A. General information on data protection
1. Scope
This privacy policy covers information regarding data processing in connection with accessing and using our website “swk-kl.de”. Where links to external websites are provided, we recommend that you check the privacy policies on those sites to determine whether, and to what extent, personal data is processed there.
2. Data controller and contact details
The company responsible for the processing of personal data on the aforementioned website is SWK Stadtwerke Kaiserslautern Versorgungs-AG, Bismarckstraße 14, 67655 Kaiserslautern. Please refer to the legal notice for the address and contact details. If you have any questions regarding data protection in connection with our services or the use of our website, you can contact us at any time by email at datenschutz@swk-kl.de. You can also contact our Data Protection Officer via this address.
B. Data processing when you visit our website
1. Log files
When you visit our website, a so-called log record (known as a server log file) is stored on our web server, which includes, amongst other things, the IP address. The data contained in these server log files is required, amongst other things, to display the content of our web pages correctly and for security purposes (the legal basis for this is Article 6(1)(f) of the GDPR and, in particular, the legitimate interest in the proper and secure operation of our IT infrastructure). The log files are deleted regularly and automatically. Should you require further information on this matter, please do not hesitate to contact us at any time.
2. Cookies
We use cookies on our websites. Details of the cookies used when you visit our website, their retention periods and information on how you can delete the data collected here can be found in the privacy settings. We distinguish between necessary cookies, which are required, for example, to provide the basic functions of the website. The legal basis for these cookies is Section 25(2)(2) of the TDDDG. Cookies that enable us, amongst other things, to analyse website traffic and visits or to display targeted marketing measures, however, require prior consent (the legal basis here is Section 25(1) of the TDDDG). The same applies in the event that information stored on your device (e.g. IP address) is accessed in any other way.
3. Tools and Cookies
Our website and our app use various services and applications (collectively referred to as “tools”) that are provided either by us or by third parties. These include, in particular, tools that use technologies to store information on your device or to access it (e.g. cookies, web storage, JavaScript or pixels). Details of the tools, in particular the cookies used, can be found in the privacy settings. We distinguish, on the one hand, between tools that are strictly necessary, for example to provide the basic functions of the website or to deliver a service you have expressly requested (the legal basis for the use of these tools is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, or Section 25(2)(2) of the TDDDG). On the other hand, we use tools that are not strictly necessary and which, for example, enable us to analyse website traffic and visits or to carry out targeted marketing activities. We require your prior consent for the use of these tools (Article 6(1)(a) of the GDPR, or Section 25(1) of the TDDDG).
4. Management and configuration of tools and cookies
Our website uses a so-called cookie consent management tool (Cookiebot, an application provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark) to manage and control any consents that may be required for the storage or loading of certain tools. The associated data processing is necessary to provide you with the legally required consent management and to fulfil our documentation obligations. The legal basis is Article 6(1)(c) and (f) of the GDPR, in particular based on our interest in fulfilling the legal requirements for consent management (Section 25(2)(2) of the TDDDG). You may withdraw your consent for specific tools at any time. To do so, click on the privacy settings. There, you can also change your selection of the tools you wish to consent to, as well as find further information on the cookies and their respective retention periods. Alternatively, you can withdraw your consent for specific tools directly with the provider. Should you have any questions regarding the provider or require further information on this matter, please feel free to contact us at any time using the contact details provided above.
5. Analytics and Tracking Tools
We use the Matomo software tool (formerly PIWIK) on our website. The software sets a cookie in which the following information is stored: the IP address (anonymised), the web page accessed, the website from which the user arrived at the accessed web page (referrer), the sub-pages accessed from the accessed web page, the duration of the visit to the website and the frequency with which the website is accessed. The software runs exclusively on our website’s servers. The data is not passed on to third parties. We process your data for the purpose of analysing the use of individual components and content on our website on the basis of your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You give your consent by accepting the use of cookies (cookie banner / consent manager), through which you may also withdraw your consent at any time with future effect in accordance with Article 7(3) of the GDPR. There is no legal or contractual obligation to provide your data. If you do not give us your consent, you may still visit our website without restriction; however, not all functions may be fully available. Should you have any questions regarding the providers or require further information on any data storage or deletion processes, please feel free to contact us at any time using the contact details provided above.
6. Google Content Delivery Network (CDN)
We use Google CDN to ensure the proper delivery of our website’s content. Google CDN is a service provided by Google Ireland Limited, which acts as a Content Delivery Network (CDN) on our website. A CDN helps to deliver content from our online offering – in particular files such as graphics or scripts – more quickly with the aid of servers distributed regionally or internationally. When you access this content, you establish a connection to servers operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, where applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of Google CDN. The use of the Content Delivery Network is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. We do not intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. However, in such a case, data transfers to the USA would take place in accordance with Article 45(1) of the GDPR on the basis of the European Commission’s adequacy decision. The US company involved and/or its US sub-processors are certified under the EU-US Data Privacy Framework (EU-US DPF). Further information can be found in the Google CDN Privacy Policy: https://policies.google.com/privacy.
C. Other specific data processing operations
1. Contact form
We provide a contact form on our website to answer users’ questions and communicate with them. We process the enquiries and information sent to us in this context solely for the purpose of dealing with your enquiry and contacting you (Article 6(1)(f) of the GDPR). We store your data for no longer than the duration of any resulting contractual relationship with you (Article 6(1)(b) of the GDPR). Your right to object to the processing in advance or to request erasure remains, of course, unaffected. Should you require further information on this matter, please do not hesitate to contact us at any time.
2. Booking appointments
Users have the option of arranging appointments and meetings via the integrated eTermin booking tool. For this purpose, we only require your email address and your first name and surname in order to manage the appointment and send you reminders about the meeting (Article 6(1)(f) of the GDPR). Your data will be stored for no longer than the duration of any resulting business relationship with you (Article 6(1)(b) of the GDPR); otherwise, it will be deleted immediately. Should you require further information on this matter, please do not hesitate to contact us at any time.
3. Newsletter
We use the ‘rapidmail’ application to send out our newsletter. The provider is rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany. The data you provide for the purpose of subscribing to the newsletter is stored (exclusively) on rapidmail’s servers in Germany. Data processing is carried out on the basis of your consent (Article 6(1)(a) of the GDPR). The data you have provided to us as part of your consent for the purpose of the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and rapidmail’s servers once you have unsubscribed. The lawfulness of any data processing operations that have already taken place remains unaffected by this withdrawal of consent.
For analytical purposes, the emails sent also contain so-called ‘tracking pixels’, which can be used, for example, to determine whether a newsletter message has been opened or whether, and if so which, links in the newsletter message have been clicked. This data processing also takes place only with your consent (Article 6(1)(a) of the GDPR). Please note: If you do not wish rapidmail to carry out any analysis, you must unsubscribe from the newsletter or refrain from subscribing in the first place.
Further information on data protection and data security from Rapidmail can be found at: https://www.rapidmail.de/datensicherheit and https://www.rapidmail.de/wissen-und-hilfe. For more details on Rapidmail’s analytics functions, please see the following link: https://de.rapidmail.wiki/kategorien/statistiken.
4. Google Maps
We use Google Maps (API) on our website. Google Maps is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Maps is a web service for displaying interactive (map) charts to present geographical information visually. When you visit a page that incorporates Google Maps, your browser loads the web fonts required to display Google Maps into your browser cache. For this purpose, too, the browser you are using establishes a connection to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. Google stores your data (even for users who are not logged in) as user profiles and analyses this data. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google directly. These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR. You can view the Google Maps privacy policy at: https://www.google.de/intl/de/policies/privacy/.
5. Google Fonts
Our website uses so-called web fonts to display typefaces, which are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit a page, your browser loads the required web fonts into your browser cache in order to display text and typefaces correctly (Article 6(1)(f) of the GDPR). However, we have integrated the web fonts locally, i.e. on our web server. As a result, no data is transferred to Google’s servers.
6. Google reCAPTCHA
We have integrated Google reCAPTCHA components into our website. Google reCAPTCHA is a service provided by Google Ireland Limited and enables us to distinguish whether a contact enquiry originates from a natural person or is generated automatically by a programme. When you access this content, you establish a connection to the servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, where applicable, browser data such as your user agent are transmitted. Furthermore, Google reCAPTCHA records the user’s time spent on the page and mouse movements in order to distinguish automated requests from those made by humans. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Google reCAPTCHA. The use of Google reCAPTCHA is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. We do not intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. However, in such a case, data transfers to the USA would take place in accordance with Article 45(1) of the GDPR on the basis of the European Commission’s adequacy decision. The US company involved and/or its US sub-processors are certified under the EU-US Data Privacy Framework (EU-US DPF). Further information can be found in the privacy policy for Google reCAPTCHA: https://policies.google.com/privacy?hl=en-US.
D. Data processing in connection with the use of the customer portal – Meine SWK
Information on the nature and scope of data processing in connection with the use of our customer portal can be found in the Login section or at “meineswk.de”.
E. Data processing in connection with recruitment procedures
1. General applications
All data that you provide to us via the application tool on our website is processed solely for the purpose of conducting the application and selection process and is used exclusively to assess your professional suitability and to contact you. This includes your first name and surname, your telephone number and your application documents (Article 6(1)(b) of the GDPR). Your application documents will not be passed on to third parties and will only be made available internally to those departments that actually require them for the assessment of your application and for recruitment purposes. If you are not offered a position, we will store the aforementioned data for a maximum of six (6) months following notification of rejection to the applicant. Should you have consented to being included in the applicant pool, we will store the data until such consent is withdrawn.
1.1 CV analysis using Textkernel
We process and analyse documents uploaded by you using AI technology to extract CV data and convert it into a structured format (known as ‘CV parsing’). To safeguard data subjects’ rights and ensure security standards, a data processing agreement has been concluded with the service provider. The data processor is the ISO 27001-certified provider Textkernel B.V., Nieuwendammerkade 26 A 5, (1022AB) Amsterdam, Netherlands. Data processing takes place on a server in Germany within a secure environment. The legal basis for the processing is Article 6(1)(f) of the GDPR, in order to initiate an employment relationship and to make the application process as efficient as possible. No personal data is transferred to non-EU countries. After processing, your data is deleted from the temporary storage at Textkernel.
1.2 Feedback Module
In connection with your application, we may ask you to provide feedback following an interview and three months after your appointment. We will send you an invitation link for this purpose, which will direct you to the rating system where you can submit your feedback. The purpose of the processing is to further develop and optimise our recruitment and application processes, as well as our corporate image. The following data is processed automatically for this purpose:
- Contact details (name, email)
- Job title of the position you applied for
- Location of the position
- Job category
- Applicant ID
The feedback itself is stored anonymously in the database. No link to an individual is established. In addition to a star rating for individual questions, you have the option here to leave comments. We expressly ask you not to include any personal data in your comments. The information collected in this way may be displayed on our review page alongside your feedback or shared with external partners such as kununu. Participation is entirely voluntary and takes place only with your consent; without this, it is not possible to submit feedback. The legal basis is Article 6(1)(a) of the GDPR.
1.3 Subscription to job advertisements (“Job Subscription”)
To be kept informed about new job vacancies, you can subscribe to the job newsletter or view suitable vacancies with us on the careers board (RSS feed). You can refine your subscription by specifying your desired role and location. Your email address is also required to subscribe. The legal basis for this is your consent to receive the newsletter in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent to receive the newsletter at any time via the unsubscribe link in the newsletter (opt-out). No personal data is processed via the RSS feed itself for the purpose of providing information about new job vacancies.
1.4 Salary Statistics Module
softgarden will give you the opportunity, at various stages of the application process, to provide feedback on your salary expectations and the salaries offered to you. The information provided in this context is anonymised and processed without being linked to your name or contact details. softgarden processes this data in anonymised form for its own purposes (statistics, analysis, studies) and is the data controller within the meaning of Article 4(7) of the GDPR. Processing takes place only with your consent through participation and on a purely voluntary basis. The legal basis is Article 6(1)(a) of the GDPR.
1.5 Social sharing buttons
It is possible to share job advertisements on various social networks. Different buttons are provided for each network. After clicking on one of these buttons, you will be redirected to the respective networks and taken to their login pages. These buttons do not constitute plug-ins and do not transfer any personal data directly to the operators of the social networks. Currently, job advertisements can be shared on the following social networks:
- Facebook (https://de-de.facebook.com/privacy/explanation)
- Twitter (https://twitter.com/de/privacy)
- LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-join-privacy-policy)
- Xing (https://privacy.xing.com/de/datenschutzerklaerung)
The legal basis is Article 6(1)(f) of the GDPR for the statistical analysis and measurement of the reach of job advertisements. You can also find out how the social media platforms mentioned process your personal data via the links provided. We have no influence over the processing of your personal data by these social media platforms.
1.6 “Easyfeedback” online surveys
At the end of the application process, softgarden may display an invitation to a survey via a link. The survey is conducted via a service provided by easyfeedback GmbH to gather feedback on the application experience. softgarden conducts this survey as the data controller within the meaning of Article 4(7) of the GDPR and processes the data collected in anonymised form for its own purposes (statistics, analysis, studies) as well as for the further development of softgarden products. The collection of survey data is secured by default using SSL encryption, and softgarden does not establish any personal links when evaluating the data. You may stop the survey at any time. The data processed up to the point at which you stop the survey may be used for the purposes stated. Your participation in the survey is entirely voluntary, and by taking part you are giving your consent – without which your participation would not be possible – in accordance with Article 6(1)(a) of the GDPR. The processing of data for evaluation purposes is carried out anonymously by softgarden. Further information on easyfeedback’s data protection policy can be found in the following notes:
https://easy-feedback.de/privacy/datenschutzerklaerung.
2. Talent pool
As part of your application or via the “Get in touch” button, you have the option to put yourself forward for our talent pool. This processing is necessary to enable you to be automatically considered for future job vacancies, including similar or otherwise suitable positions. If you register for the talent pool via the “Get in touch” button, you will be asked to provide the following details:
- Title, academic title (optional)
- First name, surname, email
address- Job sectors of
interest- Current career
stage- Preferred location(s)
- XING profile or CV
Inclusion in the talent pool is entirely voluntary and requires your consent, as well as the use of an opt-in link. The legal basis is Article 6(1)(a) of the GDPR. Furthermore, we will contact you after four months to ask whether you still wish to remain part of the talent pool.
F. Video surveillance on public transport
In the local public transport sector, video surveillance is carried out at designated locations and facilities. Video surveillance serves, amongst other things, to prevent and investigate criminal offences, to gather evidence in the event of criminal offences, to protect customers and staff, to ensure building security, and to enforce the right of access. Video surveillance is therefore based on the protection of legitimate interests (Article 6(1)(f) of the GDPR). The video recordings are stored for a period of 72 hours and automatically deleted once this period has elapsed, unless individual sequences are copied for specific evidential or proof purposes and processed or stored separately until the purpose has been fulfilled.
G. General data processing when accessing and using our app
1. Downloading the app
When you download our mobile app, the necessary information is first transmitted to the app store; this includes, in particular, your account username, email address and customer number, the time of the download, payment details and the unique device identifier. In addition, the respective app store independently collects various data and provides you with analysis results. We have no influence over this data processing and are not responsible for it. We process the data only to the extent necessary for downloading the mobile app onto your mobile device.
2. Use of the app (SWK app)
When you use our mobile app, we process the following data, which is technically necessary for us to provide you with the functions of our mobile app and to ensure its stability and security; consequently, we are required to process it. The legal basis is Article 6(1)(f) of the GDPR (IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (page visited), access status/HTTP status code, amount of data transferred in each instance, previously visited page, browser, operating system, and language and version of the browser software). Furthermore, in order to provide the app’s services, we require your device identifier, the unique number of the end device (IMEI = International Mobile Equipment Identity), the unique subscriber number (IMSI = International Mobile Subscriber Identity), mobile phone number (MSISDN), MAC address for Wi-Fi use, the name of your mobile device and your email address. In addition to the data mentioned above, when you use our mobile app, technical tools are employed for various functions, in particular cookies, which may be stored on your device. Please refer to your device’s settings for further details.
H. Social media
We maintain a presence on online platforms and social networks in order to interact with potential or existing customers, engage with interested parties and users, or promote our offers and services. We operate these platforms in what is known as ‘joint responsibility’ (under data protection law) with the providers. We process data that you share or publish directly via these online platforms and networks (e.g. via comment and chat functions) in our capacity as the data controller, in order to interact with you where appropriate or to exchange information with you. As part of this interaction, we may also receive statistical data from the platform operators regarding the use of our ‘channels and fan pages’. This includes, for example, details of interactions, ‘likes’, comments or summarised information and statistics (e.g. IP address; origin of followers), which help us to learn about interactions with our page. The legal basis for data processing within our area of responsibility is Article 6(1), first sentence, point (f) of the GDPR.
However, the providers also process data under their own responsibility. We have no influence over data processed by the provider under its own responsibility in accordance with its own terms of use and privacy policy. Please note that when you access the aforementioned providers, further data (e.g. regarding your usage and ‘browsing behaviour’) may be collected and, where applicable, transmitted to the provider. Please also bear in mind that, in the event of interaction via the aforementioned media, data may also be processed outside the European Union. Furthermore, users’ data is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These usage profiles may in turn be used, for example, to display advertisements both within and outside the platforms that are presumed to correspond to users’ interests. Further information on this can be found in the privacy policies of the respective providers. Where we hold personal data relating to you in connection with the use of online platforms and networks, please direct any enquiries to us. Should you wish to exercise any rights against a specific provider, please contact that provider directly.
I. Your rights
You may exercise your rights regarding your personal data that we process at any time by contacting us using the contact details provided at the beginning of this document. In particular, you have the following rights:
Article 15 of the GDPR: Right of access to your data processed by us
This includes, in particular, information on the purposes of processing, the categories of data, the categories of recipients to whom your data have been or will be disclosed, the intended period of storage, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, and information on the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
Article 16 of the GDPR: Right to rectification of inaccurate data or to have your data stored by us completed.
The right to rectification means, in particular, that you have the right to request that we rectify any inaccurate personal data concerning you without delay, and to complete any incomplete personal data.
Article 17 of the GDPR: Right to erasure of your data stored by us
The right to erasure means that you generally have the right to request that we erase personal data concerning you without undue delay, and we are obliged to erase such personal data without undue delay. This may be the case, for example, where personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
Article 18 of the GDPR: Right to restriction of processing
The right to restriction may apply if you contest the accuracy of the personal data.
Art. 20 GDPR: Right to data portability.
The right to data portability means that you generally have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us.
Article 21 of the GDPR: Right to object to processing, provided that the processing is carried out on the basis of Article 6(1)(e) or (f) of the GDPR.
As a data subject, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
Article 77 of the GDPR: Right to lodge a complaint with a data protection supervisory authority