Privacy information for applicants to the Institute for Quality and Efficiency in Health Care (IQWiG)

This privacy information applies to the personal data of applicants. It tells you how we process your data and what rights you have under data protection legislation.

You only need to provide the information necessary to process your application or pre-contractual relationship with us, or information that we are required to collect by law. Without this information, we will not normally be able to proceed with the application and selection process. You will be advised separately of the voluntary nature of any additional information that we may ask you to provide.

Institut für Qualität und Wirtschaftlichkeit im Gesundheitswesen
(Institute for Quality and Efficiency in Health Care)
Im Mediapark 8
50670 Köln
GERMANY
Telephone: +49 (0) 221 35685 (-0)
E-Mail: datenschutz@iqwig.de

P. Eul-Löh
E-mail: datenschutzbeauftragte@iqwig.de

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Data Protection Act (BDSG) and other applicable data protection regulations. In compliance with Article 22 of the GDPR, your personal data will not be subject to purely automated decision-making processes, including profiling. Your personal data will be processed for the purpose of handling your application in response to a specific job advertisement or as an unsolicited application.

3.1 Purposes for the performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR)

Personal data are processed for the purpose of establishing, implementing and terminating the employment relationship, in particular for the following objectives:

• reporting
• preparation of the employment contract
• assertion of legal claims and defence in legal disputes
• warranty
• internal and external communication
• audit controls
• assessment of performance and conduct to the extent permitted by law
• examination and assessment of your suitability for the position you are applying for
• registration and authentication for application via our website
• travel expense report
• contract-related communication (including appointments) with you

3.2 Purposes within the scope of a legitimate interest of us or a third party (Article 6(1)(f) GDPR)

We may process your data for the protection of our legitimate interests or the legitimate interests of third parties beyond the actual performance of the contract or pre-contractual measures. We will only process your data if and to the extent that you do not object to such processing based on overriding interests, in particular for the following purposes:

• measures to develop application and recruitment processes and associated systems.
• enriching our data, for example by using or researching publicly available data where appropriate.

3.3 Purposes within the scope of your consent (Article 6(1)(a) GDPR)

Your personal data may also be processed for specific purposes on the basis of your consent, for example:

You are entitled to withdraw your consent at any time. The purpose and consequences of withdrawing or denying your consent are specifically stated in the applicable text on consent.

As a rule, withdrawal of consent will only apply prospectively. Any processing carried out before you withdraw your consent is not affected and remains lawful.

3.4 Purposes to comply with legal requirements (Article 6(1)(c) of the GDPR) or to serve the public interest (Article 6(1)(e) of the GDPR).

Like all economic actors, IQWiG is subject to a wide range of legal obligations. The reasons for processing may include:

• identity check (e.g. for requests for information).
• fulfilment of tax control obligations.
• data archiving for Privacy and Security.
• audit by tax accountants/auditors, tax and other authorities.
• official/judicial measures taken to gather evidence, prosecute or enforce civil claims.

To the extent necessary for the purposes of the contractual relationship with you and the application you have submitted, we may process data that we receive from other entities or third parties in accordance with the law.

Relevant categories of personal data may include, in particular:

• contact details.
• professional qualifications.
• information about you on the Internet or in social business networks.

Within our Institute, your data will be communicated to those internal departments or organizational units that need it in order to fulfil our contractual and legal obligations (such as managers and specialist managers who are looking for a new employee or who are involved in deciding on filling a position, accounting, works council, etc.) or in the context of processing and implementing our legitimate interests. Your personal data will only be disclosed to third parties as follows:

• for the purposes set out in Sections 3.2 and 3.4 (e.g. to authorities, committees and supervisory bodies) on the basis of our legitimate interest or the legitimate interest of the third party.
• to the extent that external service providers process data on our behalf as data processors or function providers (e.g. companies for data disposal, courier services, postal services).
• if you have consented to our disclosure of your information to third parties.

We will not share or sell your personal information to third parties unless specifically notified to do so. If we use service providers to process your order, your information will be subject to security standards specified by us to appropriately protect your data. In all other cases, the recipients may only use the data for the purposes for which it was transmitted to them.

We generally process and store your data for the duration of your application (pre-contractual relationship).

In addition, we are subject to various retention and documentation obligations, including those arising from the German Commercial Code (Handelsgesetzbuch - HGB) and the German Fiscal Code (Abgabenordnung - AO). The retention and documentation periods specified therein extend up to ten years after the contractual or pre-contractual legal relationship ends. Your application documents and any internally generated information will be deleted after six months if you are not employed.

Your data will be deleted at a later date if we wish to retain it for future vacancies or if you have consented to your data being retained in a talent pool. You will be informed of the details associated with that process.

If the data is no longer required to fulfil contractual or legal obligations and rights, they are regularly deleted, unless their - temporary - further processing is required to fulfil the purposes listed in Section 3.2 due to an overriding legitimate interest of our Institute. Such an overriding legitimate interest exists, for example, if deleting is not possible or only possible with disproportionate effort due to the special type of storage (back-ups). In such cases, we may also keep application documents that have been transferred to the personnel file after the end of the employment relationship for a period of time that is consistent with the purposes. In principle, processing will then be restricted rather than deleted. Appropriate measures will be taken to block the data from ordinary use.

7.1 Information, deletion and other rights

You have the right to access your personal data at any time (Art. 15 GDPR). In addition, according to the legal requirements of Art. 16 to 21 GDPR, you have the right to rectify and delete your data, to restrict processing and portability of the information provided.

7.2 Complaint

You may at any time lodge a complaint regarding the processing of your data with the Institute's Data Protection Officer. The contact details are set out in Item 2.

You also have the right to lodge a complaint with any supervisory authority. The supervisory authority responsible for the Institute:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 20 04 44
40102 Düsseldorf
Telephone: +49 (0) 211 38424 0
E-mail: poststelle@ldi.nrw.de

7.3 Withdrawal and objection

You may withdraw your consent at any time with effect for the future if the data processing is based on your consent.

You may object to data processing at any time on grounds relating to your particular situation if the data processing is based on our legitimate interest. We will only continue to process your data if we can demonstrate that there are compelling reasons to override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims. The objection can be made informally. If possible, it should be sent to: datenschutz@iqwig.de.

You can withdraw your application at any time.