We are pleased to provide you with the following information on how your personal data will be processed if you apply with Flughafen München GmbH and its subsidiaries, and what rights you have under data protection law. You can apply online through the applicant portal, by email or by regular mail. Your data will then be entered in the applicant portal and processed by the appropriate entity. The company within the Flughafen München GmbH Group that is responsible for your application and the processing of your personal applicant data is the company advertising the position or receiving your unsolicited application. Your data will be passed on to other companies within the Group or stored in the applicant pool only with your direct consent.
If you consent to your application being shared within the Group, your data may be passed on to the companies listed under section 1, "Controllers and data protection officers". This will increase your visibility and the possibility of being considered for a position.
If we find your application compelling but do not currently have a vacancy for you, we will be happy to include you in an applicant pool for the companies listed under section 1 once you have given your consent. That means you give us permission to store your application for a specified period of time and consider it for vacancies where applicable.
You can also apply for jobs with us through our social media recruiting partner’s platform and your personal account on this platform. The platform provider is responsible for processing data on the platform and within your personal account. Information on data processing can be found here:
If you decide to apply to Flughafen München GmbH from your personal account on the platform after seeing a vacancy, we process the following data in our Flughafen München GmbH account on the platform:
- First name and surname
- Cover letter for the specific position at Flughafen München GmbH
- Telephone number
- E-mail address
- Other data that may also be requested depending on the job profile (e.g. qualifications, work experience)
When you send your application, these data are stored in the Flughafen München GmbH account on the platform, e-mailed to the employees in the HR department responsible for recruitment and (manually) sent to the Flughafen München GmbH applicant portal so that we can continue to process your application. The further information on the subsequent flow of data and how your data is handled is the same as when data is processed directly via the applicant portal. Please see the explanations below for related information on the purpose, legal basis, recipient, duration of storage etc.
Recipients of your data in the Flughafen München account at our platform partner may include the Flughafen München human resources department and the platform partner’s IT administrator. Applicant information stored in the Flughafen München GmbH account at our social media recruiting partner is automatically deleted no more than six months after it is received. Applicant information sent by e-mail is also deleted after no more than six months.
4.15.1 Purposes of data processing
We and the service providers acting on our behalf process personal data for the following purposes:
1. Filling posted positions and vacancies
2. Filling future vacancies (unsolicited applications)
3. Sharing within the Group
4. Reviewing or identifying previous applications (multiple applications by the same candidate)
5. Protecting children (applicants under 16 years of age)
6. Ensuring the consent of legal guardians (applicants under 16 years of age)
Without the declarations of consent from the legal guardians, applications from applicants under 16 years of age cannot be accepted or can only be partially processed. This also applies when consent is revoked.
7. Safeguarding and protecting our rights
Changes in purpose:
8. In case you are hired, some of your personal data will also be used for purposes related to your employment relationship (e.g. to prepare your contract). The processing is carried out on the basis of the following legal provisions: Art. 6 Par. 1 b) GDPR in conjunction with Art. 88 GDPR in conjunction with Section 26 Par. 1 of the German Data Protection Act (BDSG).
9. If you consent to the inclusion of your data in the applicant pool, we reserve the right to consider your application for other current or future vacancies and (if you consent to "sharing within the Group") forward your application to the companies specified in section 1 as needed. For information on the storage and deletion of data, refer to the section "Duration of storage and possibilities to have data erased" below.
4.15.2 Legal basis
- Purpose 3 and 9: Your consent (Art. 6 Par. 1 a) GDPR in conjunction with Section 26 Par. 2 BDSG)
- Purpose 5 and 6: Consent of your parents for the processing of your application data (Art. 6 Par. 1 a) GDPR in conjunction with Art. 8 GDPR in conjunction with Art. 88 GDPR in conjunction with Section 26 BDSG)
- Purpose 1, 2 and 4: Taking steps prior to entering into a contract in response to your inquiry for potentially establishing an employment relationship (Art. 88 GDPR in conjunction with Section 26 Par. 1 BDSG)
- Purpose 8: Decision on the establishment of an employment relationship (Art. 88 GDPR in conjunction with Section 26 Par. 1 BDSG)
- Purpose 7: Safeguarding our legitimate interests (Art. 6 Par. 1 f) GDPR): Legitimate interests on our part relate to the assertion and protection of our rights.
Please note that more than one of the above legal grounds for processing may apply.
4.15.3 Categories of personal data
The following categories of personal data are processed:
1) Applicant data that you enter in the application form. This generally involves the following data:
- First name*
- Last name*
- Date of birth
- E-mail address*
- Highest level of education completed / currently being pursued*
- Native language
- Foreign language
Fields marked with an asterisk (*) are required
In addition, depending on the specific job posting and target group, personal data may be required and processed in other input fields.
In case of applicants under 16 years of age (in particular for high school students' internships, other internships, vocational training and, in exceptional cases, also for other positions), the following additional data:
- Name and signature of the legal guardians
- Declarations of consent from the legal guardians
2) Applicant data which you provide by attaching documents (application documents, application photo, etc).
If you use the "Upload CV" function, the selected documents will be automatically extracted and analyzed. This is done by a subcontractor of the applicant portal operator.
3) Applicant data from other platforms (Xing, LinkedIn, Dropbox, etc.) that you allow to be transferred and processed by granting a release. This is done through automated extraction/analysis by the subcontractor of the applicant portal provider. Depending on the platform, a CV may be generated from the available profile data and attached to your application in addition to having your data imported into the application form. You may remove this attachment where appropriate.
That information includes – among other items – the following personal data if entered in the profile or document:
- Name and address data (title, salutation, last name, first name, street, postal code, city, country, etc.)
- Contact data (e-mail address, telephone number, etc.)
- Profile photo
- Current position
- Date of birth
- If applicable, other data categories contained in the document or displayed before obtaining your permission to access them.
4) Log data collected by the applicant portal provider to ensure proper system operation, error correction and defense against attacks.
This includes the following personal data, which is erased after 180 days:
- User name
- Applicant name (first and last name)
- IP address
5) We reserve the right to record applicant information (see 1) and documents in the system manually. For this purpose, a subcontractor of the applicant portal provider can use the “parsing” function. This automatically extracts/analyzes the selected documents.
4.15.4 Categories of recipients
1) Use / sharing of data within the Group
Your data can be accessed only by employees of Flughafen München GmbH and the Group companies for which the vacancy is being filled. If you consented to having your application shared within the Group, your data may also be shared with the companies specified under section 1, "Controllers and data protection officers".
If we find your application compelling but do not currently have a vacancy for you, we will be happy to include you in an applicant pool for the companies specified under section 1. In this case, you will receive an e-mail from us requesting your permission to include you in the applicant pool. Please see section 14.6.5 for the retention period.
2) Applicant portal service provider
Your personal data will be transferred by the applicant portal provider to an external data center (a subcontractor of the applicant portal provider) for processing. A contract has been signed with the applicant portal provider under which the provider is required, without limitation, to comply with all the requirements of data protection laws and to act solely as instructed by Flughafen München GmbH.
In the event of applications for the subsidiary MAI (Munich Airport International GmbH), we forward the data to an external personnel service provider. A data processing agreement has been entered into with this service provider as well that requires the service provider, in particular, to comply with all requirements of data protection law and to act solely as instructed by Flughafen München GmbH.
3) Online test service provider (for vocational training positions)
Your personal data will be processed and stored by the provider of an online test. The online test is used only in the late selection stages for vocational training positions and cooperative degree programs offered by Flughafen München GmbH. To take the online test, you will receive an email with further information. A contract has been signed with the online test provider under which the provider is required, without limitation, to comply with all the requirements of data protection laws and to act solely as instructed by Flughafen München GmbH.
4) Service providers (general)
We engage external service providers to perform tasks such as programming or data hosting. We have selected these service providers with care and monitor them regularly, particularly with regard to their careful handling and protection of the data that they process. We require all service providers to sign a contract to maintain confidentiality and comply with the data protection requirements of the General Data Protection Regulation (GDPR) and German Federal Data Protection Act (BDSG).
The platforms of the following providers can be used to complete the application form quickly and easily during the application process:
- Dropbox International Unlimited Company (One Park Place - Floor 5 - Upper Hatch Street - Dublin 2 – Ireland)
- XING AG (Gänsemarkt 43 - 20354 Hamburg - Germany)
- LinkedIn Corporation (2029 Stierlin Court - Mountain View - CA 94043 - USA)
Please note that these providers and/or their servers may operate at locations outside the EU or the EEA (e.g. in the USA). When an applicant uses a platform, information – which may include personal data – may be sent to and possibly utilized by the platform provider. Please refer to the data protection statement of each platform provider for information on which specific data is stored by the provider in such cases and how it is used.
The applicant portal does not use platform providers' social plugins; these are only links to the platforms. Nor do we use the platforms to capture any personal data or how it is used.
After clicking on the button, you will be transferred to the platform provider's login screen. After logging in and releasing the data, the data will be automatically extracted and analyzed by the subcontractor for the applicant portal.
If you wish to ensure that no data of any kind is processed by the platform providers, enter your data manually in the application form and refrain from using the platforms.
6) Other third parties
We will transfer your personal data to other parties only to the extent that this is required to take steps prior to entering into a contract, if we or another party have a legitimate interest in the data transfer, or if you grant us your permission. In addition, data can be transferred to other parties if we are required to do so by law or under an administrative or court order. Your data will not be used for advertising purposes.
4.15.5 Duration of data storage and possibility of erasure
1) Your data will generally be deleted six months after your hiring date, your notification that your application was unsuccessful, or your decision to turn down an offer of employment.
In case of an application for a vocational training position or a cooperative degree program, all your data will be stored for six months after your application is rejected, you refuse an offer, or your are invited to your first day of work. In case of a rejection on our part or your refusal of an offer, the data will be stored on the basis of legitimate interests (legal concerns).
In case of an application for a high school student's internship, all your data will be stored for six months after your application is rejected, you refuse an offer, or the internship has ended. In case of a rejection on our part or your refusal of an offer, the data will be stored on the basis of legitimate interests (legal concerns).
2) If you have consented to be included in our applicant pool, you will receive a notification about your continued inclusion in the pool after five months. If you consent to remain included in the pool, you will be notified again after a further five-month period. If you do not contact us after this notification, all your data will be erased within three months.
3) If you wish to have your data erased early or withdraw one of your permissions, please send an e-mail with your name, the e-mail address you provided when applying, the job title and company and, for unambiguous identification, your date of birth to firstname.lastname@example.org or contact the person in charge of the advertisement.
4) Please note that when the data is erased, all data associated with the application in question will be removed, making it impossible to obtain information on the application.
Log data – collected by the applicant portal provider – is erased after 180 days. Log data that has to remain on file for evidentiary purposes will not be erased until the final disposition of the matter and may, in specific cases, be forwarded to the investigating authorities.
The applicant management system provider only uses temporary (session) cookies. These cookies are automatically deleted as soon as the user closes the browser.