Privacy Policy

KOSTAL Group data protection notice on the application process

In this data protection notice, we inform you about how your personal data is processed as part of the application process at the KOSTAL Group. In addition, we inform you about your rights under the applicable data protection law. Personal data is all data that relates to an identified or identifiable natural person, such as date of birth, address or billing data, as well as data that indicates their identity.

The personal data that you have entered into our applicant management system will be processed by the relevant legal entities of the KOSTAL Group for the purpose of processing your application.

The protection of personal data and ensuring the security of business data are an integral part of the KOSTAL Group's corporate policy. 

Personal data is therefore always processed with great care in order to protect the privacy of the data subjects and the security of all data. The personal data collected during your online application will always be processed confidentially and strictly in accordance with the statutory provisions. For detailed information, please refer to the privacy policy at kostal-career.com.

A.        Contact information of the data controller and the data protection officer

The KOSTAL Group legal entity to which you submit your application is responsible for the processing of your data. You can find the contact details of the legal entity in Poland is:

Kostal Automotive Research & Development Center Poland Sp. z o.o.

ul. Grabarska 1

50-079 Wrocław, Poland

KOSTAL Industrie Elektrik Poland Sp. Z o.o.

Nadleśna 12

21-040 Świdnik, Poland

KOSTAL Automotive Poland Sp. Z o.o.

Nadleśna 12 

21-040 Świdnik, Poland

Below you will find the contact details of our data protection officer 

Data Protection Officer of the KOSTAL Group

At the Bellmerei 10

58513 Lüdenscheid

dataprotection@kostal.com.

To assert your rights or report data protection incidents, please use the above address or the following link https://kostalgroup.speakup.report/kostalgroupexternal

B.        Information on the processing of personal data

Below you will find information about the processing of your personal data for the purposes listed in more detail and, among other things, about the legal basis for the processing. If the legal basis for the processing is mentioned there as the balancing of interests, you can request further information on the balancing of interests from us using the contact details given in Section A.

If you are applying to Kostal, the easiest way is to apply directly for an advertised position on one of our job portals. We will then evaluate the application according to our internal procedures. You can find more information on the collection of data and the applicant management process at https://kostal-career.com/privacy-policy .

I.          Data categories

We process the following categories of personal data in order to recruit new employees and to carry out an application process: 

•  Assignment to a specific job advertisement (i.e. linking your entries to such an advertisement); 
• Your personal master data (first name, surname, address, contact details, date of birth, place of birth); 
• the photo you have provided; 
• Information about your CV to date, including educational background and professional experience, as well as references from previous employers and/or educational institutions; 
• Your letter of application; 
• Information about how you became aware of us (voluntary as well as 
• Login data
• Special categories of personal data (e.g. health data) (voluntary)

In general, the personal data about you comes directly from you. 

II.         Purposes of the processing

We and the external service providers commissioned by us process your personal data in accordance with the General Data Protection Regulation of the EU General Data Protection Regulation (GDPR), with national data protection laws and with all other applicable national laws. 

The data is processed to decide on the establishment of an employment relationship.

III.        Legal basis

The legal basis for this processing is the decision on the establishment of an employment relationship (Art. 88 (1) GDPR in conjunction with. Art 22 (1) from Polish Labor Code), i.e. the processing of data for or before the conclusion of a contract (Art 6 (1) lit b GDPR). A further legal basis is Art 6 (1) lit f) GDPR (legitimate interests), whereby our legitimate interest is the processing of application inquiries and the implementation of recruitment procedures to maintain business operations. A further legal basis is consent (Art. 6 para. 1 lit. a GDPR).

IV.        Special categories of data

Insofar as special categories of personal data are processed in accordance with Art. 9 para. 1 GDPR in conjunction with the relevant national regulation (e.g. data on health, religious or trade union affiliation), this is done on the basis of Art. 9 para. 2 lit b) GDPR in conjunction with the relevant national regulation. The processing of special categories of personal data (health data) may be necessary for the assessment of the ability to work pursuant to Art. 9 para. 2 lit. h) GDPR in conjunction with the relevant national regulation.

V.         Disclosure of personal data to third parties

Only persons who are involved in the selection process (e.g. line managers, employees in the recruitment departments, HR employees, members of employee representatives) have access to your personal data. 

In addition, in certain cases your application data may be shared with other job vacancies within the KOSTAL Group, in each case you will be notified by email and your consent will be obtained. The list of all legal entities of the KOSTAL Group can be found in Appendix 1. 

In some cases, we use external service providers to help us fulfill our relevant contractual or legal obligations. These act as processors for us:

We may also transfer personal data to other data controllers if we are obliged to do so by law or by an enforceable official or court order.

VI.        Disclosure to recipients outside the European Economic Area

Data will only be transferred to third parties (both within and outside the KOSTAL Group) outside the European Economic Area if the third country has been confirmed by the EU Commission to have an adequate level of data protection (adequacy decision) or if other appropriate data protection guarantees (e.g. standard contractual clauses, binding corporate rules) are in place or if legal requirements permit a transfer. 

Should a transfer to recipients outside the EEA (e.g. authorities, courts, litigants or consultants) be necessary for the enforcement/exercise or defense of legal claims or is necessary for the defense of legal claims, this will be done in accordance with Art. 49 para. 1 lit (e) GDPR.

When processing personal data, we take all necessary technical and organizational measures to ensure an appropriate level of security and to protect your personal data in particular against the risks of accidental or unlawful destruction, manipulation, loss, alteration, disclosure to or access by unauthorized third parties. 

The technical and organizational measures are subject to technical progress and further development. We are constantly striving to improve our security measures and keep them up to date with the latest technology.

VII Duration of storage; retention periods

We delete your personal data as soon as it is no longer required for the above-mentioned purposes or we no longer have a legitimate interest in storing it. 

After completion of the application process, your personal data will continue to be stored for a period of six (6) months, unless such storage is prevented by national law.

C.        Rights of the data subjects

As a data subject, you have the following rights in relation to the processing of your personal data, which you can exercise by contacting us using the contact details provided (see above):

• A right to information (Art. 15 GDPR) about which of your personal data we process. This includes further information about the data processing, such as the purpose and legal basis as well as the recipients of this data. You also have the right to request a copy of this data. 

• A right to obtain from us the rectification of inaccurate personal data concerning you and the completion of incomplete personal data (Art. 16 GDPR).

• A right to request the erasure of personal data concerning you in the cases provided for by law (Art. 17 GDPR), for example if the data is no longer required for the purposes for which it was collected or if it has been processed unlawfully. 

• A right to request the restriction of processing in the cases prescribed by law (Art. 18 GDPR). 

• The right to access the personal data concerning you that we have collected on the basis of your consent or for the performance of a contract (see section B) in a structured, commonly used and machine-readable format (right to data portability, Art. 20 GDPR). 

• The right to withdraw consent given to us at any time. This does not affect the lawfulness of the processing carried out up to the point of withdrawal.

• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Right to lodge a complaint with a data protection authority. You can contact either the data protection authority responsible for your place of residence or your federal state or the data protection authority responsible for KOSTAL in Germany:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia

Kavalleriestr. 2-4, 40213 Düsseldorf

P.O. Box 20 04 44, 40102 Düsseldorf

Phone: +49 (0)211/384 24-0

Fax: +49 (0)211/38424-999

E-mail: poststelle@ldi.nrw.de

https://www.ldi.nrw.de

Poland :

Office for the Protection of Personal Data (Urzad Ochrony Danych Osobowych)

Stawki 2

00-193 Warsaw, Poland

Phone: + 48 22 53 10 300

E-mail: kancelaria@uodo.gov.pl

https://www.uodo.gov.pl/

Appendix 1: Legal entities of the KOSTAL Group (EU/EEA)