Privacy Policy

The protection of your personal data is a top priority, and is taken into consideration in all business processes. When and insofar as you share personal data with us, it will be processed in accordance with the provisions of the EU General Data Protection Regulation (GDPR), which has been in effect since May 25, 2018, as well as the statutory data protection provisions of the German Federal Data Protection Act (BDSG). The following Data Protection Notice provides a detailed overview of the processing of your personal data. “Personal data” means all in-formation that relates to a natural person who has been or can be identified. With this Data Protection Notice, we are providing you with comprehensive information on the nature, scope and purposes of the collection of personal data and how this data will be processed. It additionally serves to provide you with information on the rights to which you are entitled in regard to the processing of your personal data. 

1. Scope of the Data Protection Notice 

1.1. Basic principle 

This Data Protection Notice applies for all candidates who come into contact with us or are already in contact with us in the context of our intermediary services, as well as for all companies of The Aristo Group in the same manner, and is summarized in the interest of ease of under-standing. Insofar as the Aristo Group is mentioned in the following in a uniform manner, this shall be understood to encompass the Aristo Recruitment GmbH, Aristo Personnel GmbH, Aristo AG, Aristo Austria Recruitment GmbH, Aristo Temp GmbH, as well as the Lenyx Logistik und Service GmbH. 

1.2. Supplementary applicability of particular provisions for particular services 

There are additional data protection notices pertaining to certain ser-vices that supplement this Data Protection Notice for Candidates. This particularly applies to the use of our website, which is integrated with the “My Aristo” candidate application portal; you can learn about the processing of your personal data that takes place when this portal is used from our Website Data Protection Declaration, which can be accessed and viewed on our website. 

2. Contact Details of the Controller and the Data Protection Officer 

2.1. Controller 

The controllers as defined by the EU General Data Protection Regulation (GDPR) and other national data protection laws of the Member States and other data protection provisions are the Aristo Recruitment GmbH, Aristo Personnel GmbH, Aristo AG, Aristo Austria Recruitment GmbH as well as the Lenyx Logistik und Service GmbH:

Aristo Personnel GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Personnel GmbH is responsible within the scope of its business activities for the placement of candidates in permanent positions with our clients.

Aristo Recruitment GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Recruitment GmbH is responsible within the scope of its entrepreneurial activities as far as the placement of candidates in temporary projects with our clients is concerned.

Aristo AG
Brandschenkestrasse 30
8001 Zurich, Switzerland
Tel: +41 44 274 3900
Mail: info@aristo-group.com
Website: www.aristo-group.ch

The representative of Aristo AG is E- Mail: info@aristo-group.com, website: www.aristo-group.com

Aristo AG is responsible within the scope of its entrepreneurial activities for the provision of specialists to our customers within the scope of temporary employment and for the placement of candidates in temporary projects with our customers, primarily in Switzerland.

Aristo Austria Recruitment GmbH
Graben 12
1010 Vienna, Austria
Tel: + 43 1 3950593
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Austria Recruitment GmbH is responsible for the placement of candidates in temporary projects and permanent positions with our clients in Austria.

Aristo Temp GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Temp GmbH is responsible within the scope of its business activities for the placement of candidates in temporary employment with our clients.

If you have any questions about your personal data, please contact: datenschutz@aristo-group.com

2.2 Contact data protection officer

You can contact our data protection officer at: dsb@aristo-group.com

3. General Principles of Data Processing at the Aristo Group 

3.1. Scope of the processing of personal data 

The Aristo Group shares the underlying philosophy of the GDPR and the Ger-man Federal Data Protection Act (BDSG) that the collection and processing of personal data (“data”) must be minimized whenever possible. For this reason, we only process personal data when doing so is required for clearly defined purposes, which will be set out in the following (principles of data avoidance and data minimization). In such contexts, data processing is only permissible insofar as it can Page be justified according to a sufficient legal basis or your consent (principle of lawfulness). 

3.2 General information on the legal bases for the processing of personal data 

3.2.1. General legal bases 

The processing of personal data is forbidden in principle and is only permissible in exceptional cases. The permissibility of data processing can only be established when the processing of the data can be supported by an appropriate legal basis. The following legal bases are definitively deemed appropriate: 

• Article 6(1)(a) of the GDPR serves as legal basis provided that we have obtained consent to the processing of personal data from the data subject. 

• Article 6(1)(b) of the GDPR serves as the legal basis for the processing of personal data if it is necessary for the performance of a contract to which the data subject is a party. This also applies to processing operations required to carry out pre-contractual actions. 
• Article 6(1)(c) of the GDPR serves as the legal basis for the processing of personal data if it is necessary for the fulfillment of a legal obligation that applies to us. 
• Article 6(1)(d) of the GDPR serves as the legal basis in the event that the data subject’s vital interests or those of another natural person necessitate the processing of personal data. 
• Article 6(1)(e) of the GDPR is the legal basis for processing if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. 
• Article 6(1)(f) of the GDPR serves as the legal basis for processing if the processing is necessary to safeguard the legitimate interests of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override those interests. 

3.2.2. Special legal bases for the processing of special categories of personal data pursuant to Article 9 GDPR 

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. In exceptional cases, the processing of these special categories of personal data by us can also be allowed if there is an appropriate legal basis for this. In particular, the following legal bases come into consideration as appropriate: 

• If the data subject has given explicit consent to the processing of special categories of special data for one or more defined purposes, this can serve as the legal basis for processing (Article 9(2)(a) of the GDPR). This does not apply if the prohibition of the processing of special categories of personal data cannot be lifted pursuant to Union or Member State law. 
• Article 9(2)(e) of the GDPR is the legal basis for processing in the event that the data subject has manifestly made the data public. 
• Processing is permissible pursuant to Article 9(2)(f) of the GDPR if processing of the data is required for the establishment, exercise or defense of legal claims. 

• Processing of data is permitted insofar as it is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; cf. Article 9(2)(g) of the GDPR. 

3.3. Objection and withdrawal of consent to the processing of personal data 

If you have given us consent to process your personal data, you can withdraw your consent at any time. A withdrawal of this type influences the permissibility of the processing of your personal data once you have announced it to us. If our processing of your personal data is based on a balancing of interests, you can lodge an objection to the processing. This is particularly the case when the processing is not required for the performance of a contract with you, which we explain in the following de-scription of functions. In the event of the exercise of an objection of this type, we request an explanation of the reasons why your personal data should not be processed in the manner implemented by our company. If the objection is justified, we will review the situation and either halt/adjust the data processing or inform you of the compelling legitimate grounds according to which we will continue the processing. Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. 

3.4. Data deletion and retention duration 

Your personal data will be deleted or blocked by us as soon as the purpose of retention ceases to apply; “blocking” in this context means any removal of references to your person in the data (e.g. for statistical purposes). In addition, retention may be provided for by the European or national legislatives in regulations, laws or other regulations to which we are subject. The data shall also be blocked or deleted when a retention period prescribed by the specified standards expires, unless there is a need for further retention of the data for the conclusion or performance of a contract. 

4. Human Resources Consulting and Job Placement: Processing of Your Personal Data 

4.1. Description and scope of data processing 

4.1.1. Data collection from generally accessible sources and/or recommendations 

The Aristo Group is a specialized provider of personnel services in the area of the placement of highly qualified specialists in the life science industry. We can place you either as a freelancer on fixed-term project engagements or as a candidate for direct permanent employment with our customers. The Aristo Group actively searches generally accessible sources for candidates for these engagements. In particular, we search sources such as LinkedIn, XING and other career networks where we obtain information on you. We also receive information about you based on recommendations, which are often sent to us by customers and your colleagues. In these cases, we initially store those elements of your personal data that we obtain from these public sources or recommenders. This typically encompasses: 

• First and last name 

• Telephone number and email address 
• Place of residence 
• Focus of qualifications (e.g. project manager) 
• Education / professional experience 
• Skills / soft skills 

After storing your data, we will contact you immediately, within one month at the latest, and inform you of the processing of your data. 

4.1.2. (Further) data collection directly from you 

If, after we make contact with you but also in the event of an unsolicited application on your part, you are interested in being included in our database, or potentially would like to apply to an advertised position with one of our customers directly, we will collect additional personal data from you. This can typically encompass the following categories of data: 

• (Additional) master data and contact details, particularly: form of address and title, names, addresses, telephone numbers, email addresses, date of birth, marital status, nationality; 
• Image recordings, particularly in the form of an application photo or in the context of a video interview using Microsoft Teams or Zoom; 

• (Further) data on your qualifications and knowledge, particularly: school education and vocational training and/or higher education, other training and professional education, professional experience, previous roles and previous industries, previous customers and project experience, references, language skills, other qualifications (driver’s license, etc.) and soft skills, publications; 
• Data on your availability, work locations, commercial terms, 
• Tax data, particularly VAT ID and/or tax ID; 
• Bank account data; 
• Data from commercial registry extracts and police clearance certificates; 

• Copies of identity documents (ID card and/or passport); 
• Insurance data, particularly on employers’ liability insurance; 
• For (intended) positions in Switzerland: data from AHV ID, religious denomination data, data on spouse and children, workload data, degree of fitness for work; 
• Potentially other data related to the establishment and performance of the contractual relationship. 

4.2. Purposes of data processing 

In the context of your inclusion in our database or in the event of a specific or general application to potential positions, we use your information to create a qualification profile without your name, master data, images, mailing address, email address and other contact data (hereinafter “personal contact data”), but with information on availability, hourly rate, qualifications, project-related experience from your profile and other project-relevant information where applicable. We send this qualification profile to our customers unsolicited, if and insofar as we assume that you may be of interest to this customer based on your profile. We also carry out “matching” on the basis of concrete customer requests to find out whether or not you are suitable for a specific project and/or job listing of one of our customers. This means that we filter out / derive your skills and experience from the data you have provided to us (particularly the text of your CV, your project history etc.) in order to then carry out a partially automated and/or manual assignment of your profile to a customer request; in particular, the partially automated evaluation of your data can take place through the use of codes/filters that we use to restrict the search to suitable candidates for the respective projects. This can result in a situation where you are not brought into consideration for specific customer requests / customer requirement profiles (project and/or job listings) due to the partially automated derivation. Overall, the processing of your data serves the purpose of reviewing your suitability for current or future job placements that you would like to apply for or for which you would like to be considered, and to facilitate your successful placement in interesting roles with prestigious contractual partners (customers). The processing additionally serves the purpose of establishing contact with you in order to update you on the progress of your applications or to inform you of different / additional job listings that may be of interest to you. The communication conducted between you and the Aristo Group is documented historically by us in a customer relationship management (CRM) system. In addition to this direct contact, internal notes and comments relevant to the current or future recruitment process are also recorded in the CRM system. This processing of your data serves the purpose of handling procedures quickly and without errors or loss of information so that we can provide you with optimized service in accordance with your wishes and expectations. In addition, the processing of your data serves the purpose of fulfilling public obligations that apply to us or to our customers for whom we would like to bring you into consideration. The processing of your data also serves the purpose of the general performance of the contractual relationship with you, and is required for the performance thereof. 

4.3. Transfer of your data to customers for the review of your credentials, when applicable 

Your qualification profile (cf. Section 4.2), which is stored in our database, is only made accessible to potential customers in anonymized form (without personal contact data, cf. Section 4.2); this serves to prevent the customer from recognizing your identity to the furthest possible extent. The qualification serves the purpose of an initial introduction, evaluation and selection by the customer with the goal of achieving a placement. If the customer is interested in a placement, we will only share your name and other project-relevant personal data with the customer after prior consultation with you. Of course, it is not possible for potential customers to search our database directly; they have no access to your personal contact data. As a matter of course, we can assume no responsibility for the confidential, purposeful, and data protection-compliant handling of your transferred data, particularly your personal contact data, by potential clients. Please keep this in mind particularly when entering your CV data, the transmission of additional data and files carried out for introductory purposes, and the sharing of personal data, e.g. via a social network, with a potential customer. Additionally, we compare individual items of your information, particularly concerning your references, qualifications and any criminal record, with the information we already possess or data provided by third parties (particularly reference providers, public databases) in or-der to verify the accuracy of your submissions; transmission of this data to the corresponding third parties may occur in this context. Beyond this, we will only share your data with third-party service providers who review your submissions, particularly concerning references, qualifications and any criminal record, on our behalf in exceptional cases; this occurs only if these reviews are appropriate and permissible in accordance with local law, and always takes place on the basis of exact instructions from us and in accordance with this data protection declaration. 

4.4. Legal bases of data processing 

4.4.1. Processing based on your consent 

The legal basis for the processing of your data in the event of the existence of your consent is Article 6(1)(1)(a) GDPR; if special categories of personal data will be processed, your consent pursuant to Article 9(2)(a) GDPR is a supplementary legal basis. In this respect, you give consent for your personal data (particularly in the scope specified above) to be processed within the framework of this Data Protection Notice for the purposes described. The Aristo Group is permitted to transmit your personal data within the relevant requisite scope to potential customers for the purpose of initiating a placement. Your personal data will not be transmitted to third parties without your express consent if doing so is not necessary for the performance of service or the execution of a contract. In the event, for example, that an ap-plication on your part or an attempted placement on our part for a specific role should prove unsuccessful, you can give your consent for the Aristo Group to continue processing your data even beyond the end of the specific placement attempt. The Aristo Group is also permitted to use your data to contact you in the future, particularly in order to reach you for the continuation of the placement or for a new placement. 

4.4.2. Processing based on the establishment/implementation of a contract 

If the processing of your data already serves to facilitate the performance of a contract to which you are a party or the implementation of pre-contractual actions, an additional legal basis for processing of the data is Article 6(1)(1)(b) GDPR. 

4.4.3. Processing based on statutory provisions 

The Aristo Group is subject to statutory and regulatory stipulations. The fulfillment of the statutory requirements arising from these requires the collection and processing of your personal data (Article 6(1)(1)(c) GDPR). 

4.4.4. Processing based on legitimate interests 

In addition, we process your personal data if doing so is necessary in order to safeguard the legitimate interests of the Aristo Group or a third party (pursuant to Article 4(10) GDPR) and is not overridden by the interests or fundamental rights and freedoms of the data subjects (in the present case: you) which require the protection of personal data (Article 6(1)(1)(f) GDPR). In particular, processing of your data based on a legitimate interest may take place so that the Aristo Group can carry out internal controlling. Your data may also be processed so that the Aristo Group can establish claims or defend itself against claims in legal disputes. In this respect, the Aristo Group also assumes that your interests override your fundamental rights and freedoms that require the protection of your data. If our processing of personal data is based on a balancing of interests, you can lodge an objection to the processing. In the event of the exercise of an objection of this type, we request an explanation of the reasons why the personal data should not be processed in the manner implemented by our company. If the objection is justified, we will review the situation and either halt/adjust the data processing or inform you of the compelling legitimate grounds according to which we will continue the processing. 

4.4.5. Retention duration; objection and erasure options 

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. If the processing of the data already serves to facilitate the performance of a contract to which you are a party or the implementation of a pre-contractual action, then the data will be deleted once it is no longer needed for the performance of the contract. Concluding an agreement may also result in the necessity to store your personal data in order to meet contractual or statutory obligations – particularly retention obligations under commercial and tax law – or to safeguard our legitimate interests: 

• Retention in order to comply with retention obligations under commercial and/or tax law to the requisite extent applicable to us. The periods for the fulfillment of commercial and/or tax law retention periods are ten years, in accordance with the statutory provisions for all documents that are necessary for profit determination; the retention period for business letters (including e-mails) is six years. Article 6 (1)(1)(c) of the GDPR is the legal basis for this; 

• According to the provisions of the German Civil Code (BGB), statutory retention periods can amount to up to 30 years, with the regular retention period being three years. For this reason, we retain the contract documents and documents related to the contract in accordance with these statutory retention regulations in order to be able to conduct any potentially necessary (legal) disputes. Article 6 (1)(1)(f) of the GDPR is the legal basis for this. 

If the processing of your data is based on consent, you can send a corresponding message to datenschutz@Aristo-group.de to wholly or partially withdraw this consent for the future. If you withdraw your consent, this may prevent you from being referred to positions to be filled, particularly if doing so causes your general or concrete application to lose the generally customary explanatory power and thus makes it impossible for potential customers to establish an image of who you are. If you withdraw your consent, we will delete your data as a general principle; if the data is necessary for the performance of a contract or the implementation of pre-contractual actions, then a premature erasure of data is possible only to the extent that this is not opposed by contractual or statutory obligations. 

5. Transfer of your data to third parties 

Unless already specifically described above, we will not share your personal data with third-party companies, organizations or persons except in one of the following situations: 

• We share data with public bodies (authorities), companies, organizations or persons when we are obligated to do so in accordance with applicable laws, regulations, legal proceedings or enforceable official orders, or can assume in good faith that access to this data or the use, retention or transfer thereof can be reasonably expected to be necessary in order to fulfill equivalent obligations (Article 6(1)(1)(c) GDPR); 

• The Aristo Group retains and processes your data in the context of the establishment and performance of a contractual relationship with you in an IT system that is also used by the other the Aristo Group companies named in Section 1.1. For this reason, the data stored there by the Aristo Group is also technically accessible to these companies. Access to your personal data by these companies is generally not allowed, but the possibility of this cannot be totally ruled out. The companies will access the data insofar as doing so is necessary for the business relationship with you and is not opposed to any of your legitimate interests (Article 6(1)(1)(f) GDPR); 
• We provide the data to our third-party business partners and other trustworthy companies or persons who process the data on our behalf. This takes place on the basis of precise instructions from us and in accordance with this data protection declaration. 

6. Transfer of your data to third countries or international organizations 

Unless expressly stated in this data protection declaration, your personal data will not be transmitted to third countries (countries outside the EU / the EEA) or international organizations.  

7. Automated Individual Decision-making, Including Profiling 

Unless otherwise explicitly described above, no automated decision-making takes place. 

8. Your Rights 

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights in relation to the data controller. You may contact any of the bodies listed in 2.1.1 through 2.1.3 to exercise your rights. 

8.1. Right of access 

You have the right to access to the data stored with the controller, particularly to information on the purpose of the processing and how long the data will be retained (Article 15 GDPR). 

8.2. Right to rectification 

You have the right to ask the controller to rectify and/or complete your personal data if the processed personal data pertaining to you is in-correct or incomplete. The controller is obligated to rectify the data without undue delay. 

8.3. Right to restriction of processing 

You have the right to request the restriction of the processing of your data. This right particularly applies for the duration of the review in the event that you have contested the accuracy of the data pertaining to you, as well as in the event that you would like processing to be restricted instead of exercising an existing right to erasure. A re-striction of processing shall also take place in the event that the data is no longer necessary for our purposes, but you still need the data for the establishment, exercise or defense of legal claims, and if the successful exercise of an objection is disputed between you and the controller (Article 18 GDPR). 

8.4. Right to erasure 

You have the right to request the erasure of the personal data pertaining to you by the controller. These requirements specify that you can request the deletion of your data if, for example, the controller no longer needs the personal data for the purposes for which it was collected or otherwise processed, the controller processes the data un-lawfully, you have lodged a legitimate objection, you have withdrawn your consent, or a statutory obligation of deletion exists (Article 17 GDPR). 

8.5. Right to data portability 

You have the right to receive the personal data you have provided to the controller from the controller in a structured, common and ma-chine-readable format (Article 20 GDPR) insofar as it has not already been deleted. 

8.6. Right to object 

You have the right to file an objection at any time to processing of personal data pertaining to you that is collected under Article 5(1)(1)(e) or (f) GDPR (Article 21 GDPR) for reasons relating to your particular situation. The controller will halt the processing of your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the purpose of the establishment, exercise or defense of legal claims. In the event that you object, for example, to the use of your data for advertising purposes, the controller will cease processing your data for such purposes. 

8.7. Right to withdraw consent 

You have the right to withdraw your declaration of consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 

8.8. Right not to be the subject of automated decision-making in individual cases, including profiling 

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision 

• is necessary for entering into, or performance of, a contract be-tween you and the controller; 

• is authorized by Union or Member State law to which the con-troller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or 
• is based on your explicit consent. 

However, these decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. With regard to the cases referred to in points (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. 

8.9. Right to lodge a complaint with a supervisory authority 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you violates the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR. 

The protection of your personal data is a top priority, and is taken into consideration in all business processes. When and insofar as you share personal data with us, it will be processed in accordance with the provisions of the EU General Data Protection Regulation (GDPR), which has been in effect since May 25, 2018, as well as the statutory data protection provisions of the German Federal Data Protection Act (BDSG). The following Data Protection Notice provides a detailed overview of the processing of your personal data. “Personal data” means all information that relates to a natural person who has been or can be identified. With this Data Protection Notice, we are providing you with comprehensive information on the nature, scope and purposes of the collection of personal data and how this data will be processed. It additionally serves to provide you with information on the rights to which you are entitled in regard to the processing of your personal data. 

1. Scope of the Data Protection Notice 

1.1. Basic Principle 

This Data Protection Notice applies for all candidates who come into contact with us or are already in contact with us in the context of our intermediary services, as well as for all companies of The Aristo Group in the same manner, and is summarized in the interest of ease of under-standing. Insofar as the Aristo Group is mentioned in the following in a uniform manner, this shall be understood to encompass the Aristo Recruitment GmbH, Aristo Personnel GmbH, Aristo AG, Aristo Austria Recruitment GmbH, Aristo Temp GmbH, as well as the Lenyx Logistik und Service GmbH. 

1.2. Supplementary applicability of particular provisions for particular services 

There are additional data protection notices pertaining to certain services that supplement this Data Protection Notice. This particularly applies to the use of our website; the data protection declaration for use of our website can be accessed and viewed on our website. 

2. Contact information of the controller and the data protection officer 

2.1. Controller 

The controllers as defined by the EU General Data Protection Regulation (GDPR) and other national data protection laws of the Member States and other data protection provisions are the Aristo Recruitment GmbH, Aristo Personnel GmbH, Aristo AG, Aristo Austria Recruitment GmbH, Aristo Temp GmbH, as well as the Lenyx Logistik und Service GmbH:

Aristo Personnel GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Personnel GmbH is responsible within the scope of its business activities for the placement of candidates in permanent positions with our clients.

Aristo Recruitment GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Recruitment GmbH is responsible within the scope of its entrepreneurial activities as far as the placement of candidates in temporary projects with our clients is concerned.

Aristo AG
Brandschenkestrasse 30
8001 Zurich, Switzerland
Tel: +41 44 274 3900
Mail: info@aristo-group.com
Website: www.aristo-group.ch

The representative of Aristo AG is E- Mail: info@aristo-group.com, website: www.aristo-group.com

Aristo AG is responsible within the scope of its entrepreneurial activities for the provision of specialists to our customers within the scope of temporary employment and for the placement of candidates in temporary projects with our customers, primarily in Switzerland.

Aristo Austria Recruitment GmbH
Graben 12
1010 Vienna, Austria
Tel: + 43 1 3950593
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Austria Recruitment GmbH is responsible for the placement of candidates in temporary projects and permanent positions with our clients in Austria.

Aristo Temp GmbH
Alter Hof 5
80331 Munich, Germany
Tel: +49 89 599 1827 0
E-Mail: info@aristo-group.com
Website: www.aristo-group.com

Aristo Temp GmbH is responsible within the scope of its business activities for the placement of candidates in temporar employment with our clients.

If you have any questions about your personal data, please contact: datenschutz@aristo-group.com

2.2 Contact data protection officer

You can contact our data protection officer at: dsb@aristo-group.com

3. General principles of data processing 

3.1. Scope of the processing of personal data 

The Aristo Group shares the underlying philosophy of the GDPR and the German Federal Data Protection Act (BDSG) that the collection and processing of personal data (“data”) must be minimized whenever possible. For this reason, we process personal data only when doing so is required for clearly defined purposes, which will be set out in the following (principles of data avoidance and data minimization). In such contexts, data processing is permissible only insofar as it can be justified according to a sufficient legal basis or your consent (principle of lawfulness). 

3.2. General information on the legal bases for the processing of personal data 

3.2.1. General legal bases 

The processing of personal data is forbidden in principle and is permissible only in exceptional cases. The permissibility of data processing can be established only when the processing of the data can be supported by an appropriate legal basis. The following legal bases are definitively deemed appropriate: 

• Article 6(1)(a) GDPR serves as legal basis provided that we have obtained consent to the processing of personal data from the data subject. 
• Article 6(1)(b) GDPR serves as the legal basis for the processing of personal data if it is necessary for the performance of a contract to which the data subject is a party. This also applies to processing operations required to carry out precontractual actions 
• Article 6(1)(c) GDPR serves as the legal basis for the processing of personal data if it is necessary for the fulfillment of a legal obligation that applies to us. 

• Article 6(1)(d) GDPR serves as the legal basis in the event that the data subject’s vital interests or those of another natural person necessitate the processing of personal data. 
• Article 6(1)(e) GDPR is the legal basis for processing if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us 
• Article 6(1)(f) GDPR serves as the legal basis for processing if the processing is necessary to safeguard the legitimate interests of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override those interests.  

3.2.2. Special legal bases for the processing of special categories of personal data pursuant to Article 9 GDPR 

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. In exceptional cases, the processing of these special categories of personal data by us can also be allowed if there is an appropriate legal basis for this. In particular the following legal bases come into consideration as appropriate: 

• If the data subject has given explicit consent to the processing of special categories of special data for one or more defined purposes, this can serve as the legal basis for processing (Article 9(2)(a) GDPR). This does not apply if the prohibition of the processing of special categories of personal data cannot be lifted pursuant to Union or Member State law. 
• Article 9(2)(e) GDPR is the legal basis for processing in the event that the data subject has manifestly made the data public. 
• Processing is permissible pursuant to Article 9(2)(f) GDPR if processing of the data is required for the establishment, exercise, or defense of legal claims. 
• Processing of data is permitted insofar as it is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; cf. Article 9(2)(g) GDPR.  

3.2.3. Special legal basis for the processing of personal data in the employment relationship 

According to Article 88(1) GDPR in conjunction with Article 26 BDSG, various specific features apply when processing personal data of employees for purposes relating to the employment relationship. These particularly include specific features regarding the legal bases for the processing of personal data for the purpose of the employment relationship as per Article 26(1) through (4) BDSG.. 

3.3. Objection and withdrawal of consent to the processing of personal data 

If you have given us consent to process your personal data, you can withdraw your consent at any time. A withdrawal of this type influences the permissibility of the processing of your personal data once you have announced it to us. If our processing of your personal data is based on a balancing of interests, you can lodge an objection to the processing. This is particularly the case when the processing is not required for the performance of a contract with you, which we explain in the following description of functions. In the event of the exercise of an objection of this type, we request an explanation of the reasons why your personal data should not be processed in the manner implemented by our company. If the objection is justified, we will review the situation and either halt/adjust the data processing or inform you of the compelling legitimate grounds according to which we will continue the processing. Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time 

3.4. Data deletion and retention duration 

Your personal data will be deleted or blocked by us as soon as the purpose of retention ceases to apply; “blocking” in this context means any removal of references to your person in the data. In addition, retention may be provided for by the European or national legislatures in regulations, laws or other regulations to which we are subject. The data shall also be blocked or deleted when a retention period prescribed by the specified standards expires, unless there is a need for further retention of the data for the conclusion or performance of a contract. 

4. Processing of your personal data in order to conduct the application procedure for a specific job 

4.1. Description and scope of data processing 

If you apply for a specific job or internship at an Aristo Group company, personal data is processed in the context of the requisite application procedure. This can – depending on the content of your application – particularly include the following categories of personal data: 

• Master data and private contact information: in particular form of address, first names, last names, addresses, telephone numbers, e-mail addresses, marital status, and further data regarding family circumstances, age and date of birth, nationality; 
• If proxies, representatives or contact persons are named: their master data and private contact information as well as data regarding the type of representation and the degree of any relationship; 

• Qualifications and skills, in particular data regarding school qualifications, degrees, vocational qualifications, additional qualifications, certificates, language skills, special skills; 
• Any data contained in the ID card, driver’s license, or other submitted identification documents, or other authentication data; 
• Any data regarding exercise of further or previous employed or independent activities and any related data regarding contractual content and contractual partners; 
• Any data regarding equity investments in corporations; 
• Bank information; 

• Tax data, in particular tax ID, tax number, certificate in tax matters as well as social insurance data and employer’s liability insurance association data; 
• Data from postal, electronic, and telephone communication between you and the Aristo Group as well as between you and third parties; 
• Health data, if applicable; 
• Any image recordings, particularly in the form of an application photo or in the context of a recorded or live video interview; 
• Any data communicated in the context of your application. 

4.2. Source of the personal data 

Aristo Group collects your personal data from you directly. Furthermore, the Aristo Group also processes personal data that we have permissibly obtained from other Aristo Group companies (see Section 2.1.). In addition, in order to conduct the application process, it may be necessary to process personal data that we have obtained from third-party companies (e.g. past employers) or other third parties, e.g. social insurance funds etc., permissibly and for the respective purpose. 

4.3. Purposes of data processing 

The Aristo Group collects and processes your data in order to conduct the application procedure. In particular, the Aristo Group collects and processes your data for the following purposes:. 

• To check your suitability for the vacant job or internship; 
• To meet the existing social insurance-related and other legal obligations; 
• For correspondence with you and any proxies or representatives. 

Your data shall solely be processed to check your application for the vacant post, and shall be sent to the directly responsible decision-makers. The applicant management system in which your data is stored is access-protected, meaning that only duly selected and authorized employees of the corresponding HR units and departments can have access to and process your data. Our employees are obliged to maintain confidentiality and comply with the applicable statutory data protection regulations. 

4.4. Legal bases of data processing 

4.4.1. Processing to meet pre-contractual obligations 

The legal basis for the processing of your data is Article 6(1)(1)(b) in conjunction with Article 88(1) GDPR in conjunction with Article 26(1)(1) BDSG. Data processing is essential to the creation of contractual relationship between you and the Aristo Group and to fulfillment of the resultant obligations. We need you to make your personal data available so that a decision can be made regarding your application. If you do not make your personal data available, it may not be possible to conclude a contract. 

4.4.2. Processing based on your consent 

In addition and in particular, as far as the processing of special categories of personal data is concerned (in particular data regarding your religion or beliefs, sexual orientation, ethnic origin, health data etc. of which you disclose voluntary information that can be derived from a transmitted photograph (application photograph)), the legal basis for the processing of this data is your express consent pursuant to Article 6(1)(1)(a) in conjunction with Article 9(2)(a) in conjunction with Article 88(1) GDPR in conjunction with Article 26(3)(2) and (2) BDSG, which you can provide in the context of your application; alternatively, Article 9(2)(e) GDPR can be a legal basis if you have clearly disclosed the data, particularly in the course of your application. If you do not provide the corresponding consent or there is no other legal basis, in some circumstances your application cannot be processed, or can be processed only after further consultation with you. Processing on the basis of your consent is also carried out if you agree to let the Aristo Group to include your application – should it prove to be unsuccessful – in the general applicant pool so that it can be considered for other future vacancies (see also Section 4.5.2.). 

4.4.3. Processing based on a legitimate interest 

In addition, the Aristo Group processes your personal data if doing so is necessary in order to safeguard the legitimate interests of the Aristo Group or a third party (pursuant to Article 4(10) GDPR) and is not overridden by the interests or fundamental rights and freedoms of the data subjects (in the present case: you) which require the protection of personal data (Article 6(1)(1)(f) GDPR). Processing of your data based on a legitimate interest is particularly carried out if your data is stored in the IT systems jointly used with other Aristo Group companies. The Aristo Group comprises the companies stated in Section 2.1. These companies technically have access to the jointly used IT systems and the data stored there. Access to and processing of this data are carried out only if this is necessary in order to conduct and handle the application procedure with you in line with the purposes set out above. Furthermore, processing of your data based on a legitimate interest may take place so that the Aristo Group can carry out internal controlling. In addition, your data may be processed so that the Aristo Group can establish claims or defend itself against claims in legal disputes. In this respect, the Aristo Group also assumes that your interests override your fundamental rights and freedoms that require the protection of your data. 

4.5. Retention duration; objection and erasure options 

Processing of your data is carried out for the duration of the respective application procedure until the post is filled. When your personal data no longer needs to be processed for the application procedure, it will be deleted after a period of six months. This period arises from the fact that the Aristo Group must be able to defend itself against legal claims that you could enforce under the German General Act on Equal Treatment if the Aristo Group rejects your application; the legal basis is Article 6(1)(1)(f) GDPR, with the legitimate interests of the Aristo Group also arising from these stated purposes. 

5.Talent pool 

5.1. Description and scope of data processing 

The Aristo Group maintains a talent pool in which the contact information of promising people are included, for instance in the context of careers fairs. You have the opportunity to be entered in the talent pool. To this end, the Aristo Group regularly processes the following elements of your data: 

• Master data and private contact information: form of address, first names, last names, addresses, telephone numbers, email addresses, age and date of birth; 
• Any CVs (in some cases including application photograph) 
• Any relevant (work-related) references and diplomas 

5.2. Source of the personal data 

The Aristo Group collects your personal data from you directly. Furthermore, the Aristo Group also processes personal data that we have permissibly obtained from other Aristo Group companies (see Section 2.1.). In addition, in order to conduct the application process, it may be necessary to process personal data that we have obtained from third-party companies (e.g. previous employers, online databases) or other third parties, e.g. social insurance funds etc., permissibly and for the respective purpose.  

5.3. Purposes of data processing 

In particular, the Aristo Group collects and processes your data for the following purposes: 

• Sending of a newsletter to keep you up to date with developments at the Aristo Group, interesting events and exciting job opportunities; 
• Making personal contact with you if the Aristo Group would like you to recruit you for a specific job at the Aristo Group; 

5.4. Legal bases of data processing 

5.4.1. Processing to meet contractual obligations 

The legal basis for the processing of your data is Article 6(1)(1)(b) GDPR. The Aristo Group processes your data in the course of a contractual relationship existing between you and the Aristo Group that is concluded upon your entry in the talent pool. Processing of your data is necessary for fulfillment of the resultant obligations. 

5.4.2. Processing based on your consent 

Alternatively, the legal basis for the processing of this data can be your express consent pursuant to Article 6(1)(1)(a), possibly in conjunction with Article 9(2)(a), possibly in conjunction with Article 88(1) GDPR in conjunction with Article 26(2) BDSG, which you can provide when entering the talent pool. 

5.4.3. Processing based on a legitimate interest 

In addition, the Aristo Group processes your personal data if doing so is necessary in order to safeguard the legitimate interests of the Aristo Group or a third party (pursuant to Article 4(10) GDPR) and is not overridden by the interests or fundamental rights and freedoms of the data subjects (in the present case: you) which require the protection of personal data (Article 6(1)(1)(f) GDPR). Processing of your data based on a legitimate interest is particularly carried out if your data is stored in the IT systems jointly used with other Aristo Group companies. The Aristo Group comprises the companies stated in Section 2.1. These companies technically have access to the jointly used IT systems and the data stored there. Access to and processing of this data are carried out only if this is necessary for upkeep of the talent pool (in particular for notification of and participation in events, sending of newsletters and targeted communication with you). Furthermore, processing of your data based on a legitimate interest may take place so that the Aristo Group can carry out internal controlling. In addition, your data may be processed so that the Aristo Group can establish claims or defend itself against claims in legal disputes. In this respect, the Aristo Group also assumes that your interests override your fundamental rights and freedoms that require the protection of your data 

5.5. Retention duration; objection and erasure options 

The Aristo Group processes and stores your data only for as long as it is needed in order to fulfill the agreed purposes, in particular to fulfill contractual or statutory obligations arising from the contractual relationship with you; this happens for as long as the contractual relationship with you exists and the data passed on by you has to be retained in order to comply with statutory retention obligations. If the processing of your data is based on your consent, the Aristo Group processes and stores your data only until you revoke the underlying consent. If there is no longer any basis for the processing of your data, the Aristo Group will block any personal reference to you (particularly in our CRM system) in line with data protection rules, or, if this is not possible, will erase the data. 

6. Transfer of your data to third parties 

Unless otherwise described above, the Aristo Group will not pass on any personal data to third-party companies, organizations, or persons except in one of the following situations: 

6.1. Transfer of data to associated companies (Section 2.1) in the context of joint data retention 

The Aristo Group stores and processes your data in an IT system that is also used by the other Aristo Group companies named in Section 2.1. For this reason, the data stored there by the Aristo Group is also technically accessible to these companies. Access to your personal data by these companies is allowed here only if this is essential for the stated purposes. 

Transfer of data when conducting video interviews by means of StarLeaf and Skype 

If you conduct a video interview by means of StarLeaf or Skype, your collected personal data (image and video data) is sent to the software provider as well as the other person or persons involved in the conversation. The Aristo Group has no influence on the processing of your data by these third parties. Further information regarding data protection at StarLeaf can be found in StarLeaf’s data protection declaration via the following link: https://support.starleaf.com/legalinformation/starleaf-privacy-notice/. Further information regarding data protection at Skype can be found in Skype’s data protection declaration via the following link: https://privacy.microsoft.com/dede/privacystatement/ 

6.3. Forwarding of data to processors 

The Aristo Group makes personal data available to other companies associated with Aristo Group in the Aristo Group as well as to our third-party business partners and other trusted companies or persons that process the data on Aristo Group’s behalf. This takes place on the basis of precise instructions from the Aristo Group and in accordance with this data protection declaration as well as other appropriate confidentiality and security measures 

7. Transfer of your data to third countries or international organizations 

Unless expressly stated in this data protection declaration, your personal data will not be transmitted to third countries (countries outside the EU/the EEA) or international organizations.  

8. Automated individual decision-making, including profiling 

No fully automated decision-making (including profiling) as per Article 22 GDPR is used to process the data passed on by you. 

9. Your rights 

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights in relation to the data controller. You may contact any of the bodies listed in Section 2.1.1 through 2.1.4 to exercise your rights. 

9.1. Right of access 

You have the right to access to the data stored with the controller, particularly to information on the purpose of the processing and how long the data will be retained (Article 15 GDPR). 

9.2. Right to rectification 

You have the right to ask the controller to rectify and/or complete your personal data if the processed personal data pertaining to you is incorrect or incomplete. The controller is obliged to rectify the data without undue delay. 

9.3. Right to restriction of processing 

You have the right to request the restriction of the processing of your data. This right particularly applies for the duration of the review in the event that you have contested the accuracy of the data pertaining to you, as well as in the event that you would like processing to be restricted instead of exercising an existing right to erasure. A restriction of processing shall also take place in the event that the data is no longer necessary for our purposes, but you still need the data for the establishment, exercise, or defense of legal claims, and if the successful exercise of an objection is disputed between you and the controller (Article 18 GDPR). 

9.4. Right to erasure 

You have the right to request the erasure of the personal data pertaining to you by the controller. These requirements specify that you can request the deletion of your data if, for example, the controller no longer needs the personal data for the purposes for which it was collected or otherwise processed, the controller processes the data unlawfully, you have lodged a legitimate objection, you have withdrawn your consent, or a statutory obligation of deletion exists (Article 17 GDPR). 

9.5. Right to data portability 

You have the right to receive the personal data you have provided to the controller from the controller in a structured, common, and machine-readable format (Article 20 GDPR) unless it has already been deleted. 

9.6. Right to object 

You have the right to file an objection at any time to processing of personal data pertaining to you that is collected under Article 6(1)(1)(e) or (f) GDPR (Article 21 GDPR) for reasons relating to your particular situation. The controller will halt the processing of your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the purpose of the establishment, exercise, or defense of legal claims. In the event that you object, for example, to the use of your data for advertising purposes, the controller will cease processing your data for such purposes 

9.7. Right to withdraw consent 

You have the right to withdraw your declaration of consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 

9.8. Right not to be the subject of automated decisionmaking in individual cases, including profiling 

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision 

• is necessary for entering into, or performance of, a contract between you and the controller; 
• is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safegu 
• is based on your explicit consent 

However, these decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. With regard to the cases referred to in points (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. 

9.9. Right to lodge a complaint with a supervisory authority 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you violates the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.