Thank you for visiting our website. We are pleased that you are interested in Deutsche Bahn (AG)* as a potential employer. The protection of personal data of applicants**, employees and all third parties connected with us is of particular importance to us.
When processing personal data, Deutsche Bahn takes account of the relevant statutory provisions on privacy and data security applicable in the respective countries, as well as of our internal privacy regulations.
This Privacy Notice provides information on how Deutsche Bahn deals with personal data collected through Deutsche Bahn’s job board web pages, or that you otherwise provide to Deutsche Bahn, due to your application, and explains the handling of your personal data in the course of the application process.
For better clarity, this privacy notice is divided into three sections: The first section A provides general information relevant for all subsidiaries of Deutsche Bahn which use these web pages for their application processes. Country and subsidiary specifics with regard to privacy are then explained in section B. Section C gives you further insights into technically relevant information.
Part A - General Information
1. Which purpose has the personal data collection?
Deutsche Bahn needs your personal data to handle your application. The data you have provided to us in line with your application will only be used and processed for the purpose of applicant selection. For the handling of your application we will only use the information that you have provided to us directly. This may include details that you have stored in online career networks or other job boards.
In addition, it is our goal to make the application process as easy as possible for you. We take your application into account for further positions within our subsidiaries. In this case, we might contact you and invite you to apply for another position if your profile matches. You then decide if you are interested in applying. The same applies for any speculative application that you might have provided to us.
2. Which personal data do we collect?
We record your personal data which is relevant for, or that you provide to us during, the application process (including, but not limited to last name, first name, address, email, position you applied for, and details on your application). To be able to consider your application thoroughly we might also need information on your previous professional career and other similar information.
In the case of a speculative application which does not refer to a concrete position, we also ask for your interests (e.g. with regard to location and job groups of interest) in order to consider you for other suitable jobs.
In the case of an online application you complete the personal data in the online forms and upload the relevant documents. In the case of other application channels, we record the relevant information from your application and store your application documents.
3. Who processes the information from your application?
Due to the organizational structure of Deutsche Bahn and depending on the method of application chosen by you, your application might be processed by different divisions. In all cases, your personal data will exclusively be processed by the unit that is responsible for recruiting and, if necessary, by service providers which are contractually bound and legally obliged to comply with the applicable privacy regulations.
In your online application for a specific job or to attend a recruitment event, you can, as an external applicant, actively agree to the disclosure of your personal data for other suitable jobs in the same or another group company (both nationally and internationally). If you do not agree or if you cancel your agreement, this means that the application will cease to be considered for other jobs. If you have applied by email or post, we will inform you in the acknowledgement of application that we would also like to check your application against other job offers in the same or another group company. In this regard, we will advise you to notify us if you do not agree to this. Prior to any disclosure of your personal data, we will contact you again to obtain your express consent. You may cancel your agreement to disclosure at any time, by email or post, at the address indicated in Clause 1. Cancelling your agreement to disclosure of the application means that the application will cease to be considered for other jobs.
4. Who is informed about your application?
Your personal data is treated strictly confidentially and will be provided only to the competent persons involved in the recruitment process and to subcontractors which might deliver necessary services during the selection process (e.g. online test suppliers). For more details on subcontractors on a country and subsidiary level please refer to section B.
Should you be considered for employment, the subsequent use or disclosure of your information is limited to general accepted employment-related purposes to those with a need to know. This includes information disclosed to internal or third party providers for required pre-employment check, verification and any legal or regulatory requirements.
If you apply online, we ask you to decide to which extent we are allowed to share your personal data:
- In case you select “nationally”, your profile is visible to Personnel responsible for recruitment within the country in which the position is located or which you have selected as country of interest in the speculative application process.
- In case you select “internationally”, your profile is visible to Personnel responsible for recruitment independent in which country they are located. This means that all responsible employees of all DB Group companies that use this platform for their recruitment purposes, including, if applicable, employees of their respective data processors, have access to your application/profile. You find out to which DB Group companies this actually applies if you turn to the overview of the attached local privacy policies (see Section B).
If you applied using any other application channel besides online application, your personal data will only be shared in the country the job is located in.
You can revise your decision on the visibility of your application at any time, for instance you may decide to withdraw your decision to be visible internationally. If you want to do so, please refer to part B and the respective country and subsidiary specific section for the concrete email address.
5. How can you change your personal data?
In the case of an online application you can access and update your profile and personal information in the job board, including your personal data and added documents, at any time. Furthermore, it is possible to withdraw an application for a position via your profile. If you want us to delete your profile and/or some or all of your applications with immediate effect, please refer to part B for the respective email address to request the deletion. In this case we will also inform any subcontractor (e.g. for online tests) who might have received your personal data and request the instant deletion of your personal data.
6. When is your personal data deleted?
Due to different deletion periods based on the diverse applicable local data protection laws please refer to the relevant paragraph in part B for further details. We will only store your personal data as long as necessary.
You have questions about data privacy?
For question and suggestions around the privacy topic please address them to our contact persons in the respective country and subsidiary named in part B.
Part B – Additional Country and Subsidiary Specific Information
You are receiving this information pursuant to articles 13 and 14 of the European General Data Protection Regulation (GDPR), from us, DB Schenker Global Services Europe S.R.L., [full corporate info] (hereinafter “DB SGSE”, “us” or “we”), part of the DB group of companies.
1. Data we process when you apply for a job with DB SGSE
When you apply for a job with us, in addition to the general description in section A above, we process the following two main categories of data about you:
CV and talent management information: details contained in an application and resume/CV or otherwise provided to us by you, including full name, address, email, telephone number, previous employment background, professional qualifications, references, career development and skills analysis, training, departmental changes, etc.
We process this data in order to take steps at your request prior to entering into an employment contract. The data is provided by you directly unless you indicate that we can request external references, in which case references can be provided by those persons.
Identification and compliance search results, including directorship searches, bankruptcy searches, media and social media searches, litigation searches.
We use all of the data above in our legitimate interest to assess candidate suitability, as well as confirming information on resumes, CVs and covering letters, obtaining reference letters and performing reference checks.
This data is obtained from third party public sources available on the internet, such as LinkedIn, Facebook, courts portal.
If you are selected for an offer, you will be presented with a separate notice concerning the processing of personal data of our employees. That will cover preliminary checks we perform and documents we require upon execution of the employment contract (such as medical examination, in some cases criminal records etc).
2. Data we process when you do not actively apply for a job with DB SGSE, but our recruiters headhunt you
It is possible that, even though you have not actively applied for a job with us, our recruiters select you based on the skills included in your public professional profile on platforms like LinkedIn. We do this only when your profile signals that you are open for new opportunities by taking part in LinkedIn’s Open Candidates or a similar tool. This is a selection that you make yourself in your account preferences, and in order to see how you can switch that on or off in the case of LinkedIn, please see this link [https://www.youtube.com/watch?v=fArXoyKYtF0].
In this situation our recruiters can upload in our platform information from your public profile(s), as well as their own notes. The skills you listed on your profile as well as keywords from the descriptions of your career record may be used to match you, both automatically and manually, with job vacancies that we have. We do not use this data to take any automated decisions about you.
When our recruiters build a profile on you, we will inform you by providing this notice by email at the earliest of (i) our first communication with you; (ii) a reasonable term that will not exceed one month from our data collection.
3. How long we store your data
We keep your personal information for no longer than necessary for the purposes for which the personal information is used or otherwise processed. If you become our employee, your recruitment data is consolidated into your employment file which is subject to a separate policy.
Note that this only applies to the electronic records in our recruitment platform. Emails sent to and received from you are subject to our emails retention policy.
4. Disclosure of personal information
4.1 Disclosure to DB group companies
Your personal information may be shared with any company that is a member of our group, where you have selected the visibility of your profile to be “international”, as well as when we consider that it is in our legitimate interests to do so for internal administrative purposes (e.g. storage of data).
We may also share your personal information with our group companies where they provide products and services to us, such as information technology systems or human resources services.
Access to your personal information is limited to those employees who need to know the personal information, and may include your potential managers and their designees, as well as employees in the human resources, corporate services, legal, information technology, security and finance departments.
4.2 Disclosure to third parties
We will share the strictly necessary parts of your personal data, on a need-to-know basis with companies that provide products and services to us (processors), such as:
(a) human resources services and recruitment agencies;
(b) information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery and cyber security services; other outsourcing providers, such as off-site storage providers and cloud services providers.
You can obtain a list of our processors upon request.
We will also disclose your personal information to third parties:
(a) If you request or authorise so;
(b) to persons demonstrating legal authority to act on your behalf;
(c) where it is in our legitimate interests in connection with the merger, sale or other disposition of all or part of our business and/or assets;
(d) if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;
(e) to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or
(f) to protect our rights, property or safety, our employees, customers, suppliers or other persons.
Some of these recipients (including our affiliates) may use your data in countries which are outside of the European Economic Area. Please see below for more detail on this aspect.
5. Transfers of information
The personal information may be processed by staff operating outside the EEA working for us, other members of our group or third-party data processors for the purposes mentioned above.
If we provide any personal information about you to any such non-EEA entities, we will take appropriate measures to ensure that the recipient protects your personal information adequately. These measures include, in the case of service providers based in other countries outside the EEA, entering into European Commission approved standard contractual arrangements.
6. Your rights
You have certain rights in relation to your personal information.
You can request that we provide access to the personal data we may have about you. You may also request information about: the purpose of the processing; the categories of personal data concerned; who else might have received the data from us; what the source of the information was (if you didn’t provide it directly to us); and how long it will be stored.
You have a right to correct (rectify) the record of your personal data maintained by us if it is inaccurate.
You may request that we erase that data or cease processing it, subject to certain exceptions.
Where processing was based on your consent, you can withdraw such consent at any time without any negative consequences.
You may also request that, due to your particular situation, we cease using your data processed under a legitimate interest, subject to certain exceptions. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you wish the erasure of your personal data or the restriction of its processing by us.
You have the right to request that we transfer the data we process about you with your consent or in the performance of a contract, either to you or, where technically feasible, directly to another controller.
You have the right to obtain a copy of the safeguards we use for the transfer of personal data outside of the EEA (if applicable).
You have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how we process your personal data.
If you would like further information in relation to these or would like to exercise any one of them, please contact us (see end of this section - Further questions or making a complaint).
We will consider all such requests and provide our response within a reasonable period (and in any event not longer than one month, which we can extend by two further months if your request is complex). Please note, however, that certain personal information may be exempt from such requests in certain circumstances. If for some reason your request is denied, we will provide an explanation as to why the request has been denied. Similarly, If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.
If you have any questions or concerns about our use of your personal information, please contact us.
If you are dissatisfied with our answers to your inquiries related to the processing of your personal data, you can also make a complaint to the National Supervisory Authority for Processing of Personal Data. You can find further information about the process at http://dataprotection.ro/?page=procedura_de_solutionare_a_plangerilor (in Romanian language).
7. Changes to this Policy
Further questions or making a complaint
If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact:
Name: HR Recruitment Department
Part C – Technical Information
For technical reasons, certain data must be collected and saved when you visit this website. The following data is collected without any action on your part and saved until it is automatically deleted after 10 days:
- IP address from the querying computer,
- Date and time of access,
- Name and URL of the file acessed,
- Website from which the access took place (referrer URL),
- the browser used and in some cases the operating system of your computer.
1. How is your personal data transferred?
The internet server of our provider meets the current security standards. Our aim is to protect your personal data from loss, misuse, unauthorised access, publication, change and deletion. Your personal data is transferred to the servers using the security standard, the TLS method.
2. What is a cookie?
Cookies are small text files which might store personal data. Cookies can be sent to this website when it is called, allowing the user to be identified. Cookies help users to use internet sites more easily.
2.1 How are cookies used?
This is an information of how and in what manner cookies are used on our sites.
Please note that when you delete all cookies, you are also deleting any opt-out cookies, meaning that you must opt out again.
Cookies that are mandatory for using the site:
Session cookies cannot be deactivated as they are necessary for the usage of this website.
The “PHPSESSID cookie” and the "ScustomPortal-[...] cookie" are used by the platform on stateless protocols as identification criteria to recognize several associated requests of a client and to assign them to one session. In these cookies there is a long alphanumerical ID included which is also stored on the server. In case both IDs match, the client is allowed to send a request to the server. The session and the cookie are destroyed as soon as the page is closed.
Cookies that are not mandatory for site use include Google Analytics cookies. Please refer to item 3.
3. Use of Google Analytics
This website uses Google Analytics, a web analysis service of Google Inc. ("Google"), to analyse the use of our website and to improve it on a regular basis. The statistics gathered allow us to improve our offering and design it in a way that is more attractive to you.
The cookies have a runtime of 24 months.
To prevent data (inclusive your IP address) generated by the cookie with regard to the use of the website from being gathered and any processing by Google, you can install the Google browser add-on found under this link https://tools.google.com/dlpage/gaoptout?hl=de.
This sets an opt-out cookie that prevents the collection of your data on our site in future. This applies for this browser only and for this website only. If you delete the cookies in your browser, you must set the opt-out cookie again.
For more information on data protection in connection with Google Analytics, see also Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=de).
4. Use of YouTube
We want to give you a wide variety of information across media formats. Our website includes embedded YouTube videos. We merely enable a connection to YouTube. YouTube is a service of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA.
The privacy-enhanced mode is activated for all YouTube videos on our website. The privacy-enhanced mode is provided by YouTube and ensures that YouTube does not save any cookies containing personal data on your computer. When the website is called up and in the embedding of the videos the IP address is transmitted. This will not be assigned to any other data if before you call up the page you have not logged in to YouTube or another Google service or if you are not permanently logged in.
When you click to play the embedded video, the privacy-enhanced mode means that YouTube saves on your computer only cookies that do not contain any personally identifiable data. These cookies can be disabled in the browser settings and extensions. YouTube sets a session cookie that is deleted when you close your browser.
For more information on the integrated YouTube videos, see YouTube's informational page under: https://support.google.com/youtube/answer/171780?hl=de
* To Deutsche Bahn belong all subsidiary companies of Deutsche Bahn AG.
** For reasons of better legibility, the simultaneous use of male and female language forms is dispensed with. However, all descriptions apply to all gender types.