Data Protection Notice for Applicants

Dear Applicant,

Thank you for your interest in our company. In accordance with the requirements of the data protection laws, in particular with the General Data Protection Regulation ("GDPR"), we want to inform you in the following about the processing of your personal data submitted by you in the course of the application process, as well as any other personal data collected by us, and your rights in this regard.

1. Controller of Data Processing & Data Protection Officer

1.1 Controller Pursuant to Art. 4 No. 7 GDPR:

CENTOGENE GmbH  Tel.: +49 (0)381 80 113-400
Am Strande 7              Fax: +49 (0)381 80 113-401
18077 Rostock           E-Mail: Info@centogene.com

("CENTOGENE", "we" or "us"), represented by the executive board members listed on our website.

1.2     Data protection officer pursuant to Art. 37 et seq. GDPR:

You can reach our data protection officer at the above address with the addition "Attn: Data Protection Officer" or by e-mail at dataprivacy@centogene.com.

2. Purposes and Legal Bases of the Processing

We process your personal data in accordance with applicable laws, in particular the GDPR and the German Federal Data Protection Act ("BDSG"), based on, among others, the following legal bases:

• For the decision on the establishment of an employment relationship: To the extent necessary, we process your personal data primarily for the establishment of an employment relationship (Art. 6 para. 1 sentence 1 lit. b, Art. 88 GDPR in conjunction with § 26 para. 1 BDSG).
• For purposes of legitimate interests: In some cases, we process your data for purposes of our or third parties’ legitimate interests. A legitimate interest exists, for example, if your personal data is required for the assertion, exercise or defense of legal claims in the context of the application process (e.g. claims under the General Equal Treatment Act) (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Based on your consent: You can give us your consent to process your personal data for specific purposes, such as to consider your personal data and application for other relevant vacancies in the future (Art. 6 para. 1 sentence 1 lit. a, Art. 9 para. 2 lit. a, Art. 88 GDPR in conjunction with § 26 para. 2 BDSG). Any consent given can be revoked at any time with effect for the future (see section 8 of this Data Protection Notice).
• For purposes of the employment relationship: If an employment relationship is established between you and us, we will, in accordance with Art. 88 GDPR in conjunction with § 26 para. 1 BDSG, further process the personal data already received from you for purposes of the employment relationship, insofar as this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations arising from law.

3. Categories of Personal Data

We only process personal data that is related to your application and an interview. These may include, but are not limited to, the following personal data or categories of data:

• Personal and contact information, such as name, address, email address, telephone number, date and place of birth, gender, marriage status and nationality, visa and work permit (if required), bank details (for reimbursement of travel expenses), internal records of the interview;
• Special categories of personal data, such as family status information that may allow conclusions about your sexual orientation; information about your health, such as severely disabled status; photographs that allow conclusions about your ethnic origin and, if applicable, your eyesight and/or religion;
• Training, performance and employment data, such as details of your professional qualifications and school education, details of further professional training, references;
• Other application documents, such as cover letter, CV, photo;
• Other data that you provide to us in connection with your application and during the interview, if applicable.

The provision of your personal data as part of the application process is voluntary. However, we can only make a decision on the establishment of or establish an employment relationship with you if you provide personal data that is required to complete the application.

4. Sources of the Personal Data

We process personal data that we receive from you in the course of making contact or your application via e-mail or via our applicant portal under the URL https://career.centogene.com/de (provided by our service provider, HRworks GmbH). In certain cases, we collect personal data via third parties, in particular via professional networks such as LinkedIn or Xing and via recruiters.

5. Recipients / Categories of Recipients of the Personal Data 

We disclose your personal data within our company exclusively to those departments and persons who need this data to fulfill (pre)contractual and legal obligations or to implement our legitimate interest.

We may use service providers (such as the applicant management system HRworks, IT service providers and data centers), whereby your personal data is processed exclusively on our behalf and on the basis of agreements under data protection law. For further information, please feel free to contact us.

A data transfer to recipients outside of CENTOGENE will only take place if it is permitted or required by law, if the transfer is necessary for the fulfillment of legal obligations or if we have your consent.

6. Transfers to a Third Country

In principle, your personal data is processed exclusively within Germany, the European Union and the European Economic Area (“EEA”), where the provisions of the GDPR apply. If one of our service providers is located outside the EEA, CENTOGENE may transfer your personal data to a so-called third country where the GDPR provisions do not apply, provided that either (1) the European Commission has decided that such third country already provides an adequate level of data protection, or (2) CENTOGENE takes appropriate safeguards with the processor, e.g. by concluding GDPR-compliant so-called "standard contractual clauses", including - as the case may be - supplementary clauses containing additional safeguards. In such a case, you have the right to request a copy of the "standard contractual clauses". You can request these from CENTOGENE using the contact details provided in section 1.

7. Duration of Data Storage

We store your personal data for as long as necessary to decide on your application. Your personal data or application documents will be deleted no later than six months after the end of the application process (after notification of the rejection decision), unless longer storage is required or permitted by law. We store your personal data beyond this only to the extent that this is required by law or in the specific case for the assertion, exercise or defense of legal claims for the duration of a legal dispute.

If an employment, training or internship relationship is established following the application process, your data will initially continue to be stored insofar as this is necessary and permissible and will then be transferred to the personnel file.

If you have not already given us your consent to store your application in our talent pool in advance, you may receive an invitation to join our talent pool following the application process. This will allow us to continue to consider you in our selection of applicants for suitable vacancies in the future. If you have given us your consent, we will store your application data in our talent pool for 6 months after you have given us your consent and delete it accordingly thereafter.

8. Your Rights

You have the right to information under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, the right to notification under Art. 19 GDPR and the right to data portability under Art. 20 GDPR.

In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you are of the opinion that the processing of your personal data is not lawful. The right of appeal is given regardless of any other administrative or judicial remedy.

If the processing of your personal data is based on your consent, you are entitled under Art. 7 GDPR to revoke your consent at any time and without giving reasons for the future. This does not affect processing that took place before the revocation. Please also note that we may have to retain certain data for a certain period of time in order to comply with legal requirements (see section 7 of this Data Protection Notice).

Insofar as the processing of your personal data is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR for purposes of legitimate interests, you also have the right, in accordance with Art. 21 GDPR, to object to the processing of this personal data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless there are compelling legitimate grounds for the processing. These must override your interests, rights and freedoms, or the processing must serve the assertion, exercise or defense of legal claims.

To assert your rights or if you have further questions about data processing, you can contact us using the contact details provided in section 1.

9. Changes to This Data Protection Notice

CENTOGENE reserves the right to change this Data Protection Notice at any time. A current version is always available for review under the URL www.centogene.com/data-protection-applicants. Further information can be found in our Data Protection Policy under the URL https://www.centogene.com/legal/data-protection-policy.