Data Protection
The person being responsible in the meaning of the General Data Protection Regulation and in compliance with other national data protection laws of the EU Member States, as well as other data protection regulations, is the following:
Heinrich & Coll. Gesellschaft für Personalberatung GmbH
Bavariaring 38
80336 München
Germany
+49(0)89 7 41 18 08-0
+49(0)89 7 41 18 08-29
Managing Director:
Philipp Ruoff
Daniel Stockenberger
This email address is being protected from spambots. You need JavaScript enabled to view it.
- We collect and utilise your personal data only insofar as this is necessary to provide a functioning website, our content and our services. We regularly collect and use your personal data, but only with your consent. An exception applies in cases in which circumstances prevent us from obtaining prior consent and the processing of the data is permitted by law.
- Insofar as we obtain the consent of the Data Subject for processing their personal data, section 6 paragraph 1 lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. For the processing of personal data necessary for the performance of a contract to which the data subject is a party, section 6 paragraph 1 lit. b of the GDPR serves as the legal basis. This principle shall also apply to the processing needed in order to implement pre-contractual measures. Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, the section 6 paragraph 1 lit. c of the GDPR serves as the legal basis. In the event that vital interests of the Data Subject or another natural person require the processing of personal data, the section 6 paragraph 1 lit. d of the GDPR serves as the legal basis. If the said processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights, and freedoms of the person concerned do not outweigh the first-mentioned interest, the section 6 paragraph 1 lit. f of the GDPR serves as the legal basis for the processing.
- Your personal data will be deleted or blocked as soon as the purpose for its storage no longer applies. In addition, the data may be stored if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the data controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned regulations has elapsed unless further storage of the data is necessary for the conclusion or fulfilment of a contract.
- Every time you visit our website, our system automatically collects data and information from your computer system. In this context, the following data will be collected:
- The date and time of access,
- The IP address of the requested hosts,
- The IP address of the requesting clients,
- The port number,
- The command method,
- The URI Stem and URI Query,
- The protocol status,
- The Win32 status,
- The timing, and the browser type and/or version
- The computer model
- The searched Domain Server Code (200 found and delivered for contents)
- The operating system used
The data will also be stored in our system's log files. The said data will not be stored together with any other personal data pertaining to the user.
- The legal basis for the temporary storage of data and log files is the section 6 paragraph 1 lit. f of the GDPR.
- The system needs to temporarily store the IP address to enable the website to be delivered to the user's computer. For the said purpose, the user's IP address must be stored for the duration of the session.
- The log files are saved to ensure the functionality of the website. Data is also used to optimise the website and ensure the security of our information technology systems. We do not evaluate this data for marketing purposes.
- These purposes also encompass our legitimate interest in data processing in accordance with the section 6 paragraph 1 lit. f of the GDPR.
- The data will be deleted as soon as it's no longer required to fulfil the purpose for which it was collected. In the case the data was collected in order to provide the website, it'll be deleted once your session on our site ends. Should any data be stored in log files, it will be deleted automatically within a term of seven days at the latest.
- The collection of the data required to make the website available and storage of the data in log files is essential for the operation of the website. Consequently, users cannot object to its collection.
- On our website, we offer users the opportunity to apply for certain advertised positions by providing personal data through our website. Data is entered into an input screen, transmitted to us, and then stored. Permission to send the data is obtained by the user before submitting his/her application. The following data is collected during the registration process:
- Name and surname
- If applicable, academic degree
- Date and place of birth
- Contact details (address, email, landline and/or cell phone number)
- Application documents (cover letter, curriculum vitae, and certificates)
- Language skills, and capabilities.
In addition, there are other personal data provided by the user sending them to us at a later point during his/her application process or in the further course of the application procedure, such as for example notice period, current salary and salary requirement, willingness to move (relocation, second residence in the case of a position outside his/her current place of residence), willingness to travel, professional goal, and motivation to change. The said data as well as the data transmitted to us through the homepage will be stored in our applicant management system called "Meffert" after actively obtaining the necessary consent (cf. what stated under section 2).
At the time of the transmission of the application through the homepage, the following data will be stored as well:
- The user's IP address
- The date included in the access log file
- The date and time of the transmission of the application
- Mr/Mrs
- Surname and first name
- Title
- Current position
- Phone number
- Selected vacancy
- Curriculum Vitae
- Confirmation of the permission relating to the data collection
In this context, the data will not yet be transmitted to any third parties. This data will be used exclusively to respond to your enquiry. The processing of the personal data from the input forms serves us solely to process the application. In the case of an application via email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the submission process is used to prevent any misuse of the applicant management system and to ensure the security of our information technology systems.
As an alternative, an application transmitted through the provided email address will also be feasible. If you use this option, the personal data transmitted with the email will be stored.
- In the context of the application process through the homepage and /or by email, the respective consent is obtained from the user/applicant/candidate for the processing of the above-listed data. The said consent is granted by means of the online service datenschutz-freigabe.de we use. This service is integrated into our internal applicant management system called "Meffert". After the receipt of the application or the CV by us, each applicant/candidate will be sent a confirmation of receipt by email including an individualized link to the website https://datenschutz-freigabe.de. The candidate shall actively grant the permission to us to store his/her personal data, to pass on the curriculum vitae within Heinrich & Coll Personalberatung as well as to submit it to clients (after prior consultation). In addition, the user/candidate/applicant shall grant his/her permission to receive job offers per email. The said permission can also only be granted for partial areas. The personal data will be stored until revocation.
The user/applicant/candidate has the possibility at any time to revoke all or part of his/her authorisations granted via data protection clearance and to ask for the deletion of his/her application/all personal data in accordance with the section 17 of the GDPR. In case the permission has been granted, the legal basis for the processing of the data is the section 6 paragraph 1 lit. a of the GDPR. The legal basis for processing the data transmitted in the course of the transmission of an email message shall be the section 6 paragraph 1 lit. f of the GDPR. If you email us with the intention of entering into a contract, the section 6 paragraph 1 lit. b of the GDPR will serve as additional legal basis for the data processing.
We base the personal data provided by you on our decisions in the application process within the framework of the legal requirements. For example, we use your professional qualification to decide whether we'll consider you in the shortlisting process or a personal impression in a job interview to decide whether we'll forward your data to one of our clients with your prior consent. The necessary consent is granted through the website www.datenschutzfreigabe.de
For the data collected during the application process for the fulfilment of a contract or for the implementation of pre-contractual measures, the purpose of the collection shall be achieved as soon as the respective data is no longer necessary for the implementation of the contract. Even after having entered into the contract, it may still be necessary to store personal data of the contractual partner in order to fulfil contractual or legal obligations.
The user has the right to revoke his/her consent to the processing of personal data at any time. The applicant/candidate can either make the revocation through the link to data protection release sent to him/her after receipt of the application or send his/her revocation by email to the data protection address This email address is being protected from spambots. You need JavaScript enabled to view it..In such a case, all personal data that was stored when contact was made with us will be deleted.
In the event the data is required for the fulfilment of a contract or for the implementation of any pre-contractual measures, the early deletion of the data will only be feasible insofar as contractual or legal obligations do not prevent the said deletion.
Special types of personal data, for example about health, religious views, political beliefs, shall generally not be processed. This is the reason why we expressly request that you do not send us such types of data. We will not accept an application including such types of data. We delete such types of data in our system and ask the user/applicant/candidate to send us his/her new application.
Personal data will only be forwarded to suitable clients with prior consent.
Our website uses cookies. Cookies are text files stored within or by the internet browser on the computer system of the user. If a user visits a website, a cookie may be stored on the operating system of the user. This cookie contains a distinctive character string enabling the unique identification of the browser when the website is accessed again.
- We use cookies to make our website more user-friendly. Some elements of our website require that your browser be identifiable as you move on to another page within the site.
The following data is stored and transmitted in cookies:
(1) Language settings
(2) Login information
- We also use cookies on our website to analyse user behaviour.
The following data can be transmitted in this way:
(1) Entered search terms
(2) Frequency of page views
(3) Use of website functions
The user data collected in this way is pseudonymised with technical means. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with the user's other personal data.
When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and referred to this data protection declaration. A note is also included in this context as to how the user can disable the storage of cookies in their browser settings.
When accessing our website, the user is informed regarding the use of cookies for analytical purposes and his/her consent to the processing of personal data used in this context is obtained. We will at that time also make reference to this privacy policy.
The legal basis for the processing of personal data by using cookies is the section 6 paragraph1 lit. f of the GDPR. The legal basis for the processing of personal data by using technically necessary cookies is the section 6 paragraph1 lit. f of the GDPR. The legal basis for the processing of personal data by using cookies for analytical purposes, if the user's consent to this has been granted, is the section 6 paragraph1 lit. a of the GDPR.
The purpose of using such technically essential cookies is to make the website easier to use for the users. Some features of our website will not be available if the use of cookies is disallowed. This is why it is necessary that your browser remain recognisable as you make your way through our site.
We require cookies for the following applications:
(1) The application of language settings
The user data collected by technically necessary cookies will not be used to create user profiles.
The analysis cookies are used to improve the quality of our website and its content. By analysing cookies, we learn how the site is used and can constantly optimise our service.
For these purposes, our legitimate interest lies in the processing of personal data according to the section 6 paragraph1 lit. f of the GDPR.
- The cookies are stored on the user's computer and from there they will be transmitted to our site. For this reason, as a user, you will retain full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it will be possible that you will no longer be able to use all of the features offered by the website.
Our recruiting website contains so-called hyperlinks to websites of other providers and to the social networks, LinkedIn, and Xing. These (inactive) "Social Media Buttons" are integrated in such a way that no contact is made with the respective social network without activating the link by you. If you click on the Social Media Buttons by consequently activating the link, a new window will open in which you can login to the social network, for example to recommend and/or share the selected page. Without the activation of the link by you, we will not transmit data about you to social networks at any time.
We cannot take responsibility for the handling of your data on these external websites, as we have no influence on how these companies process your data. Please obtain the information about the handling of your personal data by these companies by yourself directly on their websites.
- For LinkedIn at: http://www.linkedin.com/legal/privacy-policy
- For XING at: https://www.xing.com/privacy
We use Google Maps on our website. This service is offered by the companies of Google.
In order to increase the protection of your data when visiting our website, Google Maps is restricted and only integrated into the page using HTML linking. This ensures that when you visit our website, no connection to Google's servers is established and your data will not be transmitted to Google. Only when you activate the plugin and thus grant your consent to the transmission of data, your browser will establish a direct connection to Google's servers so that you can plan your route to us. Functionally, the integration of Google Maps thus corresponds to a hyperlink, so that neither we nor Google collect data from you on our website.
For the purpose and scope of the data collection and the further processing and use of the data by Google, as well as your rights in this respect and setting options for protecting your privacy, please refer to Google's data protection information at https://www.google.com/policies/privacy/partners/?hl=de
If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the data controller. You can assert your rights by email to This email address is being protected from spambots. You need JavaScript enabled to view it. or by post to the address given under the I.
- Information Right
You can request confirmation from Heinrich & Coll. as to whether personal data concerning you is being processed by us. If such processing is available, you can request the following information from Heinrich & Coll.:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data which are processed;
(3) the recipients and/or the categories of recipients to whom the personal data have been or will be disclosed the categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the envisaged duration of the storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
(5) the existence of a right to correct or delete the personal data regarding you, a right to have the processing restricted by the controller or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) any available information on the origin of the data if the personal data are not collected from the data subject;
(8) the existence of automated decision-making including profiling according to the section 22 paragraph1 and 4 of the GDPR and – at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing regarding the data subject.
You have the right to be informed as to whether your personal data will be transmitted to a third country or an international organisation. In this regard, you can request to be informed about the appropriate guarantees in accordance with the section 46 of the GDPR in connection with the transmission.
- Right to Rectification
You have the right to rectification and/or completion by the data controller if the personal data processed concerning you is either incorrect or incomplete. The data controller is required to make the correction immediately.
- Right to Restriction of Processing
You may ask for the processing of your personal data to be restricted under the following conditions:
(1) You contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you object to the deletion of the personal data and request instead the restriction of the use of the personal data;
(3) the controller no longer needs the personal data for the purposes of the processing but you need them for the establishment, exercise or defence of legal claims; or
(4) you object to the processing according to the section 21 paragraph1 of the GDPR and it is not yet clear whether the data controller's legitimate reasons for processing your data outweigh your interests.
If the processing of personal data concerning you has been restricted, then – apart from its storage – this data may only be processed with your consent or for the purposes of asserting, exercising or defending legal claims or protecting the rights of another natural or a legal person, or for reasons of an important public interest of the Union or a Member State.
If the processing restriction has been done in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.
- Right to Deletion
You have the right to demand that the data controller deletes your personal data immediately, and the data controller must do so without any delay if any of the following reasons applies:
(1) The personal data concerning you is no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent, upon which the processing was based in accordance with the section 6 paragraph1 lit.a or the section 9 paragraph2 lit. a of the GDPR and there's no other legal basis for the processing.
(3) You object to its processing in accordance with the section 21 paragraph1 of the GDPR, and there are no overriding legitimate reasons for its continued processing, or you submit an objection to its processing in accordance with the section 21 paragraph2 of the GDPR.
(4) The personal data concerning you have been processed unlawfully.
(5) Your personal data must be deleted in order to comply with a legal obligation under Union or Member State law to which the data controller is subject.
6) The personal data concerning you have been processed in relation to information society services offered in accordance with the section 8 paragraph1 of the GDPR.
If the data controller has made your personal data public and is required to delete it in accordance with the section 17 paragraph1 of the GDPR, it shall take reasonable steps, including technical measures, to inform data controllers processing the personal data that you, as the data subject, have requested the deletion of all links to, or copies or replications of, those personal data, by taking into account the available technology and the cost of implementation.
The right to deletion doesn't exist if processing is necessary
(1) for the exercise of the right to freedom of expression and information;
(2) for the compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the field of public health in accordance with the section 9 paragraph2 lit. h and i, as well as in accordance with the section 9 paragraph3 of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes according to the section 89 paragraph1 of the GDPR, insofar as the right referred to under item a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or
(5) for the establishment, exercise or defence of any legal claims of any kind.
- Right to Information
If you have asserted the right to rectification, deletion, or restriction of processing against the data controller, the data controller will be obliged to communicate this rectification or deletion of the data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or requires a disproportionate effort.
You have the right against the data controller to be informed about who these recipients are.
- Right to Data Portability
You have the right to obtain a copy of the personal data you have put at disposal of the data controller in a structured, commonly used, machine-readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data has been given, if
(1) the processing is based on consent given in accordance with the section 6 paragraph1 lit. a of the GDPR or in accordance with the section 9 paragraph2 lit. a of the GDPR or on a contract according to the section 6 paragraph1 lit. b of the GDPR and
(2) the processing is carried out with the aid of using automated procedures.
In exercising this right, you also have the right to have the data controller transfer your personal data directly to another data controller if this is technically feasible. This action must not affect the freedoms and rights of other persons.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller.
- Right to Object
You have the right, for reasons arising from your specific situation to object to the processing of personal data concerning you at any time carried out in accordance with the section 6 paragraph1 lit. e or f of the GDPR; this also applies to profiling based on these provisions.
The data controller will no longer process the personal data relating to you unless they can prove a compelling, legitimate reason for this which outweighs your interests, rights, and freedoms or the processing serves to assert, exercise, or defend any legal claims.
You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures by using technical specifications.
- The right to revoke the declaration of consent under data protection law
You have the right to revoke a declaration of consent granted under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.
- Right to file a legal complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes the principles of the GDPR.
The supervisory authority to which the complaint has been lodged shall inform you of the status and outcome of the complaint, including the possibility of a judicial remedy according to the section 78 of the GDPR.