OC Payment GmbH, Domstraße 20, 50668 Cologne, Germany, hereinafter referred to as “paymenttools” or “we”, operates the website www.paymenttools.com.
This information gives you an overview of the processing of your personal data when you visit the paymenttools.com website. We inform you about what data we collect from you and how we use it. We also inform you of your rights under applicable data protection law and tell you who to contact if you have any questions.
The controller under data protection law is the: Company indicated above
2 Contact person for data protection
DYou can reach the controller’s data protection officer at:
OC Payment GmbH
3 Processing of personal data
We process your personal data when you visit the paymenttools.com website, provide us with information via a contact form on our website, request access to protected information or otherwise contact us. The following data or data categories may be collected:
- data you provide when contacting us (including title, first name, last name, email address, telephone number, company, position, address, date of registration, date of last login)
- data that you provide to us when you apply for an advertised position or send us an unsolicited application (personal data, education data, career history data, cover letter, CV, portrait photo, certificates)
- data that you provide on career platforms such as Xing and LinkedIn or other platforms such as Stackoverflow and that we collect as part of the recruiting process (surname and first name that you provided on the platform, your current position, the date we contacted you, your response to our inquiry, samples of your work, etc.)
4 Scope, purpose and legal basis of data processing
4.1 Making contact via the contact form
You can contact us via the contact form, email, post and telephone. We process your data in order to answer your inquiry and, if necessary, to send you requested information material. Your data may be transferred to the office responsible for your request. The legal basis for the data processing described above is Article 6 (1) sentence 1 b), f) GDPR (pre-contractual measure, fulfilment of contract or balancing of interests, based on the interest of paymenttools in answering inquiries).
4.2 Recruiting and application
We process your personal data when you apply to paymenttools via the contact form on the paymenttools.com website or in any other way. Your data will be analysed as part of the application process and, if necessary, forwarded to the head of the department to which you have applied. In addition, the data required for this purpose will be used in the context of job interviews and corresponding rejections or offers. Specifically, this may be the following data:
- data collected when using our website (pages viewed, links clicked, the date and time of the request, the duration of the visit, the identification data of the type of browser and operating system used and the website from which you are visiting us)
- data you provide when setting up a candidate profile (first name, surname, email address, password, place of residence (country), address, title, telephone number, date of birth, interest in receiving email notifications on job tickers with new job offers and/or information about the company, invitations to events and interviews about the application process, consent to being included in the candidate pool, documents you upload such as CVs and certificates)
- data that you provide to us as part of an application by email or post
- data about your applications submitted when using the online application system (title, first name, surname, date of birth, address, email address, telephone number, mobile phone number, previous contacts with a REWE Group company, first name and surname of parent/guardian, data on school education, training and studies, data on previous professional career, data on driving licence, data on possible impairments, data on field of employment, cover letter, CV, certificates, portrait photo, insofar as you provide us with the respective information)
- data from job-oriented social networks (e.g. Xing, LinkedIn) insofar as they are generally accessible
- data that we require as proof of your consents, e.g. when you are admitted to the candidate pool, when you receive information about the company or invitations to events and declarations of consent given
- data that you provide to us via a web form on a website maintained by paymenttools or in any other way when you contact us
- data that you provide to us in the context of a chat application (voice recording and text logs) (first name, surname, email address, telephone number, professional and managerial experience, education and further education, job interests, driving licence, mobility, skills, health pass, health insurance pass, availability, place of residence, postcode, insofar as you provide us with the respective information)
data that you provide to us in the context of a chat application (voice recording and text logs) (first name, surname, email address, telephone number, professional and managerial experience, education and further education, job interests, driving licence, mobility, skills, health pass, health insurance pass, availability, place of residence, postcode, insofar as you provide us with the respective information)
The primary purpose of data processing is the establishment, implementation and termination of the employment relationship. The primary legal basis for this is Article 88 GDPR in conjunction with. section 26 (1) sentence 1 of the German Data Protection Act (BDSG).
Insofar as special categories of personal data are processed pursuant to Article 9 (1) GDPR, this serves the exercise of rights or the fulfilment of legal obligations under labour law, social security law and social protection law within the framework of the employment relationship (e.g. disclosure of health data to the health insurance fund, recording of severe disability for the purposes of granting additional leave and determination of the severely disabled person’s levy). This is done on the basis of Article 9 (2) b) GDPR in conjunction with section 26 (3) BDSG. In addition, the processing of health data may be necessary for assessing your fitness for work pursuant to Article 9 (2) h) in conjunction with section 22 (1) b) BDSG. In addition, the processing of special categories of personal data may be based on consent pursuant to Article 9 (2) a) GDPR in conjunction with section 26 (2) BDSG (e.g. occupational health management).
If we collect other categories of personal data not mentioned here or wish to process them for a purpose not mentioned above, we will inform you in advance.
We offer you the option of conducting the interview via Google Hangouts video telephony. We would like to point out that this is an offer and not an obligation. If you do not agree to the use of Google Hangouts, this will not have a negative impact on the application process. In this case, we will arrange an interview by telephone or, if possible, in person. With regard to data processing by Google Ireland Limited, we refer to the corresponding data privacy statement: https://policies.google.com/privacy. Data processing within Google Hangouts video telephony is based on your consent and thus occurs in accordance with Article 6 (1) sentence 1 a) GDPR, section 26 (2) BDSG. You may revoke your consent at any time with future effect. Even in the event of a revocation, this has no negative impact on the application process.
4.3 Forwarding to social media services
On our website you will find links to the platform operators of LinkedIn, Xing, Twitter and Kununu. You can recognise links to the websites of social media services by the respective company logo. If you follow these links, you will reach paymenttools’ corporate presence on the respective social media service. Clicking on a link to a social media service establishes a connection to the servers of the social media service. This communicates to the servers of the social media service that you have visited our website. In addition, further data is transferred to the provider of the social media service. These are, for example:
- address of the website on which the activated link is located
- date and time the website is accessed or the link is activated
- information about the browser and operating system used
- IP address
We use necessary technologies. These services, technologies and cookies are necessary to guarantee central functions or the correct display of the portal. They cannot be deactivated by you as a website user. The use of the necessary technologies takes place on the legal basis of Article 6 (1) sentence 1 f) of the General Data Protection Regulation (balancing of interests, based on the interest of paymenttools in providing central functions of the website).
5 Recipients of personal data
Within paymenttools, only persons who need your data to complete the tasks assigned to them will have access to it. In addition, service providers who assist us in fulfilling our tasks may have access to your data. These are service providers in the following categories:
- Hosting service providers for the operation of our servers
- Development service providers for programming, development, maintenance and support of software applications
- The vendors/recipients of data named in this data privacy statement within the scope of cookies and other technologies
We do not use service providers located in third countries outside the European Union to process your data.
Service providers we use must comply with special confidentiality requirements. They will only have access to your data to the extent and for the period of time that is necessary for the fulfilment of the tasks.
6 Storage period
We generally only store your data for as long as we need it for the respective processing purposes. If the data is no longer required for the fulfilment of the processing purposes stated in this data privacy statement, it will be deleted unless its retention is still necessary for the fulfilment of retention obligations under commercial or tax law.
- data on an inquiry pursuant to point 4.1 as a rule three months, at the latest ten years after the event is completed
- data on an application pursuant to point 4.2 for an advertised position six months after completion of the application process
7 Automated individual decision-making, profiling
We do not use your personal data for automated decision-making or profiling.
8 Your rights as a data subject
Insofar as we process your personal data, you as the data subject are entitled in particular to the following data subject rights under the requirements of data protection law.
8.1 Right to information
You may request information from us about the personal data which we process.
If your information is not (or no longer) correct, you can request that your data be corrected. If your data is incomplete, you may request that it be completed.
You have the right to demand the erasure of your data. Please note that a claim for erasure depends on the existence of a legitimate reason. In addition, there must be no regulations that oblige us to retain your data.
8.4 Restriction of processing
You have the right to demand that we restrict the processing of your data. Please note that a claim to restrict processing depends on the existence of a legitimate reason.
8.5 Objection on the grounds of legitimate interests
If data is collected on the basis of Article 6 (1) (f) GDPR (data processing for the protection of legitimate interests), you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing is for the purposes of asserting, exercising or defending legal rights/claims.
8.6 Right to lodge a complaint
You are entitled to lodge a complaint with the competent data protection supervisory authority if you do not agree with the processing of your data.
8.7 Data portability
You have the right to receive personal data that you have provided to us in an electronic format.