For us, the protection and confidentiality of your personal data are of particular importance. To ensure the protection of your personal data, we have implemented technical and organizational measures to comply with data protection regulations. With this privacy policy, we inform you about how we collect personal data within your application process and for what purpose the data is processed. Your data will be processed in accordance with this privacy policy and the applicable data protection regulations.

This privacy policy applies to the career portal and the applicant management system of Baruti AG.

Name and contact details of the controller

Controller according to Article 4 No. 7 of the General Data Protection Regulation (hereinafter: “GDPR”) is:

Baruti AG

Muhamet Veliu

muhamet.veliu@baruti.ch

Data Protection Officer

Proliance GmbH

datenschutzbeauftragter@datenschutzexperte.de

Data processing

For the efficient conduct of application procedures, we use an applicant management system operated by softgarden e-Recruiting GmbH, Tauentzienstr. 14, 10789 Berlin (Contact: datenschutz@softgarden.de), which operates the applicant management as a processor within the meaning of Article 4 No. 8 GDPR. A contract for data processing according to Article 28 GDPR has been concluded with the provider, ensuring compliance with data protection regulations.

For the exercise of your data subject rights and the processing of the application procedure, we remain your primary contact. You can contact us directly using the contact details of the controller mentioned above or, if specified, confidentially to the data protection officer.

Subject of data protection

The subject of data protection is the processing of personal data, in this case within the framework of applicant management. This includes, according to Article 4 No. 1 GDPR, all information relating to an identified or identifiable natural person (hereinafter “data subject”) that is necessary for the implementation of the application procedure and the initiation of an employment relationship, § 26 BDSG.

In addition, within the framework of the use of applicant management, usage data, i.e., data that is necessary to operate our websites, such as information about the start, end, and extent of the use of our website, including login data, are also collected. These processing activities comply with data protection and telemedia law regulations.

Within the application process and/or the use of the system, processing activities may also take place based on legitimate interest according to Article 6(1)(f) GDPR or based on your consent according to Article 6(1)(a) GDPR. Processing activities may also occur due to a legal obligation or public interest, Article 6(1)(c) and (e) GDPR, such as in the context of law enforcement or investigation by government authorities. You can determine and control the extent of processing through individual settings in your web browser, configuring the corresponding cookie settings, and your user behavior.

Collection and use of your data

Visit to the website

For operational and maintenance purposes, as well as in accordance with telemedia regulations, interactions are recorded (“system logs”) that are necessary for the operation of the website or for the purpose of system security to analyze attack patterns or unlawful use behavior (“evidence function”).

Upon accessing the career portal, your internet browser automatically transmits the following data:

• Date and time of access
• Browser type and version
• Operating system used
• Amount of data sent
• IP address of the access

These data do not serve the immediate allocation within the applicant management and are deleted promptly in accordance with legitimate retention periods unless longer storage is required for legal or factual reasons, such as for evidence purposes. In individual cases, storage for the mentioned purposes may be considered. The legal basis is Article 6(1)(f) GDPR and telemedia law.

Session cookies

We store so-called “cookies” to provide you with an extensive range of functions and to make the use of our websites more comfortable. “Cookies” are small files that are stored on your computer with the help of your internet browser. If you do not wish to use “cookies,” you can prevent the storage of “cookies” on your computer by adjusting the settings of your internet browser accordingly. Please note that this may restrict the functionality and scope of our offer.

On the career page, we use the cookie JSESSIONID as a technically necessary session cookie. This stores a so-called session ID, with which various requests from your browser can be assigned to the common session. This allows your computer to be recognized when you return to our website. This session cookie is deleted when you log out or close the browser.

User-entered data

Application process

Within the application process, you can set up and manage an account on the career portal after configuring a username and password. Beyond individual applications, you can use additional options in the softgarden applicant management system and make individual settings (e.g., inclusion in a talent pool).

For an efficient and promising application, you can provide the following information as part of your application with us:

• Contact details (address, phone number)
• Resume data, e.g.,
• Education
• Vocational training
• Professional experience
• Language skills
• Profiles on social networks (e.g., XING, LinkedIn, Facebook)
• Documents related to applications (application photos, cover letters, certificates, work certificates, work samples, etc.)

Legal basis for processing for the purpose of conducting the application procedure and initiating an employment relationship is § 26(1) BDSG. Furthermore, the use of the applicant management system by the controller is based on legitimate interest according to Article 6(1)(f) GDPR. If consent according to Article 6(1)(a) is required for a specific processing activity, it will be obtained separately and transparently by the controller unless it results from your conclusive and voluntary behavior, such as voluntary participation in a video interview.

Data disclosure

Your data will not be disclosed to unauthorized third parties within the framework of applicant management and will be processed for the purposes stated in this privacy policy. The inspection by internal departments and responsible specialists of the controller is in the legitimate interest, insofar as knowledge of the information from the application process is necessary and permissible for the selection of applicants or internal administrative purposes of the company. For this purpose, your information may be forwarded to third parties within the company by email or within the management system. The legal basis can be § 26(1) BDSG, Article 6(1)(f) as well as (a) GDPR.

Disclosure to third parties also takes place within the framework of data processing according to Article 28 GDPR, i.e., within the framework of processing activities for which the controller has a legitimate interest in outsourcing processing activities that it is otherwise authorized to perform itself. The controller takes measures for this purpose to ensure compliance with data protection regulations.

Furthermore, disclosure to external third parties can also take place for the defense of legal claims based on legitimate interest or as part of disclosure to government authorities, insofar as a law requires this or there is an obligation to disclose. Information obligations to data subjects according to Article 13, 14 GDPR are ensured in advance of the relevant disclosure, insofar as these must be fulfilled separately.

Resume analysis with Textkernel

We process and analyze documents uploaded by you using AI technology to extract resume data and convert it into a structured form (so-called “CV parsing”).

To ensure data subject rights and security standards, a contract for data processing has been concluded with the providing service provider. The data processor is the ISO27001 certified provider Textkernel B.V. Nieuwendammerkade 26 A 5, (1022AB) Amsterdam, Netherlands. Data processing takes place on a server in Germany in a secure environment.

Legal basis for processing is § 26(1) BDSG as well as Article 6(1) sentence 1 lit. f) GDPR to initiate an employment relationship and make the application process as efficient as possible. No personal data is transmitted to insecure third countries. Your data will be deleted from the cache at Textkernel after processing.

Feedback module

In addition to your application, we may ask you for feedback after an interview and 3 months after your hiring. We will send you an invitation link that leads you to the rating system for providing feedback. The purpose of processing is the development and optimization of our recruiting and application processes as well as the company image.

The following data is processed automatically for this purpose:

• Contact details (name, email)
• Position title of the position you applied for
• Location of the position
• Job category
• Applicant ID

The feedback itself is anonymized in the database. Personal reference is not established. In addition to a star rating for individual questions, you also have the opportunity to leave comments. We explicitly ask you not to leave personal data in the comment. The information collected in this way may be displayed on our review page or transmitted to external partners such as kununu.

Participation is purely voluntary and only with your consent, without which the feedback cannot be provided. Legal basis is Article 6(1)(a) GDPR.

Subscription to job ads “Job subscription”

To be informed about new job offers, you can subscribe to the job newsletter or display suitable positions with us on the career board (RSS feed). You can further define the subscription by providing information about the desired activity and location.

In addition, providing your email address is required for the subscription. The legal basis for this is your consent to receive the newsletter according to Article 6(1)(a) GDPR. You can revoke your consent to receive the newsletter at any time using the unsubscribe link in the newsletter (opt-out).

No personal data is processed via the RSS feed itself for informing about new job advertisements.

Social Share Buttons

There is the option to share job ads on various social networks. Different buttons are offered for each network. After clicking on one of these buttons, you will be redirected to the respective networks and go to their login pages. These buttons do not constitute plugins and do not directly transmit personal data to the operators of social networks.

Currently, job ads can be shared on the following social networks:

• Facebook (https://de-de.facebook.com/privacy/explanation)
• Twitter (https://twitter.com/de/privacy)
• LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-join-privacy-policy)
• Xing (https://privacy.xing.com/de/datenschutzerklaerung)

Legal basis is Article 6(1)(f) GDPR for statistical analysis and reach measurement of job advertisements.

You can also find out how the mentioned social networks process your personal data using the links provided. We have no influence on the processing of your personal data by social networks.

Online Surveys “Easyfeedback”

At the end of the application process, you may be shown an invitation to a survey via a link by softgarden. The survey is conducted using a service of easyfeedback GmbH to assess the application experience. Softgarden carries out this survey as the controller within the meaning of Article 4 No. 7 GDPR and processes the collected data anonymously for its own purposes (statistics, analysis, studies) as well as for the further development of softgarden products.

The collection of survey data is standardly secured via the SSL encryption method, and softgarden does not establish personal reference in the context of the evaluation. The survey can be canceled at any time. The data processed up to the point of cancellation can be used for the mentioned purposes.

Your participation in the survey is purely voluntary, and you declare your consent by participating, without which your participation is not possible, Article 6(1)(a) GDPR. The processing of data for evaluation purposes is carried out anonymously at softgarden.

For more information on data protection by easyfeedback, please refer to the following link: https://easy-feedback.de/privacy/datenschutzerklaerung.

Talent Pool

As part of your application or through the “Get in Touch” button, you have the opportunity to recommend yourself for our talent pool. Processing is necessary to be automatically considered for further job openings, including similar or otherwise suitable positions. If you register for the talent pool through the “Get in Touch” button, the following information will be requested:

• Salutation, academic title (optional)
• First name, last name, email address
• Fields of interest
• Current career level
• Preferred location(s)
• XING profile or resume

Inclusion in the talent pool is entirely voluntary and requires your consent through the use of an opt-in link. The legal basis is Art. 6(1)(a) GDPR. Additionally, we will contact you after 6 months to inquire if you still wish to be part of the talent pool.

Cronofy Schedule

We use an integrated service from Cronofy Limited, 9a Beck Street, Nottingham, NG1 1EQ, UK for scheduling and invitations. If we invite you to an interview using this function, you will receive a schedule invitation created via Cronofy by email. This involves the transmission of your email address, the title of the appointment, a description, and the location of the appointment. No further personal data will be transmitted to Cronofy.

The legal basis for processing is Art. 6(1)(f) GDPR, to integrate scheduling into our applicant management system and to plan and manage interviews and other appointments more efficiently. Data processing takes place encrypted on a server in Germany, and adequate security standards have been agreed upon with the provider. For more information, see the following link: Cronofy – Scheduling Platform for Business.

If you do not wish for data processing by Cronofy, please indicate this before coordinating the appointment (objection).

Pitchyou

As part of the recruiting process, Baruti AG offers the option to apply via WhatsApp using the Pitchyou service from SBB-Software und Beratung GmbH in Germany. This service facilitates the connection and forwards the information provided to the recruiting system. Your data will be temporarily stored by the provider for 24 hours and then deleted.

We have no control over the data processing by WhatsApp. The processing is based on your consent under Art. 6(1)(a) GDPR and § 26 BDSG for the implementation of the application process. For more information on data processing by Pitchyou, please visit Pitchyou Data Protection.

Deletion and Use of Data

Your data will be stored for the duration of the application process and according to legitimate retention periods after its completion. After the retention period, the data will be completely anonymized. The processing of anonymized records is not subject to the scope of data protection regulations, allowing for the processing of anonymized data for statistical and analytical purposes, market studies, or product development.

Your Rights as the Data Subject

Data subjects have the right to know whether their personal data is stored, request information about stored data (right to information), verify its accuracy (right to correction), request its supplementation and updating, demand its deletion (right to be forgotten), request the restriction of processing (right to restriction), and have the data transferred/portable in a common, machine-readable format. These rights apply unless there are compelling and/or legitimate reasons on the part of the data controller. Please contact datenschutz@baruti.ch or by mail at the address provided for these requests.

For cases where we process data based on your consent (Art. 6(1)(a) GDPR), you have the right to revoke your consent at any time, without giving reasons and with effect for the future. The corresponding data processing will then no longer take place, but this does not affect the legality of the processing carried out until the time of revocation. You also have the right to object to processing, for example, if the data is processed or has been processed incorrectly, or other reasons exist that are in the interest of the data subject. Data subjects also have the right to lodge a complaint with the supervisory authority responsible for data processing.

Please note that in the event of an objection and/or revocation, certain services/processing activities may not take place or be used, to the extent that processing is necessary for these purposes.

Automated Decision-Making

Automated decision-making does not take place. If this becomes necessary, we will obtain transparent consent before processing.

Changes to this Privacy Policy

We reserve the right to change or supplement this privacy policy at any time in view of the continuously changing legal, technical, and organizational requirements for the processing of personal data. This also applies to any translation errors and differences regarding national requirements of data protection law.

Version

Document ID: D404

Effective from: September 15, 2023

Rev. 3.2