Dear Sir or Madam,
dear applicant,

due to the legal requirements of the European General Data Protection Regulation ("EU GDPR"), we are obliged to inform you comprehensively about the processing of your personal data in the context of your application, which we are glad to do.

Data protection and the handling of your personal data are very important to us, so we always endeavour that your personal data is processed in a compliant manner.

If you have any questions about your applicant data and its processing, our data protection officer is at your disposal at any time. They are not subject to any instructions, are independent in their position and are legally obliged to maintain secrecy and confidentiality, so that you can contact them in confidence.

Please consider the following information regarding the processing of your personal data in the context of your application:

I. Identity and contact details of the controller

Depending on the company which you have applied at, your contact as the controller within the meaning of the European General Data Protection Regulation ("EU GDPR"), other national data protection laws of the member states and other data protection regulations is:

Arnold & Richter Cine Technik GmbH & Co. Betriebs KG
Herbert-Bayer-Straße 10, 80807 München
Germany
Tel.: +49 (0)89 3809-0
Fax: +49 (0)89 3809-1244
Email: webmaster@arri.de
Website: www.arri.com

ARRI Media GmbH
Herbert-Bayer-Straße 10, 80807 München
Germany
Tel.: +49 (0)89 3809-0
Fax: +49 (0)89 3809-1244
Email: webmaster@arri.de
Website: www.arrimedia.de

ARRI Rental Deutschland GmbH
Münchner Straße 101/39, 85737 Ismaning
Germany
Tel.: +49 (0)89 3809-1240
Fax: +49 (0)89 3809-1798
Email: info@arrirental.de
Website: www.arrirental.com

ARRI Italia S.r.l.
Via Achille Grandi, 50, 20017 Rho (Milan)
Italy
Tel.: +39 02 2622 7175
Email: info@arri.it
Website: www.arri.com

ARRI CT France SARL
54, Rue René Boulanger, 75010 Paris
France
Tel.: +33 1 42412995
Email: info@arrifrance.com
Website: www.arri.com

(hereinafter referred to as "we", "us" or "our")

II. Contact details of the data protection officer

The protection of your personal data is a high priority for us. We have appointed a data protection officer in accordance with Art. 37 EU GDPR:

DataCo GmbH
Dachauer Straße 65, 80335 München
Germany
Tel.: +49 89 7400 45840,
Email: datenschutz@dataguard.de

Please contact our primary email address for all questions regarding data protection and data security:
privacy@arri.de

III. Categories of personal data

As part of the application process, we only process data related to your application.

This data processing may include in particular the following categories of data: personal master data, application documents, job title, qualification data, certificates of employment and references as well as all other necessary data required in the context of the selection of applicants and recruitment.

Special categories of personal data are not requested from applicants in order to exclude the possibility of discrimination against applicants. Only the information necessary for the assessment of the applicant's suitability is collected and processed.

Pursuant to Art. 9(1) EU GDPR, special categories of personal data include health data and data revealing religious or philosophical beliefs. Any information on severe disability is voluntary. If you provide such voluntary information, we may be entitled or even obliged to take this information into account. We use such data to fulfil any applicable obligations under labour and social law.

IV. Purposes and legal bases of processing

We may only process your personal data for specific purposes in the context of contacting you or considering your application and where we have an appropriate legal basis, such as can be specified in the EU GDPR and national laws.

If you do not provide us with the personal data we need to select applicants, establish an employment relationship or fulfil our obligations as an employer, we may not be able to consider your application or fulfil our obligations as a possible future employer.

Your personal data will be processed for the following purposes and on the following legal bases:

We do not carry out profiling based on personal data. An automated decision-making that could have legal effect on you or affect you in a similar way does not take place.

V. Storage period

Your personal data will be deleted or blocked as soon as the purpose of the processing no longer applies.

We may also store data if storage is mandated by the European or national legislator in Union regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the above provisions expires unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

Thereafter, we will store your data for the following periods, in particular:

• Application documents, application data – from the time of the rejection, for up to 6 months, to satisfy the burden of proof subject to Sections 21 (5),  2 of the General Act of Equal Treatment (AGG).
• Application documents otherwise - upon termination of employment relationship

If at our request you consent to your data being stored in our talent pool for later use, this data will remain stored until you withdraw your consent. You can withdraw your consent to this storage at any time by simply contacting us (by telephone or email).

VI. Categories of recipients

Within our company, those offices and departments receive personal data that need it to fulfil the above listed purposes. In addition, we sometimes use different service providers and transfer your personal data to other trustworthy recipients. The recipients can include, for example:

• Personnel department
• Possible superiors of the applicant (data subject)
• Relevant departments
• Affiliated companies, if and to the extent that your application is considered for more than one vacancy.
• Financial accounting department
• Works council
• Data protection officer
• Disabled persons' council
• Equal Opportunities Officer
• Controlling/auditing
• Employment agency
• Integration office in case of severe disability
• Banking institutions
• Insurance companies
• External service providers such as document shredders or IT service providers
• Lawyers, courts, tax consultants

Your personal data is processed on our behalf by service providers bound by our instructions on the basis of data processing agreements in accordance with Art. 28 EU GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the EU GDPR. In this case, the recipient is in particular the provider of applicant management systems and software (d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, website dvinci.de).

Your data will only be passed on to third parties who are not data processors and are therefore not subject to our instructions in accordance with the relevant legal basis in each case.

VII. Transfer of personal data to third countries

In principle, your personal data required in the context of the selection of applicants and recruitment will be stored on our servers in the European Union.

If you apply from a third country, communication with you during the selection process will require your data to be transferred to that country. In this case, the recipients of your data will be limited to you or, if applicable, foreign postal services, email and software providers whose services you use to receive information from us. Such transfer is permissible insofar as it is necessary for the purposes of the applicants selection (implementation of pre-contractual measures). 

If the providers of our software solutions, among others, offer their products and/or services internationally on the basis of available resources and servers, your personal data may be transferred to other jurisdictions outside the European Union and the European Economic Area or accessed from such a jurisdiction outside the European Union.

We ensure that the protection of your data corresponds to the level of protection guaranteed by the EU GDPR. The corresponding level of protection can be ensured by one of the mechanisms provided for by law, for example by EU standard contractual clauses or an adequacy decision of the European Commission certifying an appropriate level of protection in a third country.

As a rule, data transfer to and data processing by our service providers in third countries is carried out on the basis of appropriate guarantees pursuant to Art. 46 et seq. of the GDPR, in particular through the conclusion of so-called standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR.

VIII. Your rights

You have the following rights against us:

1. Right of access

You have the right to information about whether and which of your personal data is processed by us. In this case, you have the right to the following information:

1) the purpose of the processing;

2) the categories of personal data concerned;

3) the recipients or categories of recipients of personal data;

4) the envisaged storage period or the criteria for its determination;

5) your further rights;

6) where the personal data are not collected from you: any available information as to their source;

7) if applicable: the existence of automated decision-making including information about the logic involved, as well as the significance and the envisaged consequences of such processing.

2. Right to rectification

You have a right to rectification and/or completion if your personal data processed by us is inaccurate or incomplete.

3. Right to restriction of processing

You have a right to restriction of processing where one of the following applies:

1. we verify the accuracy of the personal data;
2. the processing of your personal data is unlawful;
3. you need your personal data processed by us, after the purposes of the processing cease to apply, for the purposes of legal action;
4. you objected to processing of your personal data and we examine this objection.

4. Right to erasure

You have the right to erasure, where:

1. we no longer need your personal data for their original purposes;
2. you withdraw consent and there is no other legal ground for the processing of your personal data;
3. you object to the processing of your personal data and - unless it is a matter of direct marketing - there are no overriding grounds for the processing;
4. the processing of your personal data is unlawful;
5. the erasure of your personal data is legally required;
6. your personal data were collected in connection with information society services offered to a minor.

5. Right to notification

Where you asserted your rights to rectification, erasure or restriction, we shall communicate to all recipients of your personal data this rectification, erasure of the data or the restriction of the processing, unless this proves impossible or involves disproportionate effort.

6. Right to data portability

You have a right to receive the personal data, which you provided to us and which we processed based on consent or for execution of a contract, in a structured, commonly used and machine-readable format and to transmit those data to another controller. Where technically feasible, you have the right to have those data transferred from us directly to another controller.

7. Right to object

You have the right in case of particular grounds to object to the processing of your personal data. In this case we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing.

In case your personal data are processed for direct marketing purposes, you have the right to object at any time.

The processing of your personal data for the purposes of the applicants selection is absolutely necessary for the establishment of the employment relationship. Consequently, there is no possibility for you to object.

8. Right of consent withdrawal

You have the right to withdraw consent given to us at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data by us infringes the GDPR (EU).

The competent supervisory authority for our German entities is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach

 If you have any questions, please contact our data protection officer at any time.