Jobs Flix - Privacy Policy for Applicants

In this Privacy Policy, you will be informed about how your personal data will be processed at FlixBus if you apply for a job advertised by us. We also inform you about your rights, including the right to object (even partially), to the processing. You can find information about your rights and the exercise of these rights under “Your rights”.

In our general privacy policy, we inform you about how we process your personal data when you visit the website in addition to topics not related to the application. Our general privacy policy applies in addition to this Privacy Policy for Applicants.

1. Controller & data protection officer

The controller of the processing of your personal data (Art. 4(7) GDPR) is the company identified in the job advertisement.

Our company data protection officer is available to you at any time to answer all your questions and as a contact person on the subject of data protection:

Flix SE
Friedenheimer Brücke 16
80639 Munich
Email: data.protection@flixbus.com

For general questions about FlixBus, please contact service@flixbus.de.

For general questions about job postings or the application process, please contact jobs@flixbus.com.

2. Collection of data

We collect and process the following categories of personal data as part of the application process:

Personal master data and contact details in your candidate profile (e.g., first and last name, country, email address, phone number).
Information provided by you as part of the application form (e.g., information on salary expectations, your motivation, work permit for the respective country, as well as disability information if applicable (if relevant for the advertised position)).
Application documents (including, for example, resume, cover letter, professional development data, qualifications or language skills).
Results of online procedures (e.g., performance tests) and video interviews, if applicable.
Additional information and documents (such as references) if and to the extent that you provide them to us.

If and to the extent that performance tests are given, we evaluate the results using relevant reference groups, taking into account your profession and your level of experience.

We may also obtain the personal data about you listed above from other sources or from external business partners, such as HR service providers. This data may also originate, for example, from professional social networks where you have published it, e.g., LinkedIn. This may also involve data that you have provided us via third-party websites, e.g., job portals, or data that you have published in other publicly accessible sources. This data is limited to data that is relevant to your professional career and solely for the purpose of communicating job offers from our group of undertakings or aligning the accuracy of your information in the application documents.

3. Purposes of processing

We collect and process your personal data to be able to offer advertised positions and carry out the selection process. In this case, we process your personal data exclusively for the following purposes:

To be able to identify you as an applicant.
To initiate and establish an employment relationship.
To contact you if you should be considered for an alternative position (depending on whether you request this or not).
To ask you about your satisfaction with the application process, provided you have given us your consent for this.
To contact you about your speculative application.
To send you personalized information about open positions at Flix companies based on your consent.
To save you in our talent pool for any other suitable job offers based on your previously granted consent.

If your application is successful, the application data transmitted by you to FlixBus will also be processed to complete the recruitment process, particularly to conclude an employment contract with you, as well as in connection with administrative matters related to your employment.

4. Legal bases

We process your personal data within the scope of the application process only to the extent permitted by an applicable legal provision, i.e. based on the provisions of the GDPR, the BDSG (Bundesdatenschutzgesetz [Federal Data Protection Act]) and other applicable legal provisions, such as the Works Constitution Act (BetrVG [Betriebsverfassungsgesetz]). In doing so, we will base the processing of your personal data on the following legal bases, among others:

For the decision on establishing the employment relationship: Your personal data will be collected and processed in order to fill advertised positions and to carry out the selection process. We process your data primarily to establish the employment relationship on the basis of Art. 6 para. 1(b).
To fulfill legal obligations: We process your data to fulfill legal obligations. For example, we are legally obligated to ensure an appropriate level of data security (Art. 32 GDPR). Furthermore, we also need your data, among other things, if you exercise your rights with us as a data subject in accordance with Art. 15 et seq. GDPR. This data processing is carried out on the basis of Art. 6 para. 1(c) GDPR.
Based on your consent: If you voluntarily provide us with special categories of personal data, we will only process them on the basis of your consent. The legal basis for this is Art. 6 para. 1(a) GDPR and Sec. 26 para. 2 BDSG.

If we have invited you to participate in a survey about your satisfaction with the application process at FlixBus, the relevant legal basis is your consent pursuant to Sec. 26 BDSG in conjunction with Art. 7 GDPR. Your registration for the “Career Portal”, where you receive personalized information about current job postings at FlixBus, is also based on this legal basis.

If a performance test is planned for the respective position, participation in these tests is voluntary and requires your consent. You can decline to participate in such a test. The legal basis for this is Art. 6 para. 1(a) GDPR and Sec. 26 para. 2 BDSG.

As part of the application process, we offer suitable applicants the option of being stored in our talent pool for a period of one year based on consent within the meaning of Art. 6 para. 1(a) and Art. 7 GDPR. This consent is voluntary and can be revoked at any time for the future.

To safeguard legitimate interests: In individual cases, we process your data in order to protect legitimate interests of FlixBus or third parties. A legitimate interest exists, for example, if your data is required to assert, exercise or defend legal claims within the scope of the application process (e.g., claims under the General Equal Treatment Act). In these cases, the data processing takes place on the basis of Art. 6 para. 1(b) and (f) GDPR. A legitimate interest is, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG [Allgemeines Gleichbehandlungsgesetz]).
If we use information from public profiles on professional social networks, the legal basis for the processing - creating a basis for the decision on establishing an employment relationship with you - shall be considered in our legitimate interests. The legal basis is Art. 6 para. 1(f) GDPR in conjunction with Art. 9 para. 2(e) GDPR.

Personal data that you provide during the application process is generally voluntary. However, it is necessary to provide this personal data for the processing of your application or the conclusion of an employment contract.

5. Data recipients

Your personal data may be transmitted by us to affiliated companies, provided this is permitted within the framework of the purposes and legal bases set out above. After your application has been received, your applicant data will only be submitted to those offices that require them to carry out the application process. In addition to the company posting the job and the employees of the department that is hiring, these are generally also the responsible employees of the Human Resources Department of Flix SE.

Your personal data may also be processed on our behalf based on contracts pursuant to Art. 28 GDPR, in particular by system providers as part of applicant management or the completion of the application process. Personal data will not be transferred to third parties if there is no reference to applicant management and the applicant selection processes or outside of the purposes described in the “Purposes of processing” section.

Our Career Portal is technically implemented via the service provider Greenhouse Software, Inc., 110 Fifth Avenue, 3d Fl., New York, NY 10011 USA (hereinafter also referred to as “Greenhouse”). Greenhouse processes your data on our behalf as a processor. Your personal data will be transmitted to Greenhouse for the purposes of this processing. You can find further information regarding data protection and data security at the following links: https://www.greenhouse.io/privacy-policy, https://www.greenhouse.io/security-and-performance.

These transfers can therefore be transfers of personal data to recipients outside the European Union or the European Economic Area. We have concluded standard contractual clauses with these external service providers if they are not based in countries with adequacy decisions in accordance with Art. 45 GDPR or if they employ subcontractors in third countries without adequacy decisions. You can find further information under “Data transfers outside the EU”.

In the case of a legal obligation, we reserve the right to disclose information about you if we are required to surrender it to lawfully acting authorities or law enforcement bodies; the legal basis is Art. 6 para. 1(c) GDPR.

6. Your rights

You may assert your rights as a data subject regarding your personal data at any time, in particular by contacting us using the contact details provided in Clause 1. According to the GDPR, you have the rights listed below:

Right to information

You can request information in accordance with Art. 15 GDPR about your personal data processed by us. In your request for information, you should clarify your concern to make it easier for us to compile the necessary data. Upon request, we will provide you with a copy of the data that are the subject matter of the processing. Please note that your right to information may be limited under certain circumstances in accordance with statutory provisions.

Right to rectification

If the information relating to you is not (any longer) correct, you may request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you may request completion.

Right to erasure

You may request the erasure of your personal data in accordance with the provisions of Art. 17 GDPR. Your right to erasure depends, among other things, on whether the data relating to you are still required by us to perform our statutory duties.

Right to restriction of processing

In accordance with the provisions of Art. 18 GDPR, you have the right to demand a restriction of the processing of the data relating to you.

Right to data portability

In accordance with the provisions of Art. 20 GDPR, you have the right to receive the data that you have provided to us in a structured, commonly-used and machine-readable format, or to request the transmission to another controller.

Right to object

In accordance with Art. 21 para. 1 GDPR, you have the right to object to the processing of your data at any time for reasons relating to your particular situation. You can object to receiving advertising at any time with effect for the future, in accordance with Art. 21 para. 2 GDPR (objection to advertising in the case of direct marketing).

Right to appeal

If you are of the opinion that we have not complied with the provisions of data protection regulations when processing your data, you can complain to a data protection supervisory authority about the processing of your personal data, such as to the respective competent data protection supervisory authority: For Flix SE, this is:

Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach

Right to withdraw consent

You can withdraw your consent to the processing of your data at any time with future effect. This also applies to declarations of consent that were issued before the GDPR came into force, i.e. before 05/25/2018.

7. Storage/retention periods

We store your personal data for a period of 6 months after sending the rejection for the respective position. This storage period is particularly necessary for cases in which we must fulfill obligations to provide evidence in proceedings under the General Equal Treatment Act (AGG) or defend ourselves against any claims asserted.

If you have given your consent, we will store your data for this period in case there is another job posting you are a suitable candidate for.

You can request the erasure of your applicant data or the withdrawal of your application at any time by contacting us via email at: jobs@flixbus.com.

If you have consented to be included in our talent pool as part of the application process, your application documents will be processed in the talent pool solely within the framework of future job postings that could be suitable for you and will be destroyed after a period of one year at the latest.

In the event that your application is successful, we will store your personal data for the entire duration of your employment relationship in accordance with the Privacy Policy for Employees, which we will send you upon acceptance of employment.

In cases in which you have given consent in accordance with Art. 6 para. 1(a) GDPR for the processing of your data (e.g., if you participate in a survey on your satisfaction with the application process, inclusion in our talent pool, etc.), you can revoke this at any time with future effect.

In cases in which we process your personal data based on a balancing of interests in accordance with Art. 6 para. 1(f) GDPR, you can object to the processing. This is the case if the processing is not required to fulfill a contract with you in particular. When exercising such an objection, we request that you explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will review the situation and either stop or adjust the data processing or present to you our compelling legitimate grounds, based on which we will continue the processing.