Privacy notice for job applicants

The German version is authoritative.

Thank you for your interest in our practice. Here you can find out what happens to your information when you apply to us: online, by post or in person. Please do not apply by email. If you write to us by email anyway, this notice applies as well.

Controller

You can reach our data protection officer, Viktor Cernovski, at the same address or by email to info@praxisgundheim.de, marked ‘z. Hd. Datenschutzbeauftragter’ (for the attention of the data protection officer).

What data we process

We process the information you send us: name, email address, phone number, the job you are applying for, your information on qualifications, weekly hours, earliest start date, German language skills and experience with practice software and computers, your answers to our questions, your cover letter and your documents, for example your CV and certificates or references.

We do not ask about gender, age, origin, religion or health, and a photo is not needed. If you choose to tell us, for example, about a severe disability, we only process this information to fulfil our obligations as an employer (Art. 9(2)(b) GDPR).

Purpose and legal basis

We only use your information to decide on your application and to contact you. The legal basis is taking steps towards an employment relationship (Art. 6(1)(b) GDPR).

We cannot process your application without the required information in the form. You can also apply by post or in person.

Secure transmission

If JavaScript is switched on in your browser, your information and documents are encrypted while they are still in your browser. Neither the transmission service Cloudflare nor the publicly accessible part of our website can read them. Without JavaScript, they are transmitted via HTTPS and encrypted immediately on our server; in this case, for technical reasons, Cloudflare may process them unencrypted during transmission. In the internal practice system, we store applications and documents in encrypted form.

An email, on the other hand, is usually not encrypted all the way on its journey. We therefore recommend our online form for applications.

Who sees your application

Your application is only seen by the practice management and the people who are responsible for administration and personnel matters. The rest of the practice team has no access to applications.

We do not pass on your application to other employers or for advertising. Outside the practice, these service providers receive data: Cloudflare for transmission and STRATO for our email mailboxes. Both work for us as processors. Our backups are currently also stored with Google in the Google Drive storage service. They are encrypted at the practice beforehand. Only the practice has the key. Google therefore cannot read the content. Soon we will only make backups on our own storage device in the practice. Google will then no longer receive any backups. You can find details on this and on transfers to countries outside the EU in our general privacy notice.

Pre-sorting – a human makes the decision

So that we can reply faster, our system marks online applications in colour based on factual information from the form: desired weekly hours, earliest start date, qualification, German language skills and confidence with computers. This marking is only an indication. Every application is read by a person, and a person makes the decision. There are no automatic rejections (Art. 22 GDPR).

How long we store your data

• If we turn down your application or you withdraw it, we delete your data six months after the end of the application process. We keep it for this long so that we can defend ourselves against possible claims, for example under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz; § 15(4) AGG; Art. 6(1)(f) GDPR).
• If the application process is not completed, we delete your application no later than six months after receipt. If we have reopened the process, for example after a rejection or because we had marked your application as spam by mistake, we delete it no later than 12 months after receipt if the process has not been completed by then.
• In any case, we delete your application no later than 18 months after receipt – even if you have agreed to be included in the talent pool.
• We delete obviously abusive submissions (spam) no later than 7 days after we have identified them as spam.
• Your online application is stored in encrypted form on the website server until our internal practice system collects it. If this does not work because of a fault, we delete it there no later than 90 days after receipt.
• If an online application cannot be transferred automatically, for example because it arrives damaged, we delete it after 7 days. If, because of a technical error, our system cannot yet open it with our key, we keep it in encrypted form for up to 90 days. This way, it can still reach us after the error has been fixed.
• If we hire you, we transfer the necessary documents to your personnel file. We will then inform you about this separately.
• This is how we count the periods: for us, six months are 183 days, 12 months are 365 days and 18 months are 548 days. We always start counting from the following day, for example from the day after receipt. Data is deleted in the night after the last day of the period.
• Backups are encrypted. At the practice, we delete them after 30 days. At Google, we delete them after 90 days. After that, they remain in the recycle bin there for up to 30 more days. Then Google deletes them permanently.

Talent pool – only with your consent

If you expressly agree in the form, we keep your application for up to 12 months after receipt in order to contact you if a suitable job comes up later (Art. 6(1)(a) GDPR). Your consent is voluntary. You can withdraw it at any time without giving reasons, for example by email or by phone. After you withdraw it, the normal periods above apply, that is, six months after the end of the application process. If this period has already expired, we delete your application immediately. The withdrawal applies to the future.

Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing that is based on our legitimate interest (Art. 21). You can withdraw your consent at any time (Art. 7(3) GDPR).

Your right to object (Art. 21 GDPR): Keeping your documents for six months after a rejection is based on our legitimate interest. You can object to this at any time on grounds relating to your particular situation. We will then check whether compelling reasons for keeping them take precedence, such as defending against legal claims.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz.

General privacy notice · Back to Careers

Last updated: November 2026