Data Protection for Applicants

Information for Applicants in accordance with the General Data Protection Regulation

(Article 13 GDPR) 


Name and address of the responsible person 

Controller responsible for the collection, processing and use of personal data according to § 13 of the German Telemedia Act (TMG), and controller according to the Federal Data Protection Act (BDSG) and General Data Protection Regulation (GDPR): 

Serrala Group GmbH
Oldesloer Straße 63
22457 Hamburg, Germany
Phone: +49 (40) 51 48 08 - 0

All companies that are part of Serrala can be found here

Data subjects 

This data protection information applies to all natural persons who apply for employment at Serrala Group GmbH and the other companies belonging to Serrala  

Categories of personal data 

  • Master data (name, nationality, date of birth, private address, telephone number, e-mail address) 
  • Application information (previous schooling, work experience (including references from previous employers), qualifications and career history, language skills, professional knowledge and talents, certifications, social commitment) 
  • Interview notes 
  • Communication data (e-mail, correspondence) 

Purpose of the data processing 

Your personal data will be processed exclusively to ensure effective handling in the application process. This includes:  

  • Application and hiring activities 
  • Administration of your application documents 
  • Assessment of qualifications 
  • Carrying out of job interviews 
  • hiring decision 
  • Planning the familiarization and new hiring process 
  • Communication with you 

Legal basis of the data processing 

Your personal data is always processed in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following legal bases are relevant: 

  • Art. 6 para. 1 lit. a GDPR (consent) Your data will only be processed with your prior, explicit and voluntary consent, for example for a longer storage of your application  
  • Section 26 BDSG in conjunction with Art. 6 para. 1 lit. b GDPR on the establishment, exercise or performance of an employment relationship 
  • Art. 6 para. 1 lit. f DSGVO the legitimate interest, for example in the case of an obligation to provide evidence in proceedings under the German General Equal Treatment Act (AGG) 

Please note that this information is only the most relevant legal basis and that this is not a complete or exhaustive list of possible legal bases for data processing.

Recipients or categories of recipients 

Through your targeted application for an announced position, your application are made available to the personnel department of Serrala Group GmbH. The Serrala Group consists of several companies. Depending on which company you apply to, it is possible that your application will be made available to the following Serrala companies

Duration of data storage 

Your application documents, which we receive by e-mail, will be stored by us for six (6) months and irrevocably deleted after these six (6) months. 

Should the application be kept longer, because it might be interesting for us for another position later, we ask you for a written consent. We will then keep your application for one (1) year. 

In the case of unsolicited applications, we ask you to send us your consent to keep your application for one year; otherwise, it will be deleted after six (6) months. 

Of course, you have the right to withdraw your application at any time. 

If possible, we ask you to refrain from submitting a paper application. 

Automated individual decision making 

As a matter of principle, we do not use automated individual decision making in accordance with Art. 22 GDPR to carry out the application process. If such a method should nevertheless be applied to you, we will inform you if we are legally obliged to. 

Rights of the data subject 

Because of the collection of your personal data, you may have the right of access by the data subject (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art 18 GDPR) and the right to object (Article 21 GDPR). 

You will find further information in our privacy policy under point 12: Rights of Data Subjects.  

Data protection officer 

If you have any questions regarding the processing of your personal data, you can contact our data protection officer at any time: 

Mr. Lars Hinrichsen 

Supervisory Authority 

If necessary, you have the right to complain to a supervisory authority, the responsible supervisory authority for Serrala Group GmbH is: 

Prof. Dr. Johannes Caspar
Ludwig-Erhard-Str. 22
20459 Hamburg


Status of this information is March 2020  

You can find further information on data protection at Serrala Group GmbH here.