Data Protection Policy for Applicants

With this notice we inform you about the processing of your personal data in connection with your application, and about your rights under data protection law. This applicant policy complements our general Data Protection Declaration.

1. Controller & Data Protection Officer

bpExperts GmbH
Frankfurter Straße 39 / Stadthof 16 A, 63065 Offenbach am Main, Germany
Tel: +49 172 7210876 · info@bpexperts.de

Data Protection Officer: HSDK GmbH, Dirk Schell — Eschersheimer Landstr. 42, 60322 Frankfurt am Main · data-privacy@bpexperts.de

2. Categories of data processed and their source

We process the personal data you provide in your application, in particular:

• Master data: first name, surname, date of birth
• Contact data: address, telephone number, e-mail address
• Qualification data: CV, references/certificates, training and qualifications
• Bank details: where needed to reimburse travel expenses for an interview
• Further data you include: previous employment, desired salary, hobbies, life circumstances, and — only where you choose to disclose them — special categories of data (e.g. religious affiliation, disability/severe-disability status)

The data generally comes directly from you. It may also come from third parties involved in the process, such as recruitment agencies or employment centres.

3. Purpose and legal basis

a) We process your data to decide on the establishment of an employment relationship and to conduct the application process. The legal basis is Art. 6(1)(b) GDPR in conjunction with §26(1) BDSG, and Art. 6(1)(f) GDPR where we pursue legitimate interests (e.g. optimising the recruitment process, ensuring safety and compliance, asserting or defending legal claims, and preventing liability).

b) If you consent to being kept in our candidate/talent pool for future positions, we process your data on the basis of your consent under Art. 6(1)(a) GDPR in conjunction with §26(2) BDSG.

4. Recipients

Within bpExperts, your data is accessed by HR, management and the departments involved in the relevant vacancy. External recipients may include employment agencies and job centres, and processors that support us (e.g. IT, recruiting and document-archiving service providers) under data processing agreements.

5. International transfers

Your personal data is not transferred to a third country (outside the EU/EEA), unless an EU adequacy decision or appropriate safeguards ensure an adequate level of protection.

6. Your rights

Subject to the statutory conditions, you have the right to information/ access, rectification, erasure, restriction of processing and data portability regarding your personal data.

7. Right to complain

You have the right to lodge a complaint with a supervisory authority. The authority with jurisdiction over us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

8. Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future. We will then delete the data concerned immediately, unless another legal basis permits continued processing.

9. Retention

If your application is not successful, we store your data for up to seven months after the process concludes and then delete it. If you have consented to our candidate/talent pool, we store your data for up to two years. Longer retention may apply where required by statutory obligations (e.g. six years under the German Fiscal Code, ten years under the German Commercial Code).

10. Automated decision-making / profiling

We do not carry out any automated decision-making or profiling in the context of the application process.

Last updated: June 2026.