Privacy policy

for the processing of your data in the application process

(status: August 2025)

Data protection information

With this privacy policy, we would like to inform you about the processing of your personal data in the application process and about your rights.

Haufe-Lexware Services GmbH & Co. KG and talentsconnect AG, Nieler Straße 104, 50733 Cologne (hereinafter "talentsconnect") are joint controllers for providing our careers page and in some instances the application form. Further information on processing as joint controllers can be found here. Information on data processing by talentsconnect can be found here. If talentsconnect and Haufe are not acting as joint controllers, we have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

We use the services of SmartRecruiters GmbH, Wilhelmstraße 118, 10963 Berlin (hereinafter "SmartRecruiters"), with whom we have concluded a data processing agreement in accordance with Art. 28 GDPR, to carry out the application process through an applicantion management system. We are responsible for the processing of personal data carried out in the system in accordance with Art. 4 No. 7 GDPR, unless otherwise stated in this privacy policy.

If there are discrepancies between the English and German versions of the privacy policy, the German version shall prevail.

I. Who are we and how can you contact us?

We,

Haufe-Lexware Services GmbH & Co. KG (hereinafter also referred to as "Haufe", "we", "us", "our", etc.)
A company of the Haufe Group
Munzinger Straße 9
79111 Freiburg, Germany
E-mail: hello@career.haufegroup.com

are responsible for the processing of your data within the meaning of the EU General Data Protection Regulation (hereinafter referred to as GDPR) and are therefore also responsible for protecting your personal data.

Depending on which Haufe company has posted the position for which you are applying, one of the following companies of Haufe Group SE may also be responsible:

Haufe-Lexware GmbH & Co. KG, Haufe-Lexware Services GmbH & Co. KG, Haufe Akademie GmbH & Co. KG, Haufe Akademie Inhouse Training und Consulting GmbH, Semigator GmbH, Smartsteuer GmbH, Haufe Group Software Solutions Spain S.L., Haufe Group Romania SRL, Haufe Group Ventures GmbH as well as Schäffer-Poeschel Verlag GmbH and Verlag für Controlling Wissen AG.

In this case, this privacy policy applies to these companies accordingly.

II. What data is processed for what purpose when you apply to us?

In the following, we will inform you about which personal data is collected and processed when you apply, for what purposes and by which recipients it is processed, on what legal basis the data processing takes place and when the data is removed.

A. Transmission of applicant data via the application form and implementation of the application process

1. Categories of data processed

We collect and process personal data as part of the application process.  

The following types of data may be processed by us as part of an application:

- Personal master data (e.g. title, first name and surname)

- Address data (e.g. street, house number, zip code, town)

- Contact details (e.g. e-mail address, telephone number)

- Application data (e.g. CV, possibly also cover letter, references, certificates)

- Knowledge (e.g. language skills, information on further training, qualifications)

- Job-related data (e.g. salary expectations, earliest starting date, severe disability, desired place of work)

- Existence of any consent given (in particular data, content and attribution feature to your person)

- Data from correspondence (e.g. clarification of questions, coordination of appointments)

- If applicable, bank details (for reimbursement of travel expenses)

- If applicable, application photo

- If applicable, links to profiles in professional social networks

The data you provide in the application form will be used to carry out the application process.

Information on severely disabled status

As part of the application process, we offer you the opportunity to voluntarily provide information about any severe disability. We would like to expressly point out that there is no legal obligation for you to provide such information as part of the recruitment process. Nevertheless, we would like to give you the opportunity to take advantage of the protection provided during the recruitment process. If you are severely disabled, the representative body for severely disabled employees will be involved in accordance with Section 178 (2) SGB IX.

Severely disabled status is a health status within the meaning of Art. 4 No. 15 GDPR and thus a particularly sensitive personal data within the meaning of Art. 9 para. 1 GDPR.

2. Purpose of the processing

We process your personal data as part of the application process for the following purposes:

- To carry out the application procedure and to assess your suitability for the position and, if applicable, your recruitment (in the event of a positive recruitment decision).

• As part of our application form in SmartRecruiters, we offer the functionality of "CV parsing". In this case, the fields of our application form are pre-filled with the data from the application documents you have uploaded. Please check critically whether the entries, especially your contact information, are correct.

- To contact you as part of the application process, including to coordinate and arrange appointments (e.g. for interviews).

- To fulfill legal obligations or legal requirements, including any required data comparisons with EU sanctions lists.

- If necessary, to assert, enforce or defend legal claims.

3. Legal basis of processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR. In cases of CV parsing (see above), we rely on Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to support you in the application process by making the application process easier. You don’t have to use the feature.

For the processing of information on any severe disability, we rely on your consent pursuant to Art. 9 para. 2 lit. a GDPR and Art. 9 para. 2 lit. b GDPR in conjunction with § Section 26 para. 3 sentence 1 BDSG in conjunction with. § Section 178 (2) SGB IX in the context of the legally prescribed involvement of the representative body for severely disabled persons in the event that you should inform us of an existing severe disability.

You have the option to withdraw your consent at any time with effect for the future without giving reasons. Accordingly, the lawfulness of the processing carried out on the basis of your consent until revocation is not affected. This also does not affect the processing in the context of any involvement of the representative body for severely disabled persons and any legal obligations on our part in this regard.

4. Recipients

Within Haufe Group, those departments (in particular persons and/or divisions) receive your data that need it to carry out the application process (e.g. HR, legal department, IT, workers council, representative body for severely disabled persons, if applicable) and those colleagues who are involved in the decision-making process or are involved in team recruiting.

Service providers employed by us and working on our behalf (so-called processors) may also receive data for these purposes. These include, for example, hosting and IT service providers. For example, the Haufe Group uses software solutions for efficient applicantion management or for the organizational implementation of the application process.  

In addition, in the event of a corresponding legal obligation or for the defense or assertion of legal claims, we may pass on your personal data to the following recipients or categories of recipients who act as data controllers under data protection law:

- Authorities within the scope of their jurisdiction (e.g. tax office, police, public prosecutor's office), courts and/or other third parties, insofar as you instruct us to pass on data or give your consent or there is a legal obligation on our part.

- As part of the application process, applicant data may be passed on to other companies (see above) within the Haufe Group for further processing for an alternative review process, provided you have given your consent. (see C. Forwarding of your application documents).

5. Storage period and control option

If the application leads to the establishment of an employment relationship, the personal data will also be stored accordingly for the duration of the employment relationship in compliance with the statutory provisions. After the end of the application process, your personal data will generally be removed from our system four months after rejection or withdrawal, taking into account the provisions of the AGG, in particular the existing burden of proof according to § 22 AGG.

The four-month retention period does not apply if and insofar as statutory provisions conflict with this (e.g. tax retention periods if we have reimbursed you for travel expenses).

6. Origin of the data

In general, we collect your personal data from you or, if this is not you, from the person who enters it into the respective form and/or uploads documents.

If you transmit personal data of third parties to us (e.g. as a recruiter), you are obliged to comply with all data protection requirements, in particular those of Art. 5 to 9 and Art. 12 et seq. GDPR. Otherwise, we do not have the intent to collect this data.

B. Applications via other communication channels

If you decide not to use the online application option offered on the careers page via the website, but submit your application via another channel, the information on the types of data processed by us, the purposes, the legal basis, the source and recipients and the storage period under II.A. above apply accordingly. In addition, we would like to draw your attention to the following, taking into account the communication channel you have chosen:

1. E-mail

If you contact us by email and send us your application in this way, the application documents you send will be reviewed by our HR team. We recommend that you encrypt emails securely - there are various tools and programs that are suitable for this purpose.

After the documents have been reviewed, if the application is suitable, it will be processed manually in the system described under A.  

In addition, we process your contact details to give you the opportunity to be included in our alternative review process (C. Forwarding your application documents). We will contact you by email for this purpose. The processing of your contact data for the purpose of sending the request is based on our legitimate interest in maintaining contact with talents in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

Please note that in the case of unsolicited applications, the HR department responsible for this will forward them to the appropriate department in the opinion of the HR department. Your data will be processed further in accordance with the process described under A.

2. Post

If you contact us by post and send us your application in this way, the application documents you send will be viewed by our HR team, scanned and manually entered into the system described under A.. We will then send your application documents back to you.

Please note that in the case of unsolicited applications, the HR department responsible for this will forward them to the appropriate department in the opinion of the HR department. Your data will be processed further in accordance with the process described under A.

C. Forwarding of your application documents (Alternative review process)

1. Scope of data processing

As part of the application process, it may happen that you are not hired for the position for which you have applied, but we are nevertheless interested and we would like to make your application documents available to other departments or Haufe companies. If you have given your consent to alternative review process during the application process, your applicant profile will be forwarded to other departments or Haufe companies within our team.

If another department is also interested in your profile, you will be contacted and the process described under A. will be continued.  

In this context, we will process the types of personal data described under II.A.1.

2. Purpose of processing

The processing of your data enables us – if you have given your consent - to provide  you with alternative job offers and thereby enable you to join a Haufe Group company.  

This is separate from being part of the Talent Communities (see point D.). When forwarding your application documents, we will only check at the time of your application process whether there are other suitable positions for your profile.

3. Legal basis for processing including right of withdrawal

The processing of your applicant data in the form of forwarding to other departments or Haufe companies to carry out the alternative review process is based on your previously given consent in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR.

You can revoke your consent at any time without giving reasons with effect for the future. Accordingly, the lawfulness of the processing carried out on the basis of your consent up to the time of revocation is not affected by your revocation. Please send your objection to: hello@career.haufegroup.com. Of course, you can also use the other contact details mentioned under point I. or edit the checkbox in the candidate login (SmartProfile).

4. Recipient

As part of the transfer of your application documents, your data will be passed on to the categories of recipients listed under point II.A.4.

5. Storage period and control option

Your data will be removed four months after rejection or withdrawal as part of the application process, also in the event of an alternative review process within the meaning of this point II.C, unless your application ends with the establishment of an employment relationship.

6. Origin of the data

For the origin of the data, we would like to refer you to the explanations under point II.A.6.

D. Talent Community

As part of the application form, you can choose whether you are interested in joining our Talent Community. The Talent Communities are our talent pool. If you are part of it, you will be informed about current job offers and we will use them to keep in touch with you.

1. Scope of data processing

We will only accept you into the Talent Communities if you have given us your consent to do so.

As part of our community, we will send you interesting information about the Haufe Group by e-mail, e.g. about current company news, job vacancies, invitations to events, etc. You can unsubscribe from a newsletter at any time, e.g. by clicking on the unsubscribe link in the footer of the respective newsletter. If you unsubscribe from the campaign via the newsletter, you will also be removed from the community by default after a processing period has expired, unless you do not wish this to happen and let us know.

Please note that the communities apply to the entire Haufe Group and therefore the data is shared within the above-mentioned Haufe Group companies.

In addition, we process the types of personal data described under II.A.1 in connection with your admission to the Community.

2. Purpose of processing

The processing of your data in the context of the communities enables us to provide you with information about our company and potential job offers, provided you have given your consent. The communities are based on your area of interest, which you can select according to our areas on the careers page when you first register. In addition, the processing is used to be able to consider you for other suitable vacancies. For this purpose, the knowledge and experience you provide in your CV will be compared with the open vacancies. In the event of a match, you will be contacted by us and can then decide whether you would like to enter the application process.

3. Legal basis incl. withdrawal of consent

If you have already given your consent to be included in the communities at the beginning of the application process, your profile, including your application documents and the newsletters as part of the community, will be stored on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.  

The processing of your contact data for the purpose of sending the request for inclusion in the community is based on our legitimate interest in maintaining contact with talents in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.  

You have the option to withdraw your consent at any time with effect for the future without giving reasons. Accordingly, the lawfulness of the processing carried out on the basis of your consent until revocation is not affected. You can use the unsubscribe link at the end of a newsletter email or contact bewerbung@haufegroup.com. If you unsubscribe from the campaign via the newsletter, you will be removed from the community immediately by default, unless you do not wish this and inform us of this.

4. Recipients

The communities are created for the companies of the Haufe Group. Your information may therefore be passed on within the Haufe Group.

For the operation of our applicant tracking system and communication via the communities, we use a service provider as a processor on the basis of a corresponding contract for order processing.

In addition, your data may also be passed on to the recipients mentioned under point II.A.4.

5. Storage duration and control options

Your data will be stored for a maximum of 23 months on the basis of your consent. At the end of the 23 months, you will receive an email allowing you to inform us whether you wish to remain in the Communities. If you do not give us this consent again, the removal will take place immediately after a processing period of one month at the latest. If you revoke your consent, you will be removed from the communities after a processing period of one month.

If you wish to remain in the community, the data will be stored again for a maximum of 23 months with a subsequent query of your interest.

6. Origin of the data

For the origin of the data, we would like to refer you to the explanations under point II.A.6.

G. Smart Analytics (data analysis)

1. Scope of processing / types of data processed

We process the following types of data as part of the creation of evaluations.

Applicant data:

- Applicant ID

- Application channel (e.g. LinkedIn, career site, recommendation)

- Application type (e.g. unsolicited application, internal application)

- Status history of the application (e.g. steps in the recruiting process)

- Application data (e.g. contact data, desired job, start date, application status, duration until hiring)

- Job information (e.g. location, business unit, creation and publication date of the job).

Employee data:

- Contact data.  

The above-mentioned data types are pseudonymized or anonymized in advance when the evaluations are created.

Pseudonymization: In the case of pseudonymization, the data is changed in such a way that the identifying characteristics are kept separate from the remaining data by means of technical and organizational measures.

Anonymization: In the case of anonymization, the data is changed in such a way that we can no longer assign it to your specific person. Dashboards that are shared with third parties (see 4. Recipients) only contain anonymized data.

2. Purpose of processing

The purpose of the processing is to improve our application processes. In addition, we would also like to better understand the use of our applicant tracking system in order to make it more needs-oriented and user-friendly. We also want to understand which channels our candidates use to apply for the positions we advertise.

3. Legal basis

The legal basis for the processing of personal data, including anonymization, is Art. 6 para. 1 sentence 1 lit. f GDPR. We have a legitimate interest, in particular an economic and non-material interest, in understanding how candidates and employees use our applicat tracking system in order to improve our system and the application processes.

4. Recipients

Within Haufe Group, those departments (in particular persons, divisions and/or departments) receive the data from any evaluations that require them for the purposes pursued (e.g. HR, legal department, IT).

Service providers employed by us and working on our behalf (so-called processors) may also receive data for these purposes. These include, for example, hosting and IT service providers.

5. Storage period

The personal data processed as part of an analysis will only be stored for as long as necessary to fulfill the respective purpose of the analysis. If this purpose no longer applies, we remove personal data, provided this has not already happened and provided there are no legitimate reasons and/or obligations to retain it. The removal of personal data generally takes place after the expiry of the storage period set out under point II.A.5.

6. Origin of the data

For the origin of the data, we would like to refer you to the explanations under point II.A.6.

H. Participation in surveys

In the following, we will inform you about what data is collected and processed when you take part in a voluntary survey, for what purposes and by which recipients it is processed, on what legal basis the data processing takes place and when the data is deleted.

1. Scope of processing / types of data processed

For the purposes of online surveys, we use the services of the provider Netigate Deutschland GmbH, Untermainkai 27-28, 60329 Frankfurt am Main. Netigate processes the information provided by users for the purposes of survey evaluation on our behalf. Unless personal data, such as names or e-mail addresses, are requested, we only store anonymous data (in particular no IP address of the users). If personal data (e.g. name, address, company, etc.) is also requested as part of the survey in addition to the topic of the survey, we will point out separately in the survey that this is additional, voluntary information that we collect and use.

2. Purposes of data processing

We process the data for the improvement of our application process.

3. Legal basis

We use Netigate when you complete a corresponding questionnaire. By submitting your answers, you give your consent within the meaning of Art. 6 para. 1 sentence 1 lit. a GDPR to the processing of your personal data for this purpose.

You can revoke your consent at any time without giving reasons with effect for the future. Accordingly, the legality of the processing carried out on the basis of your consent until revocation is not affected. To do so, please contact: hello@career.haufegroup.com.

4. Recipient

Your personal data will be transferred within the Haufe Group. In addition, the above-mentioned service provider (Netigate) will receive your data as part of the creation of the survey.

5. Storage period

Surveys with personal data are automatically deleted after 13 months.

6. Origin of the data

We receive any personal data processed as part of a survey from the person completing the questionnaire.

I. "Remember job" function

Through our partner talentsconnect, we provide you with the "Remember job" function. On the various pages on our career page, we offer you the option of receiving e-mail notifications about new job offers. After activating the function, you will be sent e-mails as soon as there are new jobs in this area. You can find more details on this in TalentsConnect's privacy policy. Our partner talentsconnect is responsible for this data processing.

J. Data processing when using our careers page/cookies

We provide you with our careers page via our partner talentsconnect. For this purpose, talentsconnect processes certain data. Details can be found in the TalentsConnect privacy policy. Our partner talentsconnect is responsible for this data processing.

K. Disclosure of your data for educational purposes

In the following, we will inform you about how personal data is collected and processed when you apply for a job or an apprenticeship that is carried out together with an educational partner.  

1. Scope of data processing  

In order to enable the educational partner to contact you and to carry out the next steps in the application process, we transmit your name and e-mail address to our contact person at the educational institution. This only applies to jobs which explicitly state that they are offered together with an educational partner. You will be informed of the specific educational partner before the data is transferred. The educational institution is then solely responsible for further processing (separate controller).

2. Purposes of  processing

The purpose is to facilitate employment relationships with our educational partners, for example in the case of offering apprenticeship or Master's degree programs that are offered with a company partner.  

3. Legal basis

We rely on the legal basis of Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures for the potential employment contract to be concluded.  

4. Recipient

Your contact details may be passed on to the following recipients:  

Educational partners such as universities with whom we cooperate to offer educational programs. You will be informed of the specific educational partner before the data is transferred, and the specific partner is usually named in the job posting.

5. Storage period

Personal data is generally deleted after the storage period set out in section II.A.5 has expired.

6. Origin of the data

For the origin of the data, we would like to refer you to the explanations under point II.A.6.

III. What generally happens to your data and do you have to provide it to us?

A. No obligation to provide data

In principle, there is no legal or contractual obligation for you to provide us with your personal data. However, it is not possible for us to make a recruitment decision if you do not provide us with the information we need to make such a decision.

B. Transfers to third countries

In principle, we do not transfer personal data that we collect via our application portal to countries outside the European Union or the European Economic Area (so-called third countries). However, it is possible that data collected via our application portal may be transferred to third countries if and insofar as this is necessary, for example, for communication purposes (e.g. because your email provider is located in a third country) or due to the use of a service provider in a third country. In these cases, we ensure an appropriate level of protection for the data transfer by introducing appropriate protective measures in accordance with Art. 44 et seq. GDPR are introduced. Details of the safeguards we use and further information can be obtained from our Group Data Protection Officer, whose contact details are provided in section IV.D.

C. No automated decision-making

Your personal data will not be used for automated decision-making, including profiling, in accordance with Article 22 GDPR.

IV. What rights do you have and how can you exercise them?

A. Withdrawal/Revocation of consent

You can revoke any consent you have given to the processing of your personal data at any time with effect for the future without giving reasons. Please note that the revocation has no effect on the legality of the previous data processing and that it does not extend to additional other data processing for which there is a legal reason for permission and which may therefore also be processed without your consent.

B. Further rights of data subjects

In addition, you are entitled to the data subject rights described below in accordance with Articles 15 to 21 and 77 GDPR if the legal requirements are met. You can either assert these directly using the contact details we have provided under point I. or contact our Group Data Protection Officer, whose contact details you can find under point IV.D below.

1. Information

You can request at any time that we provide you with information about which of your personal data we process and how and provide you with a copy of the personal data stored about you, Art. 15 GDPR.

2. Rectification

You can request the rectification of inaccurate personal data and the completion of incomplete personal data, Art. 16 GDPR.

3. Erasure ("right to be forgotten")

In certain cases, you can request that we erase the personal data processed by us. This applies, for example, if the data processed about you is no longer necessary for any of the purposes described under point II, you withdraw your consent and we cannot base the processing of the data on any other legal basis. Please note that data that we need for the performance and execution of contracts and for the assertion, exercise and defense of legal claims as well as data for which there are legal, regulatory or contractual retention obligations are excluded from deletion, Art. 17 GDPR.

4. Restriction of processing

Under certain circumstances, you can request the restriction of processing, e.g. if you believe that your data is incorrect, if the processing is unlawful or if you have objected to the data processing. This means that your data may only be processed to a very limited extent without your consent, e.g. to assert, exercise and defend legal claims or to protect the rights of other natural and legal persons, Art. 18 GDPR.

6. Data portability

You have the right to receive the data that you have provided to us and which we process on the basis of your consent or to fulfill the contract, in a common, machine-readable format and to request direct transmission of this data to third parties as far as is technically feasible, Article 20 GDPR.

C. Right to lodge a complaint with a supervisory authority

If you believe that our data processing is unlawful or that we have not granted the rights described above to the extent necessary, you have the right to lodge a complaint with the competent data protection supervisory authority, Art. 77 GDPR. The supervisory authority responsible for our head office is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstrasse 20
70173 Stuttgart
poststelle@lfdi.bwl.de

D. Our Group Data Protection Officer

You can also contact our Group Data Protection Officer to exercise your rights and in case of other inquiries about data protection:

Haufe Group
Mr. Raik Mickler
data protection officer
Munzinger Strasse 9
79111 Freiburg
email: dsb@haufe-lexware.com