Privacy Policy

1. General information on data processing

Northrail GmbH (Northrail) appreciates your visit to the website and your interest in the companies and products of the Northrail Group. We take the protection of your private data very seriously and want you to feel secure when visiting our website. As the responsible party in terms of data protection, we inform you below about the nature and extent of the processing of personal data.

The protection of your privacy when processing personal data is an important concern for us, which we take into account in our business processes. As a matter of principle, we only process personal data insofar as this is necessary for the provision of functional websites, for contacting you via the email addresses provided on our websites and for the provision of our content and services.

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. In the case of processing of personal data that is necessary for the performance of a contract, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures. In addition, processing may be necessary to protect our legitimate interests pursuant to Art. 6 (1) lit. f GDPR.

The personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by the European or national legislator. Data will also be blocked or deleted if a prescribed storage period expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

Personal data will only be transferred to state institutions and authorities within the framework of mandatory European and national legal provisions. Our employees are obliged by us to maintain confidentiality.

For your security, we use SSL or TLS encryption to protect the transmission of all content that you send to us. You can recognise this encrypted connection by the fact that the address line of the browser changes from "http://" to "https//" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. Collection and processing of personal data on our websites

When you visit our website, our web server stores, among other things, the server log files listed in detail below by default. Additional data may be stored if this has been provided for by European or national legislation.

SERVERLOGFILES

When you visit our website, our web servers store (as server log files) by default, among other things, information on the type and version of browser you are using, the operating system you are using, the website from which you are visiting us, the web pages you visit on our site, the date of the visit and, for security reasons, for example to detect attacks on our websites, the amount of data sent in bytes and, for a period of 7 days, the IP address assigned to you by your internet service provider. Storage may take place beyond this if this has been provided for by the European or national legislator. The temporary storage of the IP address by the system is necessary to enable delivery of the web pages to the user's computer. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. This purpose is also our legitimate interest in data processing according to Art. 6 para. 1 lit. f GDPR.

With the exception of the IP address, personal data is only stored if you provide it to us of your own accord, for example by sending us your email address and/or your contact details.

3. Collection and processing of personal data when contacting us by email

On our website, it is possible to contact us via the email addresses provided. In this case, the user's personal data transmitted with the email will be stored. In this context, the data will not be passed on to third parties, unless the point "Passing on personal data to third parties" of this data protection declaration provides for this. The data is used exclusively for processing the conversation and is used solely for processing the contact. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of contact by email, this is the case when the respective conversation with the user has ended, i.e. when it is clear from the circumstances that the matter in question has been conclusively clarified.

The legal basis for the processing of this data is Art. 6 para. 1 lit. f GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

4. Collection and processing of personal data for job applications

PURPOSES AND LEGAL GROUNDS OF PROCESSING

In so far as it is necessary to make a hiring decision, we process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The legal grounds for the processing are provided by Art. 88 GDPR in conjunction with Section 26 BDSG for the purposes of the employment relationship, if this is necessary to make a hiring decision.

Furthermore, we can process personal data relating to you if necessary in order to comply with legal obligations (Art. 6 (1) lit. c GDPR) or to exercise or defend against legal claims. The legal basis is Art. 6 (1) lit. f GDPR. For example, we have a legitimate interest in a burden of proof in a process in accordance with the German General Act on Equal Treatment (AGG).

If you grant express consent to the processing of personal data for specific purposes, that processing is lawful by virtue of your consent in accordance with Art. 6 (1) lit. a GDPR and Section 26 (2) BDSG. You can withdraw consent at any time with future effect (see ‘YOUR RIGHTS’ below).

If an employment relationship comes into being between you and us, we may, in accordance with Art. 88 GDPR in conjunction with Section 26 BDSG, continue to process personal data that you have already provided for purposes related to the employment relationship, to the extent necessary for managing or terminating the employment relationship or to exercise or meet any rights or obligations arising from a law, collective agreement, company agreement or operating agreement (collective agreement) concerning the protection of employees’ interests.

CATEGORIES OF PERSONAL DATA

We only process data linked to your application. This can include general personal information (name, address, contact details etc.), details concerning your professional qualifications, school education or professional training, and any other information you provide to us in connection with your application.

SOURCES OF DATA

We process personal data that we receive when you contact us or submit your application by post or email, or that you send us through our HR software HRworks. In addition, we may process professional information that you have made publicly available, such as profiles on professional social media networks. The legal basis here is Section 26 (1) in conjunction with (8) sentence 2 BDSG. If we do not collect data directly from you, but rather from an active profile on an online job platform (e.g. StepStone), or if you present an inactive or only partially active profile during the application process, we may collect personal data in addition to professional information.

RECIPIENTS OF DATA

Within our company, we will only share your personal data with the departments and people who need the data to comply with contractual and legal obligations or to pursue our legitimate interests.

We can disclose your personal data to our affiliates, provided that this is admissible with regard to the purposes and legal grounds set out under ‘PURPOSES AND LEGAL GROUNDS OF PROCESSING’.

Your personal data are processed on our behalf under processing contracts within the meaning of Art. 28 GDPR. In these cases, we ensure that personal data are processed in accordance with the provisions of the GDPR. In this case, the categories of recipient are providers of applicant management systems and software. Our provider is HRworks GmbH, Waldkircherstr. 28, 79106 Freiburg im Breisgau, Germany.

The software from HR-Works uses the following technically necessary cookies:

• HrwJobApplicationmanagementSession

This cookie is used by the applicant management software ‘HRworks-Bewerbermanagement’. It displays the session of the person in our job portal. This is necessary for operational reasons in order to distinguish between the users of the session. This cookie is technically necessary.

• AWSALB and AWSALBCORS

These two cookies are used by the applicant management software ‘HRworks-Bewerbermanagement’. On the one hand, they are necessary in order to allocate information to the correct server instance. On the other hand, they are necessary for the purposes of uploading application documents, so that the process can run smoothly for the applicants. This cookie is technically necessary.

More information about the HR software’s data protection provisions is available in the privacy policy of HRworks GmbH.

Otherwise, data are only disclosed to recipients outside of the company if statutory provisions permit or require it, the disclosure is necessary to comply with legal obligations or we have your consent.

TRANSMISSION TO THIRD COUNTRIES

We do not intend to transmit data to a third country.

DURATION OF DATA RETENTION

We store your personal data for as long as this is necessary to reach a decision on your application. Your personal data and application documents will be erased no later than six months after the end of the application process (e.g. notification that the application was unsuccessful), unless a longer retention period is legally necessary or admissible. Furthermore, we shall only store your personal data where legally necessary or for the duration of a legal dispute if necessary for the establishment, exercise or defence of legal claims.

If you have consented to the retention of your personal data for a longer period of time, we will store the data in line with your declaration of consent.

If the application process leads to employment, training or an internship, we will continue to store your data initially – where necessary and admissible – and then transfer the data to your personnel file.

After the application process, you might receive an invitation to join our talent pool. This enables us to consider you in our pool of applicants if a suitable vacancy should arise in future. If we have your consent to do so, we will store your application data in our talent pool in line with your consent or any future declarations of consent.

YOUR RIGHTS

Every data subject has the right to access information pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to be notified pursuant to Art. 19 GDPR and the right to data portability pursuant to Art. 20 GDPR.

You are also entitled to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if you consider that the processing of your personal data is unlawful. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Where the processing of data is based on your consent, you are entitled under Art. 7 GDPR to withdraw your consent to the use of your personal data at any time. Please note that the withdrawal is only effective going forward. It does not affect processing which took place before your withdrawal of consent. Please also note that we might have to store certain data for a certain period of time in order to meet statutory requirements (see section 10 of this privacy policy).

Right to object:

Where your personal data are being processed for the purposes of a legitimate interest in accordance with Art. 6 (1) lit. f GDPR, you are entitled to object, on grounds relating to your particular situation, at any time to processing of personal data in accordance with Art. 21 GDPR. In that case, we shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing. These grounds must override your interests, rights and freedoms or serve the establishment, exercise or defence of legal claims.

If you wish to exercise your rights, you can contact us using the information provided in section 11.

NECESSITY OF PROVIDING PERSONAL DATA

When you provide personal data as part of application processes, you do so voluntarily. However, we cannot decide to establish an employment relationship or hire you unless you provide the personal data needed to complete the application.

AUTOMATED DECISION-MAKING

The decision on your application is not based exclusively on automated processing. As such, automated individual decision-making does not take place within the meaning of Art. 22 GDPR.

5. Cookies

Our website uses cookies. These are small text files that are stored on your device. Technically necessary cookies are stored in accordance with Section 25(2)(2) of the Telecommunications, Digital Services and Data Protection Act (TDDDG).

In addition, we use Google Analytics. Google Analytics currently uses, amongst other things, the _ga cookie, which is deleted after 731 days.

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only activated once you have given your consent via our consent management tool. The legal bases are Section 25(1) of the TDDDG for the storage of information on your device or access to it, and Article 6(1)(a) of the GDPR for the subsequent processing of personal data. Depending on the configuration, the data processed includes, in particular, usage and event data, technical information about your browser and device, referrer and page information, approximate location data and truncated IP addresses. The purpose of the processing is the statistical analysis and optimisation of our website. You may withdraw your consent at any time with future effect via the cookie settings.

Google uses cookies that are stored on your computer and enable an analysis of your use of our website. The information generated by the cookie regarding your use of our website is usually transmitted to a Google server in the USA and stored there. Insofar as this involves the processing of personal data in the USA, Google LLC is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection. With Google Analytics 4, IP address anonymisation is enabled by default. Due to IP anonymisation, your IP address is truncated by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before it is transmitted. The IP address transmitted by your browser is not combined with other data held by Google. On our behalf, Google uses this information to analyse your use of our website and to compile reports on website activity. We have no influence over the scope of data collection. For information on the purpose and scope of data collection, as well as the further processing and use of the data by Google, and your rights in this regard and the settings available to protect your privacy, please refer to Google’s privacy policy.

Your personal data will be deleted or anonymised after 731 days. You can prevent cookies from being stored by adjusting the settings in your browser software accordingly. However, Northrail hereby informs you that, in this case, you may not be able to make full use of all the content available on the website. Furthermore, as a user, you can prevent the collection of data generated by the cookie and relating to your use of our website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?.

We also offer you the option to disable the collection of your website usage data for this website by changing your preference regarding the use of Google Analytics here. You can do this in the cookie settings, which are listed in the bottom right-hand corner of every page.

Further information on the terms of use for Google Analytics and Google’s privacy policy can be found at Terms of Service | Google Analytics – Google and https://policies.google.com/?hl=en.

6. Required consent for the use of services provided by third parties

Cookie Consent

We use the consent management tool Usercentrics to obtain, manage and document your consents for services requiring consent. Insofar as information is stored on or read from your device for this purpose, this is done on the basis of Section 25(2)(2) of the German Telecommunications Data Protection Act (TDDDG), provided that access is absolutely necessary for the management of your consent decisions, which you have expressly requested.

The subsequent processing of personal data is carried out to fulfil our legal obligations to provide evidence on the basis of Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR, and additionally on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the legally compliant, user-friendly and verifiable management of your data protection decisions.

The data collected will be stored until you request its deletion, delete the cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Further details about the provider can be found here.



7. Google Tag Manager

This website uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage and control website tags. During normal operation, Google Tag Manager does not set analytics cookies itself; however, cookies may be set and personal data processed by the services integrated via it. Tags requiring consent will only be activated once you have given your consent. The legal bases are, insofar as information on your device is accessed, Section 25(1) of the TDDDG and, for the processing of personal data, Article 6(1)(a) of the GDPR. The services integrated via Tag Manager are described separately in this privacy notice.

When you use our website and as a result of your consent to the integration of Google Tag Manager tags, data – in particular your IP address and your user activity – is transferred to servers operated by Google Ireland Ltd. It cannot be ruled out that personal data may be transferred to third countries (the USA). Insofar as personal data is nevertheless processed in the USA via the parent company Google LLC, the latter is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection.

The IP address transmitted by your browser via Google Tag Manager is not combined with other data held by Google Ireland Ltd.

The storage and analysis of the data is carried out on the basis of Article 6(1)(a) of the GDPR (consent), either as part of registration with Google (opening a Google account and accepting the privacy policy implemented there) or, if you have not registered with Google, through explicit consent when you open our website. You may withdraw your consent at any time via the cookie settings.

8. Passing on of personal data to third parties

Northrail GmbH will treat your personal data confidentially. This data is received centrally by Northrail GmbH when contact is made via our general email address and, where necessary, is passed on to other areas of the company within the scope of the stated purposes. Any further disclosure to third parties will only take place if we are legally obliged to do so, if we commission an external service provider to process your information and if data is processed on the basis of contracts in accordance with Art. 28 GDPR. An example of this is the sending of letters or emails or processing by host providers or providers of applicant management systems. These service providers only receive the information needed to fulfil their tasks. They are not allowed to use it for other purposes and are obliged to treat the information in accordance with the GDPR and the Federal Data Protection Act (new). We also conclude appropriate confidentiality agreements and, where applicable, order processing agreements with each partner. In all other cases, we will inform you if personal information is to be passed on to third parties, thus giving you the opportunity to give your consent.

9. Links to other websites

Northrail GmbH sets links to third-party websites on this website. On the websites of the third parties, the privacy policy of Northrail GmbH does not apply to the processing of personal data by this third party. Northrail GmbH recommends that you always inform yourself about the data protection information on the websites of these third parties.

10. User rights

You can request information about your personal data stored by us free of charge at any time. You are also entitled to have this data corrected or completed if necessary, should it prove to be incorrect or incomplete, and furthermore — if the respective conditions are met — to make use of your right to restrict the processing of your data or to demand the deletion of your personal data. This does not apply if storage is required by law. If deletion cannot be carried out, data processing will be restricted.

Your request should be sent to the following contact details: Northrail GmbH, Brandstwiete 1, 20457 Hamburg, email: datenschutz@northrail.com

You also have the right to object at any time to the processing of personal data concerning you. This does not apply to data whose collection is absolutely necessary for the provision and operation of the websites. If you have contacted us by email or applied to us via an online job platform, you can also object to the storage of your personal data at any time. In such a case, the conversation cannot be continued and the application process cannot be continued. After receiving your objection, we will no longer use, process or transmit the data concerned for purposes other than the processing of the concluded contracts. The lawfulness of the processing carried out until the revocation remains unaffected by this.

If you wish to object to the collection, processing or use of your data by Northrail GmbH in accordance with these data protection provisions, either in whole or for individual measures, you can send your objection to the following contact details: Northrail GmbH, Brandstwiete 1, 20457 Hamburg, phone: +49 40 604 295 410, email: datenschutz@northrail.com

11. Responsible body in the sense of data protection

Northrail GmbH
Brandstwiete 1
20457 Hamburg
Phone: +49 40 604 295 410
Email: datenschutz@northrail.com

12. Data Protection Officer

Proliance GmbH
Data Protection Officer Northrail GmbH
Leopoldstr. 21
80802 Munich