 26 Par. 1 BDSG)
- Safeguarding our legitimate interests (Art. 6 Par. 1 f) GDPR): Legitimate interests on our part relate to the assertion and protection of our rights.
Please note that more than one of the above legal grounds for processing may apply.
4.16.3 Categories of personal data
The following categories of personal data are processed:
1) Applicant data entered by you in the application form. In general, this involves the following data:
- first name
- last name
- date of birth
- e-mail address
- highest level of education completed / currently pursued
- native language
- foreign language(s)
In addition, depending on the specific job posting and target group, data may be required and processed in other input fields.
In case of applicants under 16 years of age (in particular for school pupils' internships, other internships, vocational training and, in exceptional cases, also for other positions), the following additional data:
- name and signature of the legal guardians
- declarations of consent from the legal guardians
2) Applicant data which you provide by attaching documents (application documents, application photo, etc).
If you use the "Upload CV" function, the selected documents will be automatically extracted and analyzed. This is carried out by a subcontractor of the applicant portal operator.
3) Applicant data from other platforms (Xing, LinkedIn and Dropbox), the transfer and processing of which you permit by granting a release. This takes place through automated extraction/analysis through the subcontractor of the applicant portal provider. Depending on the platform, along with the import of data into the application form, a CV may also be generated using the available profile data and attached to your application. You may remove this attachment where appropriate.
The information concerned includes – among other items – the following personal data if entered in the profile or document:
- name and address data (title, salutation, last name, first name, street, postal code, city, country, etc.)
- contact data (e-mail address, telephone number. etc.)
- profile photo
- current position
- date of birth
- If applicable, other data categories displayed before obtaining your consent for access or contained in the document.
4) Log data collected by the applicant portal provider to ensure proper system operation, error correction and defense against attacks.
These include the following personal data, which are erased after 180 days:
- user name
- applicant name (first and last name)
- IP address
4.16.4 Categories of recipients
1) Use / sharing of data within the Group
Your data can be accessed only by employees of Flughafen München GmbH (FMG) and the Group companies for which the vacancy is being filled. If you are submitting an unsolicited application or consent to inclusion in the applicant pool, it is also possible that your data will be shared with other relevant units in the Group.
2) Applicant portal service provider
Your personal data will be transferred by the applicant portal provider to an external data center (a subcontractor of the applicant portal provider) for processing. A contract has been signed with the applicant portal provider under which the provider is required, in particular, to comply with all requirements of data protection laws and to act solely in accordance with the instructions of Flughafen München GmbH.
3) Online test service provider
Your personal data will be processed and stored by the provider of an online test. The online test is used only in the late selection stages for vocational training positions and work/study degree programs offered by Flughafen München GmbH. To take part in the online test you will receive an email with further information. A contract has been signed with the online test provider under which the provider is required, in particular, to comply with all requirements of data protection laws and to act solely in accordance with the instructions of Flughafen München GmbH.
4) Service providers (general)
We commission external service providers to perform tasks such as programming or data hosting. We have selected these service providers with care and monitor them on a regular basis, in particular with regard to their careful handling and protection of the data processed by them. We require all service providers to sign an undertaking to maintain confidentiality and act in compliance with the data protection standards pursuant to the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
In the application process, the platforms of the following providers can be used to complete the application form quickly and easily:
- Dropbox International Unlimited Company (One Park Place - Floor 5 - Upper Hatch Street - Dublin 2 – Ireland)
- XING AG (Gänsemarkt 43 - 20354 Hamburg - Germany)
- LinkedIn Corporation (2029 Stierlin Court - Mountain View - CA 94043 - USA)
Please note that these providers and/or their servers may operate at locations outside the EU or the EEA (e.g. in the USA). When an applicant uses a platform, information – which may include personal data – may be sent to and possibly utilized by the platform provider. For information on which specific data are stored by the provider in such cases and how they are used, please refer to the data protection statement of the platform provider in question.
The mere inclusion of the button linking to the platform provider in the applicant portal does not result in the transfer of data. Nor do we capture any personal data ourselves by means of the platforms or regarding their use.
After clicking on the button, you will be transferred to the login screen of the platform provider. After logging in and releasing the data, the data will be automatically extracted and analyzed by the subcontractor of the applicant portal.
If you wish to ensure that no data of any kind are processed by the platform providers, enter your data manually in the application form and refrain from using the platforms.
6) Other third parties
We will transfer your personal data to other parties only to the extent that this is required to implement precontractual measures, if we or another party have a legitimate interest in the data transfer, or if you grant us your consent. In addition, data can be transferred to other parties if we are required to do so under the law or an order issued by a public authority or a court. Your data will not be used for advertising purposes.
4.16.5 Duration of data storage and possibility of erasure
1) In general, your data will be deleted six months after your hiring date, your notification that your application was unsuccessful, or your decision to turn down an offer of employment.
In case of an application for a vocational training position or a work/study degree program, all of your data will be stored for six months after your application is rejected, your refusal of an offer, or the invitation to your first day at work. In case of a rejection on our part or your refusal of an offer, the data will be stored on the basis of legitimate interests (legal concerns).
In case of an application for a school pupils' internship, all of your data will be stored for six months after your application is rejected, your refusal of an offer, or the end of the completed internship. In case of a rejection on our part or your refusal of an offer, the data will be stored on the basis of legitimate interests (legal concerns).
2) If you have consented to be included in our applicant pool, you will be notified regarding your continued inclusion in the pool after five months. If you consent to continued inclusion, you will be notified again after a further five-month period. If you do not contact us after this notification, all of your data will be erased within three months.
3) If you wish to have your data erased earlier, please send an email to firstname.lastname@example.org or get in touch with the contact indicated in the job posting, stating your name, the email address provided in your application, the position you applied for, including the company, and your date of birth.
4) Please note that when the data are erased, all data associated with the application in question will be removed and it will no longer be possible to obtain information on the application.
Log data – collected by the applicant portal provider – are erased after 180 days. Log data that must remain on file for evidence purposes are excluded from erasure until the final clarification of the matter in question and, in specific cases, can be forwarded to investigating authorities.