Skip to main content

Processing of (personal) data by the entity in charge of the online application process

Data protection information for candidates



Dear applicants,


In accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of personal data provided by you as part of the recruitment process and any personal data collected by us and your rights in this regard. To ensure that you are fully informed about the processing of your personal data as part of the process, please take note of the following information.



  1. Name and contact details of the person responsible 


Responsible for the processing of your personal data in the context of this contact is the


gridX GmbH
Dennewartstraße 25
52068 Aachen

Commercial register: 20494
Register court: Aachen

Phone: +49 (0) 241 412597 10

Email: info@gridX.de

Website: www.gridx.de



  1. Contact details of the data protection officer 



The designated data protection officer is 


DataCo GmbH 

Sandstraße 33

80335 Munich, Germany

Phone: +49 (0) 89 7400 458 40

E-mail: datenschutz@dataguard.de 

Website: www.dataguard.de


  1. Categories of personal data

As part of the application process, we only process data that is related to your application. This may involve the following personal data:

  • Apply via the applicant portal or send documents by post or e-mail:

  • Personal master data (e.g. title, first and last name, date of birth)

  • Address data (e.g. street, house number, postcode, city, country)

  • Contact details (e.g. mobile phone number, email address)

  • Knowledge (e.g. language skills, additional qualifications)

  • Application or profile data (e.g. cover letter, CV, certificates, earliest possible start date, desired position, desired locations, salary expectations, how you became aware of us)

  • If applicable, details of contact persons for references

  • Information on current remuneration, if applicable

  • Data on areas of interest, if applicable

  • Link to professional networks, such as XING or LinkedIn profile, if applicable

  • Bank details for reimbursement of travel expenses, if applicable

  • Application photo, if applicable

  • Your consent to be included in the applicant and/or talent pool

  • Your consent to contact references named by you and, if applicable, data from correspondence with these references


  1. Sources from which your personal data originates


Your personal data: 

  • Salutation

  • Professional qualification and further training

  • Your e-mail address,   

  • Your  phone number  

  • Your  number  

  • Your  number 

  • Curriculum vitae

  • Certificates

  • School education

  • Other data that you share with us during the application process


come from the following professional networks and sources: 


We process personal data that we receive from you via our careers page (https://gridx.jobs.personio.de/) or by e-mail as part of the contact or application process or that you send us via Indeed, LinkedIn, GitHub, Stack Overflow, Reddit or Honeypot or forward to a colleague as part of the gridX referral programme.


  1. Purposes of the processing and its legal basis

Your personal data will be processed for the following purposes: 

  • Implementation of the application procedure and decision on the establishment of the employment relationship

  • Communication (telephone, e-mail)

  • Implementation of pre-contractual measures (initiation of the employment relationship)

  • Inclusion of applicant data in an applicant pool

  • Assertion, exercise or defence of legal claims arising from the application process


Processing of special categories of personal data that have been made public - Art. 9 para. 2 lit. e GDPR 
Insofar as special categories of personal data are processed that you have obviously made public, your data will be processed in accordance with Art. 9 para. 2 lit e GDPR.


Processing for the establishment, exercise or defence of legal claims or in the event of legal proceedings - Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR

If necessary, your data will be processed for the purpose of asserting, exercising or defending legal claims or in the case of actions of the courts pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR.


Processing on the basis of consent - Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 para. 1 GDPR in conjunction with Art. 88 para. 1 GDPR. Art. 7 GDPR, Art. 88 para. 1 GDPR in conjunction with. Art. 26 para. 2 BDSG

If you have given your consent to data processing, your data will be processed in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 para. 1 GDPR in conjunction with Art. 88 para. 1 GDPR. Art. 7 DS-GVO, Art. 88 para. 1 DS-GVO in conjunction with. Art. 26 para. 2 BDSG processed


Decision on the establishment of the employment relationship Art. 6 para. 1 sentence 1 lit. b GDPR, Art. 88 para. 1 GDPR in conjunction with Section 26 para. 1 BDSG. § Section 26 para. 1 BDSG

We process your data in order to make a decision on the establishment of the employment relationship. If you are hired by our company, your data will be processed for the purpose of implementing and terminating the employment relationship. Separate information about the processing of your personal data will be provided for this purpose. 

Processing on the basis of legitimate interest - Art. 6 para. 1 sentence 1 lit. f GDPR

Insofar as the processing is carried out to safeguard a legitimate interest of us or a third party and your interests or fundamental rights and freedoms do not outweigh the former interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for data processing. Our legitimate interest arises in particular from the following reasons:

  • The proper implementation and optimisation of the application process

  • Assertion, exercise or defence of legal claims


Processing of special categories of personal data - Art. 9 para. 2 lit. a GDPR
If you have given your consent to the processing of special categories of personal data, such as health data, religious affiliation or nationality, your data will be processed in accordance with Art. 9 para. 2 lit. a GDPR.


  1. Recipients or categories of recipients of the personal data 


As part of the processing of your personal data, we may pass on your personal data to the following recipients: 


  • Within our company, exclusively to the departments and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest

  • Personnel department

  • Personio SE & Co KG                      

  • External employees/freelancers, if they are involved in filling the vacancies

  • Affiliated companies within the E.ON Group, insofar as they are involved in filling the vacancies


Otherwise, data will only be passed on to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfil legal obligations or if we have your consent.



  1.  Transfer of personal data to a third country 


Your personal data will not be transferred to third countries outside the European Union or the European Economic Area and this is not planned. 


  1. Duration of the storage of personal data 


We will delete your personal data as soon as the purposes for its storage mentioned under point 4 no longer apply, or you object to the use of your personal data (in the case of processing on the basis of legitimate interests) or you revoke your previously given consent. However, your personal data may also be stored beyond this, in particular in the following cases:


  • if contractual, legal (in particular from HGB, StGB and AO) or statutory retention periods prevent deletion 


  • for the assertion, exercise or defence of legal claims 

  • if this is necessary under European or national law to fulfil a legal obligation to which we are subject.  

The following retention periods in particular result for us from statutory provisions:

  • After decision on non-appointment: 6 months retention period for application documents (Section 15 (4) of the General Equal Treatment Act (AGG), Section 224 of the Code of Civil Procedure (ZPO)). 

If the applicant has consented, the application documents will be included in the applicant pool and stored there for a maximum of 2 years from the date of consent. They will be deleted when the purpose no longer applies or when the applicant withdraws their consent. 

If you are hired by our company, your personal data will be deleted when the purpose no longer applies, at the latest after termination of the employment relationship, provided that there are no statutory retention periods to prevent deletion.



  1. Rights of data 


According to the General Data Protection Regulation, you have the following rights:


  • If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR).

  • If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).

  • If the legal requirements are met, you can request the erasure or restriction of processing (Art. 17 and 18 GDPR).

  • If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR)

  • If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes

  • You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is (The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia). You can contact them at:

The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia

Postcode 20 04 44, 40102 Duesseldorf

Kavalleriestraße 2-4, 40213 Duesseldorf

Phone: 0211/384 24 - 0

Fax: 0211/384 24 - 105

E-mail: poststelle@ldi.nrw.de

Internet: www.ldi.nrw.de



You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) of the GDPR (data processing in the public interest) and Article 6(1)(f) of the GDPR (data processing on the basis of a balancing of interests), Article 21(1) of the GDPR. This also applies to profiling based on this provision within the meaning of Art. 4 para. 4 GDPR.  


If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate interests for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. 


The objection can be made informally. 




  1. Right of cancellation for consent


If you have consented to the processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. This does not affect the legality of the data processing carried out on the basis of the consent until the revocation.


Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.