Data Protection Information for Job Applicants

This information on data protection relates to the processing of the personal data of job applicants (data subject, hereinafter “you” or “yours”) by

• CTS EVENTIM AG & Co. KGaA
• CTS EVENTIM Austria GmbH
• CTS EVENTIM Solutions GmbH
• CTS EVENTIM Sports GmbH
• EVENTIM Light GmbH
• EVENTIM Marketing and Sponsoring GmbH
• EDGE Entertainment Digital GmbH
• Kess Berlin GmbH

when applicants use the Careers website and go through the entire application process, whereby processing is in accordance with the General Data Protection Regulation (hereinafter “GDPR”) and the new German Federal Data Protection Act (hereinafter “New BDSG”). The controller within the meaning of Art. 4(7) GDPR is the company to which you are applying for a position (hereinafter “EVENTIM”, “we” or “us”).

1. Scope, controller and definitions

1.1 Scope of this data protection information

1. This information on data protection relates to the use of the Careers website (at Karriere.EVENTIM.de or corporate.EVENTIM.de) and the entire application process. You can access, save and print this information on data protection at any time and free of charge using the following link:

• karriere.EVENTIM.de/links/EVENTIM/datenschutz/.

2. This information on data protection only relates to the processing of the personal data of job applicants and the personal data collected in connection with the submission of a job application to EVENTIM.

1.2 Controller for the processing of your personal data 

The company to which you are applying for a position is responsible for the processing of your personal data:

CTS EVENTIM AG & Co. KGaA 

Hohe Bleichen 11

20354 Hamburg

E-Mail: HR[at]eventim[dot]de

Tel.: +49 421-3666 0

CTS EVENTIM Austria GmbH

Mariahilfer Straße 41-43

1060 Wien, Austria

E-Mail: datenschutz[at]oeticket[dot]com

Tel.: +43 1 589 54 0

CTS EVENTIM Solutions GmbH

Contrescarpe 75 A

D-28195 Bremen, Germany

E-Mail: HR[at]eventim[dot]de

Tel.: +49 421-3666 0

CTS EVENTIM Sports GmbH

Hohe Bleichen 11

D-20354 Hamburg, Germany

E-Mail: HR[at]eventim[dot]de

Tel.: +49 421-3666 0

EVENTIM Light GmbH

Hohe Bleichen 11

20354 Hamburg

E-Mail: HR[at]eventim[dot]de

Tel.: 0421-3666 0

EVENTIM Marketing and Sponsoring GmbH

Hohe Bleichen 11

D-20354 Hamburg, Germany

E-Mail: HR[at]eventim[dot]de

Tel.: +49 421-3666 0

EDGE Entertainment Digital GmbH

Kurfürstendamm 59

D-10707 Berlin, Germany

E-Mail: HR[at]eventim[dot]de

Tel.: +49 421-3666 0

Kess Berlin GmbH

Rosenthaler Straße 40/41

D-10178 Berlin, Germany

E-Mail: datenschutz[at]kessberlin[dot]de

Tel.: +49 30 767580 400

1.3. Definitions

This information on data protection is based on the following data protection terms, which we have defined for easier understanding:

1. The New BDSG is the new German Federal Data Protection Act (“Datenschutz-Anpassungs- und -Umsetzungsgesetz EU” – DSAnpUG-EU), which aligns German data protection legislation with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and implements Directive (EU) 2016/680. The new BDSG, which came into force on the same date as the GDPR, specifies the requirements of the GDPR in certain areas (e.g. the processing of employee data by employers).

2. The GDPR is the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).

3. The recipient is a natural or legal person, authority, institution or other body to which personal data is disclosed, regardless of whether it is a third party or not. Authorities, however, which within the framework of a specific inquiry mandate may receive personal data under Union law or the law of the member states shall not be considered recipients; the processing of such data by these said authorities is carried out in accordance with the applicable data protection directives in accordance with the purposes of the processing. The recipient of your personal data can be the postal service or a shipping service provider that we use to send you an employment contract and other documents associated with your job application.

4. Personal data is all information relating to an identified or identifiable natural person, i.e. the data subject. An identifiable natural person is one who can be identified directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data could be the name and contact details of job applicants, for example.

5. The controller is the natural or legal person, public authority, agency or other body – as indicated and defined above – which alone or jointly with others decides on the purposes and means of processing personal data. Where the purposes and means of such processing are laid down by Union law or by the law of the member states, the controller or the specific criteria for his appointment may be laid down in accordance with Union law or the law of the member states. CTS EVENTIM AG & Co. KGaA is controller of the data processing described in this data protection declaration (1.2.).

6. Processing is any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organising, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfer, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing can, for example, involve the collection and use of your data during the application process (e.g. storing your application documents and sending application status information via e-mail).

2. Purposes, legal bases and, if applicable, data categories for processing your personal data

2.1 Visits to the Careers website (log files / cookies)

1. When visiting our website, we process your personal data. The personal data that we process is technically necessary for us to provide you with our website and to ensure stability and security when using it. For this purpose, we process the following personal data:

• IP address
• Browser fingerprints
• Browser User Agents
• Cookies

2. When you visit our Careers website, we process your personal data (e.g. your IP address) on the basis of our legitimate interest in preventing fraud and abuse in accordance with Art. 6 Para. 1 Sentence 1 lit. f) GDPR.

2.2 Information on cookies

1. General information on cookies

Cookies are stored on your computer when you use our Careers website. Cookies are small text files that are assigned to and stored on your hard drive by the browser you use. Cookies allow certain information to flow to the site that sets the cookie. This information also contains personal data. This makes our website more user-friendly and effective. Cookies cannot run programs or transmit viruses to your computer.

2. Types of cookies used

First-party cookies:

On the one hand, we use “first-party cookies”, i.e. cookies which are set by the servers of our website and which can only be accessed by our servers.

Third-party cookies:

In addition, cookies from third-party providers (“third-party cookies”) are integrated on our website, whereby these are set by servers of other websites and/or of our website or domain and are read by third parties. These cookies can be used to track your browser beyond our website, for example to display Eventim ads on the websites of our partner companies.

Storage period for cookies

Session cookies:

Some of the cookies used are session cookies, i.e. cookies that are only stored for the duration of your visit to our website.

Persistent cookies:

In addition, we also use permanent cookies (“persistent cookies”), which remain stored on your browser after the duration of a session and are automatically erased after a specified expiry date.

Purposes for the use of cookies

Essential cookies:

The cookies we use are necessary for the proper operation of the Careers website and your ability to utilise certain necessary functions.

Functional cookies:

We also use cookies to enable certain (“comfort”) functions through automatic (re-)recognition of your browser. This includes automatic recognition of language settings, the recovery of the content of completed forms or the maintenance of your login status after you leave the website and then return again to our eventim-business.de website.

Analytics cookies

We also utilise cookies to collect information on your visit to www.eventim-business.de, which we then use to create anonymous analyses and statistics that enable us to continuously improve our website.

List of our cookies

Below this information on cookies you will find a list of all cookies that are (can be) set when visiting this website. This list contains the name of the cookie, the provider that sets the cookie, the storage period and the purpose of the cookie.

Cookie settings by user

You can use your browser settings to restrict or completely prevent the storage of (certain) cookies across websites and to erase cookies that have already been stored. For more detailed information, please refer to the instructions or help function of your browser.

In principle, our website can still be visited and used even after cookies have been restricted / deactivated in the browser settings. Please note, however, that particularly a complete deactivation of cookies can lead to limited functionalities of our website.

Listing of cookies set on our website

2.3. Receipt and processing of job applications

1. When we receive job applications via our applicant management system, by post, by e-mail or via an employee referral link, we process your personal data, such as contact details (e.g. first name, last name, address, telephone number and e-mail address) and any other data you provide with the application (e.g. CV, education and training, language skills and work permits). This processing involves reviewing application documents, conducting telephone interviews and job interviews, and deciding whether or not to issue a job offer (acceptance or rejection).

2. We also work with recruiting agencies to fill selected positions. Such agencies transmit any personal data that you may have provided to them.

3. Should you be invited in the course of our recruiting process to attend an individual assessment centre, your CV will be sent to our aptitude assessment partner (with your consent).

4. Processing here is carried out on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of conducting the application and hiring process.

2.4 Recruitment in social networks

1. In order to find qualified applicants, we actively search professional social networks and address potential candidates directly – e.g. via their Xing or LinkedIn account. Here, we access publicly available personal data from social networks that meet certain filter criteria. We make a note of any candidates we are interested in using Xing TalentManager, for example, and then store the data.

2. We process your data for the purpose of making contact with potential job applicants and on the basis of our legitimate interest of recruiting suitable employees, as described in Art. 6 Para. 1 Sentence 1 lit. f) GDPR.

2.5 Candidate search with external human resource consultants

1. In order to find qualified applicants, we also use external human resource consultants who send us profiles of potential candidates. These profiles can also contain your personal data if such data is not anonymised. We send such profiles to the relevant department or unit, which then conducts the selection process. An employment contract might then be concluded between the final candidate and our company, or else via the human resource consultant, as the case may be.

2. We process your data here on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of contacting candidates and recruiting suitable staff members.

2.6 Collection of additional information on applicants / review of references

1. If necessary, the references provided by applicants are used to obtain additional background information on the applicant and verify the information provided – e.g. by contacting former employers. This process is used to obtain an even more detailed impression of the applicant’s previous activities.

2. We only collect and review background information after an applicant has given their consent for us to do so as described in Art. 6 Para. 1 Sentence 1 lit. a) GDPR and Sec. 26 Para. 2 Sentence 1 New BDSG. In the event that we use publicly available sources (e.g. profiles in social networks), the processing of your personal data is carried out on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of conducting the application process.

2.7 Reimbursing applicant travel expenses

1. We reimburse your travel expenses if you need to travel to us for a job interview. To this end, we process your personal data, such as contact details (address, e-mail address), identification data (name) and financial data (bank details). The form for reimbursement of travel expenses will be forwarded by our HR department to the respective company or its financial accounting department along with the associated receipts.

2. Processing here is conducted on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of reimbursing travel expenses and conducting the job application process.

2.8 Talent pool

1. If we are unable to offer an applicant their desired position, we will add that candidate to our talent pool, provided they give us their consent, in order to be able to offer them another suitable position at a later date. To this end, we process the application data of the applicant and forward it to all companies in the EVENTIM Group via our applicant management system.

2. We process your application data on the basis of your consent within the meaning of Art. 6 Para. 1 Sentence 1 lit. a) GDPR and Sec. 26 Para. 2 Sentence 1 New BDSG.

2.9 Creation of an employment contract

1. As soon as we offer you a position, we process your personal data in order to create an employment contract for you. This involves collecting all information relevant to the contract (e.g. your name, address, title, start/end of employment, work location, salary, bank details, health insurance company, etc.). This information is processed and forwarded internally to the relevant HR unit. Processing here is conducted on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of creating an employment contract.

2. After you are hired, we also process special categories of personal data (e.g. your religion for church tax calculations) as well as personal data relating to any criminal convictions or a criminal record (e.g. your police clearance certificate). We process your data here on the basis of Art. 9 Para. 2 lit. b) GDPR, Sec. 26 Para. 3 Sentence 1 New BDSG, Art. 10 Sentence 1 Note 2 GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of creating and implementing your employment contract. 

2.10 Other processing

2.10.1 Execution of internal audits and compliance requirements

1. Your personal data may also be processed within the framework of the planning and execution of internal audits at EVENTIM Group locations in Germany and abroad. We also use data from other public sources (e.g. credit agencies) on a case-by-case basis.

2. If we implement compliance programs and measures, for example to implement the requirements of the German Corporate Governance Code (GCGC) and to identify and correct misconduct within the company, corresponding processing of your data may occur. 

3. Under certain circumstances, your personal data may also be processed in these data processing operations. We process your personal data to comply with our statutory obligations, on the basis of Art. 6 Para. 1 Sentence 1 lit. c) GDPR. In addition, due to the fact of our legitimate interests in reviewing the processes and efficiency in the group of companies, correcting any misconduct and preventing fraud and, if necessary, in enforcing and/or defending our rights, we process your personal data on the basis of Art. 6 Para. 1 Sentence 1 lit. f) GDPR.  

2.10.2 Whistleblowing system

You can report possible violations via our confidential reporting channels and thus contribute to their clarification. EVENTIM operates an independent, impartial and confidential whistleblower system for this purpose.

If we receive reports, we process your personal data insofar as they are provided on the basis of our legal obligation within the meaning of Art. 6 Para. 1 Sentence 1 lit. c) GDPR.

Investigations are always carried out with the utmost confidentiality and with due regard for the anonymity of the whistleblower. Information is processed in a fair, expeditious and protected procedure.

Further information: https://corporate.eventim.de/en/company/compliance/

3. Storage and erasure of your personal data

3.1 Log files

The log files of visitors to our Careers website are deleted immediately unless there is a suspicion that our services have been abused or that a cyber attack is under way, in which case a longer storage period would be justified until the matter can be clarified.

3.2 Applicant data

If your application is rejected, your data will be deleted within three months after you are notified of the rejection. If you have consented to being added to the talent pool, we will store your data for 12 months, after which time you will receive an automated e-mail message from our applicant management system requesting that you give your consent once again to the storage of your data in our talent pool. If you do not give your consent to such storage, your data will be automatically deleted.
If you are hired, your data will be transferred to our internal HR system.

4. Categories of recipients of personal data 

1. If you apply for a position at CTS EVENTIM Solutions GmbH, CTS EVENTIM Sports GmbH or EVENTIM Marketing and Sponsoring GmbH, our Group HR department at CTS EVENTIM AG & CO. KGaA will also process your personal data. The processing of your personal data by CTS EVENTIM AG & Co. KGaA is part of an internal collaborative procedure for processing your application for a position at EVENTIM. The transfer of data here is based on our legitimate interest in carrying out internal administrative activities efficiently and collaboratively in accordance with Art. 6 Para. 1 Sentence 1 lit. f) GDPR.

2. If you have consented to being added to our talent pool, your application data will be transmitted to all companies in the EVENTIM Group. The transmission of this data is based on your consent in accordance with Art. 6 Para. 1 Sentence 1 lit. a) GDPR and Sec. 26 Para. 2 Sentence 1 New BDSG.

3. Your personal data will also be transmitted to external IT service providers whose tools and platforms we use for the application and recruitment process and who process your personal data on our behalf (e.g. the company that makes the applicant management system available). We transmit your personal data in order to process your application documents on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG and pursue our legitimate interest of ensuring an efficient applicant management process (on the basis of Art. 6 Para. 1 Sentence 1 lit. f) GDPR).

4. If we send you an employment contract and documents associated with your application by mail, we will transmit your personal data to the mailing/shipping company. The transmission of this data is conducted on the basis of Art. 6 Para. 1 Sentence 1 lit. b) GDPR and Sec. 26 Para. 1 Sentence 1 New BDSG for the purpose of completing the hiring process for employment at EVENTIM.

5. Beyond this, we transfer your personal data only and in so far a legal obligation exists on our part to pass it on. The transmission of this data is conducted on the basis of Art. 6 Para. 1 Sentence 1 lit. c) GDPR (e.g. to police departments in the context of criminal investigations).

6. If we transfer data to recipients in a third country (located outside the European Economic Area), you can find a description under section 2. Some third countries are certified by the European Commission through so-called adequacy decisions to have a data protection standard that is comparable to the level in the European Economic Area. A list of these countries can be found here (link to: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). If a country does not have a comparable data protection standard, we ensure that data protection is adequately guaranteed by other measures, e.g. by means of standard contractual clauses of the European Commission for the protection of personal data (link to https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914&qid=1694511844343) or binding internal data protection regulations (so-called Binding Corporate Rules).

6. Consent and withdrawal of your consent

1. If you have given us your consent to the processing of your personal data, you may withdraw this consent at any time. The withdrawal of your consent is effective for the future. The legality of processing your personal data up to the time of withdrawal remains unaffected. Please direct your withdrawal of consent to:

• E-mail: HR[at]eventim[dot]de
• Tel: +49 (0)421-3666 0

2. If you withdraw your consent, we will process the personal data that we collect in this connection in order to respond to your request. Your personal data is processed in order to fulfil a legal obligation on the basis of Art. 6 Para. 1 Sentence 1 lit. c) GDPR.

7. Your rights

1. You may at any time, in accordance with the GDPR, request that we

• provide you with information about the personal data concerning you that we process (Art. 15 GDPR), 
• rectify any personal data concerning you that is inaccurate (Art. 16 GDPR) and/or
• erase (Art. 17 GDPR), block (Art. 18 GDPR) and/or release (Art. 20 GDPR) your personal data stored by us. 

2. Please direct your request to

• Via e-mail to HR[at]eventim[dot]de or
• by letter to CTS EVENTIM AG & Co. KGaA, Hohe Bleichen 11, 20354 Hamburg

3. If you assert your rights, we will process the personal data that we collect in this connection in order to respond to your request. Your personal data is processed in order to fulfil a legal obligation on the basis of Art. 6 Para. 1 Sentence 1 lit. c) GDPR.

4. In addition to your rights under point 7, you have the right to file a complaint with a supervisory authority for data protection if you believe that the processing of your personal data by EVENTIM violates the GDPR (Art. 77 GDPR).

8. Other

1. The terms of this data protection information (available at no charge from Karriere.EVENTIM.de/en or corporate.EVENTIM.de/en), including the information on the use of cookies for applicants to CTS EVENTIM AG & Co. KGaA (available at no charge from Karriere.EVENTIM.de/en / corporate.EVENTIM.de/en), apply in the version in force on the date of your application.

2. We reserve the right to supplement and amend the content of this information on data protection. The updated Data Protection Information is valid from the time at which it is published on our website.

3. We will inform you in a timely manner of any such changes and supplements at our website and, if we already have your contact data, we will also inform you via e-mail or by normal mail. You will be given the opportunity to view, print and save the amended information on data protection free of charge.

9. Contact details of the Data Protection Officer

Please direct any questions regarding data protection to:

Data Protection Officer

CTS EVENTIM AG & Co. KGaA

Hohe Bleichen 11

20354 Hamburg

E-mail: datenschutz[at]EVENTIM[dot]de