Applicant Privacy Notice

1. Controller#

Atomity GmbH
Hermann-Löns-Straße 16
64625 Bensheim
Germany

Email: legal@admin.atomity.de
Telephone: +49 1551 0701947

2. Data-protection contact#

Questions concerning applicant data or the exercise of your rights may be sent to legal@admin.atomity.de.

3. Purpose#

We process applicant data to receive and manage applications, communicate with applicants, arrange interviews, assess professional suitability, make recruitment decisions, document the selection process and, where necessary, establish, exercise or defend legal claims.

4. Data we process#

Depending on the application, we may process identification and contact information, CV and employment history, education and qualifications, cover letters, work samples, salary or availability information, interview notes, evaluation results, correspondence, scheduling information and information concerning work authorization.

Reference information and information obtained from referees will be processed only where relevant and after informing you.

5. Source of the data#

We normally receive the information directly from you. Where an application is submitted through a referral, recruitment platform or another permitted source, we may also receive professional and contact information from that source.

6. Legal basis#

The principal legal basis is § 26(1) BDSG, which permits processing necessary for deciding whether to establish an employment relationship. Where necessary, we may also process information under Art. 6(1)(f) GDPR to establish, exercise or defend legal claims.

7. Special-category data#

Please do not provide special-category data unless they are relevant to the position or legally necessary. Where such information is necessary for employment-related rights or obligations, it may be processed under § 26(3) BDSG together with Art. 9(2)(b) GDPR. In exceptional cases, processing may be based on explicit and voluntary consent under § 26(2) BDSG and Art. 9(2)(a) GDPR.

Unnecessary sensitive information submitted voluntarily will not be used for recruitment decisions and may be deleted or redacted where reasonably possible.

8. Application submission and CRM#

Applications and associated communications may be recorded and managed in Atomity’s self-hosted Dolibarr environment. Dolibarr is software operated by Atomity and is not an independent recipient.

9. Document storage#

CVs, cover letters and related application documents are stored in Atomity’s self-hosted Nextcloud environment.

10. Interview scheduling#

Nextcloud may also be used to provide scheduling links and manage interview appointments. This may involve your name, email address, selected time, time zone and appointment information.

11. Email communication#

Recruitment emails are sent and received through Atomity’s self-hosted Mailcow email environment. Email processing may include sender and recipient information, message content, attachments, timestamps and technical delivery information. Mailcow is operated by Atomity rather than being an independent email provider.

12. Recipients#

Access is limited to authorized persons who require the information for recruitment, such as responsible managing directors, recruitment personnel, relevant hiring managers and interview participants. Where required for the relevant role, selected technical interviewers may receive the CV, work samples, interview information and evaluation material necessary to assess the application.

Hetzner Online GmbH provides the underlying hosting infrastructure and processes technical data on Atomity’s behalf. Dolibarr, Nextcloud and Mailcow are open-source systems operated by Atomity and are not independent recipients of applicant data.

13. International transfers#

The recruitment systems described above are hosted in Germany. Applicant data is not intentionally transferred outside the European Economic Area unless this is separately disclosed and an appropriate GDPR transfer mechanism is in place.

14. Retention#

If your application is unsuccessful or withdrawn, we normally delete the application record six months after notifying you that the process has ended. We may retain relevant information longer where a specific legal dispute is pending or where another legal obligation requires retention.

The retention period applies to application documents, recruitment emails, interview notes, evaluation records and scheduling information. Duplicate working copies will also be deleted or access-restricted accordingly.

If you are hired, information necessary for establishing and administering the employment relationship will be transferred to your personnel record. Information not required for the employment relationship will be deleted in accordance with our retention rules.

15. Talent pool (optional)#

With your explicit consent, we keep your application data beyond the current process for up to 12 months to contact you about suitable future roles. Legal basis: consent (Art. 6(1)(a) GDPR).

Talent-pool participation is entirely optional and has no effect on the current application. Consent is provided through a separate, unticked choice. We will delete the talent-pool record after 12 months unless you provide new consent.

You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, the talent-pool copy will be deleted unless retention is required for a specific legal reason.

16. Requirement to provide data#

Information marked as mandatory is required to assess and process your application. Without this information, we may be unable to consider the application. Additional information is voluntary.

17. Automated decision-making#

Atomity does not make recruitment decisions producing legal or similarly significant effects solely through automated processing. Applications are reviewed by authorized persons.

18. Data security#

Atomity uses appropriate technical and organizational measures to protect applicant data, including encrypted transmission, access controls, individual user accounts, authentication controls, backups and role-based access where applicable.

19. Your rights#

Subject to the applicable legal conditions, you may request access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw consent at any time. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.

20. Right to lodge a complaint#

You have the right to lodge a complaint with a competent data-protection supervisory authority. Our principal supervisory authority is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
Telephone: +49 611 1408-0