In the following, we aim to inform you about the processing of personal data associated with use of our web pages.
Applicants can find information on data processing in the job portal and for online applications here.
I. Name and address of the controller
The “controller” for the purposes of the General Data Protection Regulation and other national data protection laws of the member states, as well as any additional data protection provisions, is:
WTM Engineers GmbH
Johannisbollwerk 6-8
20459 Hamburg, Germany
Telephone +49 40 35009-0
E-mail: info@wtm-hh.de
II. Name and contact details of the data protection officer
The data protection officer of the controller is:
Tomaske GbR
Business consultancy for data protection and information security
Christian Tomaske
Telephone: +49 171 3804773
E-mail: ct@ufdi.de
III. General info on data processing
1. Scope of processing of personal data
As a general rule, we only process the personal data of our users where this is necessary for the provision of a functioning website and our content and services. Processing of our users’ personal data only takes place where such processing is permitted in legislation or where the user has given their consent for it.
2. Legal basis for processing of personal data
In order to be able to make our website and the associated services available to you, we process personal data according to the following legal basis:
Consent: Where we require consent from the relevant person for processing of personal data, the legal basis is article 6.1(a) of the EU General Data Protection Regulation (GDPR).
Performance of a contract: For the processing of personal data necessary for performance of a contract to which the affected person is party, the legal basis is article 6.1(b) of the GDPR. This also applies for processing required for the execution of precontractual measures.
Legal obligation: If processing of personal data is necessary for the fulfilment of a legal obligation our company is subject to, the legal basis is article 6.1(c) of the GDPR.
Weighing of interests: If processing is required for the pursuit of a legitimate interest for our company or a third party and this outweighs the interests and the fundamental rights and freedoms of the person affected, the legal basis is article 6.1(f) of the GDPR.
3. Data deletion and duration of storage
As a general rule, we delete personal data if there is no need for continued storage. A requirement may exist in particular if the data is required for performance of contractual obligations, for reviewing and granting or defense against warranty and guarantee claims. Where there are statutory retention obligations, deletion can only take place after expiration of the relevant retention obligation.
4. Recipient, disclosure of data
Data that you provide us with will not be disclosed to third parties as a general rule. In particular, your data will not be disclosed to third parties for the purposes of their advertising.
Nevertheless, we may use service providers for the operation of these web pages or for other products or services we provide. It may be the case here that a service provider has access to your personal data. We select our service providers carefully – particularly in light of data protection and data security – and comply with all measures required by data protection law for permissible data processing.
5. Data processing outside of the European Union
Insofar as personal data are processed outside of the European Union, you will find information on this in the following explanations.
IV. Provision of the website and creation of logfiles
1. Description and scope of data processing
Each time somebody accesses our website, our system automatically records data and information on the computer system of the person viewing the site.
The following data are recorded in this context:
- The user’s IP address, anonymized
- Date and time of access
- Retrieval of files via http “GET /images/logo.jpg HTTP/1.1”
- Status code of the server
- Data volumes transferred
- Websites via which the user’s system reached our website
- Technical details on the client: browser, operating system, kernel, user interface, voice output, version
- Domain accessed
The data are likewise stored in our system’s logfiles. We do not store this data together with any other personal data relating to the user.
2. Purpose of data processing
Provisional storage of the IP address by the system is necessary to ensure the pages can be presented in your browser. For this purpose, the user’s IP address must remain stored for the duration of the session.
Storage in logfiles takes place to ensure the website’s functionality. In addition, we use the data to optimize the website and ensure the security of our information technology systems. In this context, there is no evaluation of the data for marketing purposes.
3. Legal basis for data processing
A visit to our website constitutes a usage relationship similar to a contract. We therefore process the IP address and browser data during your visit and on our website for the fulfilment of contracts.
Storage in logfiles takes place on the basis of a “weighing of interests” for the purpose of guaranteeing the confidentiality and integrity of the personal data processed with our IT systems.
4. Duration of storage, right to object and right to erasure
The data are deleted as soon as they are no longer required for the purpose for which they were recorded.
In the case of data recording for provision of the website, this is the case once the relevant session has ended.
In the case of data storage in logfiles, this occurs after seven days at the latest. Storage beyond this deadline is not possible. In this case the IP addresses of users are deleted or anonymized, so that assignment of the calling client is no longer possible.
Recording of data for provision of the website and storage of data in logfiles is essential for operation of the website. The user therefore has no option to object.
V. Contact form and e-mail contact
1. Description and scope of data processing
Our website includes a contact form that can be used for getting in touch with us electronically. If the user makes use of this option, the data they enter in the input fields are sent to us and stored. These data include:
- Salutation (mandatory field)
- Company
- First name (mandatory field)
- Last name (mandatory field)
- Telephone
- E-mail address (mandatory field)
- Message text
The data we must have from you in order to respond to a message are designated as mandatory fields. Details in other data fields are optional.
When the user sends a message, the following data are also stored:
- The IP address of the user
- Date and time of the submission process
The transmission of the data in the form via the internet takes place via encrypted connections.
Alternatively, we can be contacted via the e-mail address provided. In this case, the user’s personal data submitted with the e-mail are stored. We would like to point out that unencrypted e-mails can in some circumstances be read by unauthorized persons via the internet. Confidential messages should therefore not be sent via e-mail.
No data is disclosed to third parties in connection with this. The data are used exclusively for dealing with correspondence.
2. Purpose of data processing
Processing of personal data from the contact form or the e-mail is solely for handling correspondence.
The other personal data processed during the message submission process serve to prevent abuse of the contact form and to ensure the security of our information technology systems.
3. Legal basis for data processing
In the case of specific enquiries, data processing is required for the fulfilment of a contract or for contract initiation. If the contact does not relate to the conclusion of a contract, then the data processing occurs based on a balancing of interests. The legitimate interest in processing then corresponds with the purpose of the data processing (see point 2).
4. Duration of storage, right to object and right to erasure
The personal data from the input fields of the contact form, as well as the additional personal data recorded during the submission process and those sent via e-mail, are deleted no later than three months after the relevant conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the relevant matter has been conclusively dealt with.
At any time, the user has the option of objecting to the storage of their personal data by writing a corresponding message to the controller. The contact details for the controller can be found in point I: “Name and address of the controller”. If an objection is raised, the correspondence must be terminated. In this case, all the personal data stored during the course of correspondence are deleted.
VI. Google Maps
1. Description, scope and purpose of data processing
On the “Contact” page and under “Company/locations” on our website, we have incorporated interactive maps using the “Google Maps” service. Google Maps is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whose parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
By including the service, we aim to make it easier for you to find the various locations of WTM Engineers and to get in touch with us.
When you access the page, the map is deactivated so no data is transferred to Google. It is only when you load the data by clicking on the “Load map from Google server” button that information is transferred to the Google server, which is generally located in Ireland, and stored there. It is also possible that the data will be processed on servers in the USA. The European Court of Justice has designated the USA a country with an insufficient level of data protection, since personal data can be processed by US authorities without the possibility of legal redress. Among other things, Google processes the IP address, browser information and location data. If you do not load the maps, the above processing will not take place.
2. Legal basis for data processing, duration of storage, right to object and right to erasure
We have no influence over this data transmission, but loading Google Maps is not necessary for use of our website. This processing is the responsibility of Google, whose data protection policy can be found here: https://policies.google.com/privacy. Use of Google Maps/Google Earth is subject to these additional terms of use: https://www.google.com/intl/de_US/help/terms_maps/.
VII. Job portal and online application
In the job portal of our website, we offer you the option of submitting an online application for the job vacancies posted there.
To operate the job portal pages and the application process, we use the specialized software provider “rexx systems GmbH”. They act as service provider for us and may have access to your personal data in connection with the maintenance and upkeep of systems. We have concluded a so-called “data processing agreement” with this provider, which ensures that the data processing takes place in compliance with all the applicable regulations.
1. Use of cookies
a) Description and scope of data processing
The job portal on our website makes use of cookies. Cookies are text files that are stored in the internet browser or on the user’s computer system by the internet browser. If a user accesses a website, a cookie can be stored on their operating system. This cookie has a specific sequence of characters that permits definitive identification of the browser when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identifiable even after the user switches pages. The following technically necessary cookies are used by this site:
Name | Purpose | Data recipient | Storage duration (lifespan) |
sid | Visitor recognition | - | 1 hour |
b) Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of websites for the user. Some functions of our website cannot be offered without the use of cookies. This is necessary so that the browser can be recognized again even after the user switches pages.
c) Legal basis for data processing
Processing of personal data using technically necessary cookies takes place based on a balancing of interests. Our legitimate interest here lies in the fault-free and user-friendly functioning of the website.
d) Duration of storage, right to object and right to erasure
Cookies are stored on the user’s computer and transferred from it to our website. That means you as a user also have full control over the use of cookies. You can deactivate or limit transmission of cookies by changing the settings in your internet browser. Previously stored cookies can be deleted at any time. This can also take place automatically. If cookies are deactivated for our website, the user may find they are no longer able to use all the functions of our website in full.
2. Job alerts
a) Description and scope of data processing
Our job portal offers the option of signing up to get e-mail alerts when a new job vacancy is posted that fits with your search criteria. As part of this, when you sign up for job alerts the following data are transferred to us from the input fields:
- Location (vacancies at selected WTM Engineers location)
- Career level (job offers for interns, trainees, managers, …)
- Company division (e.g. fire prevention, civil engineering, building construction, …)
- E-mail address (mandatory field)
The data you must provide in order to receive the alerts are labelled as mandatory fields. Input in other data fields is optional.
When the user signs up, the following data are stored:
- The IP address of the user
- Date and time of registration
No data will be disclosed to third parties in connection with the data processing for provision of this service. The data are used exclusively for delivery of job alerts.
b) Purpose of data processing
Recording of the user’s e-mail address takes place for the purpose of providing alerts, while the search criteria are processed for the purpose of sending alerts for suitable job vacancies only.
Recording of other personal data as part of the registration process serves to prevent abuse of the services or the e-mail address used.
c) Legal basis for data processing
As part of the sign-up process, consent is obtained via a so-called “double opt-in process”. The legal basis for processing data following a sign-up to job alerts by the user is the consent given by the user pursuant to article 6.1 (a) of the GDPR.
d) Duration of storage, right to object and right to erasure
You can cancel the alerts at any time via the dedicated link provided in each job alert or by sending us a message to that effect. After you have cancelled the job alerts, your e-mail address will be immediately deleted from our distribution list.
The remaining personal data recorded as part of the sign-up process will generally be deleted within a period of seven days.
e) Duration of storage, right to object and right to erasure
You can cancel the alerts at any time via the dedicated link provided in each job alert or by sending us a message to that effect. After you have cancelled the job alerts, your e-mail address will be immediately deleted from our distribution list.
The remaining personal data recorded as part of the sign-up process will generally be deleted within a period of seven days.
3. Application form
Clicking on the link “Apply now!” for each job posting will take you to our online application form. Here, you have the option of submitting an application digitally via a secure, encrypted connection.
a) Help with completion
In order to make it as easy and fast as possible for you to fill in the application form, we give you the option of completing the form automatically. For this, you can use the “Upload résumé” button to upload your résumé as a document. The system reads the applicant’s data and transmits all the relevant data from the uploaded résumé automatically into the input fields of the application form. You can then edit or add to the fields as you wish. Only when you submit the application form to us are the data transferred. The uploaded file is used solely for extraction of the data that is transferred to the fields and is not saved.
b) Application with “finest jobs” profile
The button “Apply with finest jobs profile” gives you the option of applying to us via the job portal finest-jobs.com operated via rexx systems.
c) Description and scope of data processing
If you use our online application form, then we process your personal data in the application form as well as the data contained in the documents you have uploaded, such as your cover letter, résumé, references and other documents. The following data is transferred to us via the input fields of the application form:
- Salutation
- Title
- First name (mandatory field)
- Last name (mandatory field)
- Street and house number (mandatory field)
- Town/city and postcode (mandatory field)
- Country (mandatory field)
- Date of birth
- Telephone (mandatory field)
- Mobile telephone
- E-mail address (mandatory field)
- Notice period
- Languages
- School leaver qualification
- University degree
- Vocational training
- Professional experience
- General competences
- Earliest start date (mandatory field)
- Contact source (mandatory field)
- File attachments (mandatory field)
- Other file attachments (photo, résumé, references, final school report)
The data you must provide in order to receive the alerts are labelled as mandatory fields. We need these data in order to be able to process your application. All the other information you provide voluntarily as part of your application.
When the user signs up, the following data are also stored:
- The IP address of the user
- Date and time of registration
No data will be disclosed to third parties in connection with the data processing. The data will be used exclusively for handling the application process. Within the company, as a general rule access to the data is provided solely to those who need it for proper handling of the application procedure.
d) Purpose of data processing
We process the data that you transfer to us in connection with your application in order to review your suitability for the relevant role (or potentially other vacancies within our company) and to manage the application procedure.
Recording of other personal data as part of the submission process serves to prevent abuse of the services or the e-mail address used.
e) Legal basis for data processing
The legal basis for processing of your personal data in the application process is primarily section 26.1.1 of the German Federal Data Protection Act (BDSG). According to this, processing of data is permitted in connection with a decision on whether or not to establish an employment relationship.
If we wish to save your applicant profile in our talent pool in order to be able to offer you other suitable positions or to circulate your application to other divisions within the WTM Engineers group of companies, this will take place with your consent only, pursuant to article 6.1 (a) of the GDPR.
Should the data be required for legal proceedings after completion of the application process, data processing may be carried out to safeguard legitimate interests pursuant to article 6.1 (f) of the GDPR. Our interest then lies in the assertion of or defense against claims.
f) Duration of storage, right to object and right to erasure
The personal data that you make available to us as part of your application will be stored for the duration of the application process. You can notify us of changes or send us more documents via the application form at any time.
If applicants are unsuccessful, their data will be deleted after six months at the latest. If you are appointed to a position as a result of the application process, the data from the applicant data system are transferred to our HR information system.
The remaining personal data recorded as part of the sign-up process will generally be deleted within a period of seven days.
VIII. Rights of the data subject
If personal data relating to you are processed, you are the “data subject” pursuant to the GDPR and have the following rights vis-à-vis the controller.
To exercise these rights, you can contact our data protection team via e-mail at any time at datenschutz@wtm-engineers.de, or the abovementioned controller.
1. Right to information
You can request confirmation from the controller of whether personal data relating to you are processed. If such processing is taking place, you have the right to obtain information about the data relating to you.
If you request information in non-written form, we ask for your understanding that we may need to request proof that you are indeed the person you claim to be.
2. Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller where the processed personal data relating to you are incorrect or incomplete.
3. Right to erasure and right to restrict processing
You can ask the controller to erase the personal data relating to you immediately and the controller is obliged to delete such data without delay where one of the grounds pursuant to article 17.1 of the GDPR exists.
You can also ask to restrict the processing of personal data relating to you within the framework of the legal provisions.
4. Right to data portability
You have the right to obtain the personal data relating to you that you have provided to the controller in a structured, commonly used and machine-readable format and to transfer this to another controller without hindrance from the original controller, insofar as this is permitted by law.
5. Right of objection
You have the right, for reasons arising from a specific situation, to lodge an objection at any time to the processing of the personal data relating to you pursuant to article 6.1 (f) of the GDPR.
The controller will then cease processing the personal data relating to you unless it can demonstrate compelling legitimate grounds for such processing that outweigh your interests, rights and freedoms, or such processing serves for exercising, assertion of, or defense against legal claims.
If the personal data relating to you are processed for the purpose of direct advertising, you have the right to object at any time to the processing of such personal data for these marketing purposes. If you object to such processing for the purposes of direct advertising, the personal data relating to you will no longer be used for these purposes.
6. Right to withdraw consent
You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawal of consent does not affect the legitimacy of the processing carried out until the time of withdrawal on the basis of such consent.
7. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial redress, you have the right to complain to a supervisory authority if you believe that the processing of the data relating to you is in breach of the GDPR.
You are welcome to contact our data protection officer if you believe that we have processed your personal data unlawfully. You can contact our data protection officer using the contact details under “II. Name and contact details of the data protection officer”.