Privacy policy of Digital Technology Center Commerzbank AG Sofia Branch

Information on data protection for job applicants

With the following information, we would like to give you an overview on the processing of your personal data by us and your rights under data protection law in relation to or in the context of your job application process with us.

Who is responsible for data processing and who can I contact?

Responsibility lies with Digital Technology Center Commerzbank AG Sofia Branch, acting as a branch of the foreign merchant Commerzbank Aktiengesellschaft, Kaiserplatz, 60261 Frankfurt am Main, Federal Republic of Germany, the branch being registered with the Commercial Register and Register of NPLE at the Registry Agency under UIC 206042556, having its seat and address of management at: Advance Business Center 2, 2 Samara str., Mladost 4 district, 1766 Sofia.
You can reach the representative of the internal Data Protection Officer at:

Digital Technology Center Commerzbank AG Sofia Branch
Data Protection Contact
Advance Business Center 2, 2 Samara str., Mladost 4 district, 1766 Sofia
Bulgaria
Phone: +359 2 412 1130
DTC_Sofia_GDPR@commerzbank.com

Which sources and which data do we use?

We process personal data which we receive or procure from job applicants in connection with their application to work for us (as our future employees, external contractors or employees of our service providers).

More-over, we process personal data legitimately obtained from publicly accessible sources (such as press, Internet) or which have been legitimately transmitted to us from other companies of the Commerzbank Group or third parties (such as recruitment agencies, former employers) to the extent necessary and legally permitted for the purposes of the job application process.

Relevant personal data are:

a. Personal details (name, information on legal age and nationality);
b. Contact details (address, e-mail address, phone number);
c. Other relevant CV data (education, professional qualification, work experience, certifications, other skills relevant for the respective position);
d. Candidate profile (relevant when applying through a recruitment agency). Such document would likely include your full names, contact details, description of qualifications, skills and professional experience, and any comments by the recruitment agency regarding your application
e. Other relevant personal data provided by you or created by us or a recruitment agency in the context of job interviews;
f. Information on your entry into or termination of an agreement with us which may include information on your remuneration – only relevant if you applied via a recruitment agency (see below).

and other data comparable with the above categories.

What is the purpose of processing your data and on which legal basis does this take place?

We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act (PDPA)

a. in order to enter into a contract (Art. 6 (1 b) GDPR)

Data are processed for the purpose of entry in a contractual relationship with you or for performing pre-contractual measures conducted as a result of queries.

b. in connection with a reconciliation of interests (Art. 6 (1 f) GDPR)

To the extent necessary, we will process your data so as to protect legitimate interests of our own and of third parties. In particular, we shall process your personal data in order to choose the most suitable candidate for the respective position.

Furthermore, in cases where you have applied through a recruitment agency, we may provide them with information on the entry into or the termination of your agreement subject to

- our legal interest to comply with our contractual obligations and exercise our rights towards the agency, including for providing feedback, for ensuring substitutes, etc.

- the recruitment agency’s interest to update their professional database, to perform their various contractual obligations and to confirm and account for the due performance of their contract with us, including for the calculation and invoicing of their remuneration.

Other examples include:

- measures in case of organisational changes,
- lodging legal claims and defence in case of legal disputes,
- ensuring IT security and the IT operations of the company,
- prevention and investigation of criminal acts,
- video surveillance to exercise private property rights, to collect evidence in case of attacks or fraud,
- measures for securing buildings and systems (such as admission control),
- measures to protect our private property rights.

c. as a result of your consent (Art 6 (1 a) GDPR)

To the extent you have consented to the processing of personal data by us for certain purposes (such as keeping your personal data for a longer period in order to contact you for future job opportunities) such processing is legitimate on the basis of your consent. Consent once given may be withdrawn at any time. Withdrawal of consent will have an effect only for the future and does not affect the legitimacy of data processed until that date.

Who will receive my data?

Within the company and the Commerzbank group of companies, units will be granted access to your data on a “need-to-know” basis, e.g. future supervisors, HR department, IT department.

As far as passing on data to recipients outside our company is concerned, it must first be kept in mind that we will pass on only necessary personal data, observing all applicable regulations on data protection. Under these circumstances, recipients of personal data may, for example, be entities engaged by us to process such data, e.g. pursuant to personal data processing agreements concluded with IT services providers, auditors, advisors and, pursuant to applicable legal regulations to entities authorised to obtain such data, e.g. courts or law enforcement authorities, provided that they request access to such personal data and indicate the legal basis for such request.

Other recipients of data may be those bodies for which you have given us your consent to data transfer or to which we may transfer data on the basis of the balancing of interests.

Will the data be transferred to a third country or an international organisation?

As a matter of principle, we will not transfer personal data of applicants to third countries or international organisations.

For how long will my data be stored?

We process and store your personal data as long as it is required to meet the purposes of processing outlined above. In particular, we process your personal data:

a. For a period of up to 6 months after the completion of the respective recruitment procedure;
b. For a longer period, as specified in your consent;
c. If the recruitment procedure is successful and you enter into a contract with us, we will retain the personal data and we will provide additional notification;
d. Until the settlement of any legal dispute that may have arisen within the retention periods specified above;

In the event that data are processed in the legitimate interest of us or of a third party, any personal data will be erased when this legitimate interest has lapsed.

The same applies for data processing on the basis of consent given. As soon as you revoke this consent for the future, the personal data will be erased unless one of the exceptions listed applies.

What are my rights with regard to data protection?

Every data subject has the right of access pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR, the right to objection pursuant to Article 21 GDPR and the right to data portability pursuant to Article 20 GDPR, subject to the restrictions pursuant to Art. 37a PDPA. Moreover, there is a right to appeal to a competent data protection supervisory authority (Article 77 GDPR in conjunction with Art. 38 PDPA).

Your consent to the processing of personal data granted to us may be withdrawn at any time by informing us accordingly. Note that this withdrawal will be valid only for the future. Processing events that took place before withdrawal are not affected.

You may exercise your rights in the manner specified in Art. 37б and 37в PDPA.

Am I obliged to provide data?

The processing of your personal data is a mandatory condition so that we are able to carry out recruitment and assess your application. Without such data, we will generally not be able to correctly assess your application and your participation in the recruitment process will be rendered impossible.

To what extent will decision-making be automated?

As a matter of principle, we will not perform any automated decision-making, including decisions based on profiling, in relation or in the context of your job application.

Information about your right to object pursuant to Article 21 GDPR

Right to object based on individual cases

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (f) of Article 6 (1) GDPR (data-processing on the basis of the balancing of interests).

If you do object, we will no longer process your personal data unless we have compelling justified reasons for such processing which take precedence over your interests, rights and freedom or, alternatively, such processing serves to assert, exercise or defend legal claims.

Recipient of an objection

Such an objection should be addressed to:

Digital Technology Center Commerzbank AG Sofia Branch
Data Protection Contact
Advance Business Center 2, 2 Samara str., Mladost 4 district, 1766 Sofia
Bulgaria
Phone: +359 2 412 1130
DTC_Sofia_GDPR@commerzbank.com